URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Submission: On October 30 via api from CH

Summary

This website contacted 67 IPs in 6 countries across 52 domains to perform 318 HTTP transactions. The main IP is 23.210.249.64, located in Cambridge, United States and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on October 16th 2018. Valid for: 8 months.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 23.210.249.64 16625 (AKAMAI-AS)
63 23.210.249.69 16625 (AKAMAI-AS)
6 104.96.33.116 16625 (AKAMAI-AS)
2 2.18.234.21 16625 (AKAMAI-AS)
4 104.98.131.27 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 13.32.223.3 16509 (AMAZON-02)
2 52.72.136.100 14618 (AMAZON-AES)
6 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
16 216.58.210.2 15169 (GOOGLE)
1 54.171.28.28 16509 (AMAZON-02)
15 68.232.35.180 15133 (EDGECAST)
1 2a02:26f0:e7:... 20940 (AKAMAI-ASN1)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
3 94.31.29.248 33438 (HIGHWINDS2)
2 108.161.188.128 33438 (HIGHWINDS2)
5 52.31.106.135 16509 (AMAZON-02)
3 64.30.230.22 6623 (CBSI-1)
4 2400:cb00:204... 13335 (CLOUDFLAR...)
3 23.67.133.222 20940 (AKAMAI-ASN1)
1 2600:9000:20b... 16509 (AMAZON-02)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 34.231.154.145 14618 (AMAZON-AES)
1 4 66.117.28.68 15224 (OMNITURE)
1 54.171.47.36 16509 (AMAZON-02)
2 2 23.60.196.160 16625 (AKAMAI-AS)
2 2 34.199.78.214 14618 (AMAZON-AES)
1 1 23.210.249.113 16625 (AKAMAI-AS)
1 1 34.251.108.175 16509 (AMAZON-02)
2 3 34.246.247.78 16509 (AMAZON-02)
2 3 52.57.223.246 16509 (AMAZON-02)
4 52.31.219.56 16509 (AMAZON-02)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2a05:f500:10:... 14413 (LINKEDIN)
1 54.154.175.204 16509 (AMAZON-02)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 34.249.86.253 16509 (AMAZON-02)
2 63.140.43.37 15224 (OMNITURE)
1 54.76.196.204 16509 (AMAZON-02)
1 2a02:26f0:10:... 20940 (AKAMAI-ASN1)
1 23.211.152.143 16625 (AKAMAI-AS)
1 2 104.84.146.193 16625 (AKAMAI-AS)
1 23.45.101.171 20940 (AKAMAI-ASN1)
1 2 34.242.76.181 16509 (AMAZON-02)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 2 66.117.28.86 15224 (OMNITURE)
1 1 216.58.206.2 15169 (GOOGLE)
2 184.30.223.226 20940 (AKAMAI-ASN1)
2 151.101.120.134 54113 (FASTLY)
1 1 172.217.22.34 15169 (GOOGLE)
1 9 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
5 185.33.223.83 29990 (ASN-APPNEXUS)
1 23.211.9.164 16625 (AKAMAI-AS)
2 2a03:2880:f12... 32934 (FACEBOOK)
12 2a00:1450:400... 15169 (GOOGLE)
11 2.18.235.40 16625 (AKAMAI-AS)
24 2a00:1450:400... 15169 (GOOGLE)
4 23.67.129.200 20940 (AKAMAI-ASN1)
1 2.18.233.143 16625 (AKAMAI-AS)
1 213.19.162.21 26667 (RUBICONPR...)
3 213.19.162.31 26667 (RUBICONPR...)
2 213.19.162.67 26667 (RUBICONPR...)
2 213.19.162.27 26667 (RUBICONPR...)
1 34.226.72.85 14618 (AMAZON-AES)
4 95.101.57.157 16625 (AKAMAI-AS)
2 216.58.210.6 15169 (GOOGLE)
8 52.56.60.241 16509 (AMAZON-02)
20 23.210.250.213 16625 (AKAMAI-AS)
2 13.32.223.143 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
318 67
Apex Domain
Subdomains
Transfer
63 cbsistatic.com
zdnet1.cbsistatic.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
zdnet4.cbsistatic.com
686 KB
36 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
1 MB
26 doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
107 KB
20 moatpixel.com
cbsdfp5832910442.s.moatpixel.com
8 KB
19 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
872 KB
17 rubiconproject.com
ads.rubiconproject.com
optimized-by.rubiconproject.com
beacon-eu-ams3.rubiconproject.com
s.update.rubiconproject.com
eus.rubiconproject.com
37 KB
15 tiqcdn.com
tags.tiqcdn.com
90 KB
9 ml314.com
ml314.com
in.ml314.com
15 KB
7 google.com
adservice.google.com
www.google.com
1 KB
7 google.de
adservice.google.de
www.google.de
1 KB
6 demdex.net
dpm.demdex.net
cbsi.demdex.net
5 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
6 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
som.cbsi.com Failed
13 KB
6 evidon.com
c.evidon.com
26 KB
5 adnxs.com
secure.adnxs.com
3 KB
5 cbsinteractive.com
vidtech.cbsinteractive.com
299 KB
5 zdnet.com
www.zdnet.com
90 KB
4 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
7 KB
4 lightboxcdn.com
www.lightboxcdn.com
122 KB
4 pagefair.com
asset.pagefair.com
stats.pagefair.com
6 KB
4 viglink.com
cdn.viglink.com
api.viglink.com
29 KB
4 go-mpulse.net
c.go-mpulse.net
58 KB
3 scorecardresearch.com
sb.scorecardresearch.com
1 KB
3 facebook.com
graph.facebook.com
www.facebook.com
802 B
3 eyeota.net
ps.eyeota.net
854 B
3 tru.am
tru.am
beacon.tru.am
15 KB
3 everestjs.net
www.everestjs.net
6 KB
2 2mdn.net
s0.2mdn.net
92 KB
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 disqus.com
zdnet-1.disqus.com
2 KB
2 akstat.io
22ffaa5b.akstat.io
36e4f0eb.akstat.io
708 B
2 facebook.net
connect.facebook.net
33 KB
2 rlcdn.com
idsync.rlcdn.com
610 B
2 bluekai.com
tags.bluekai.com
1 KB
2 agkn.com
js.agkn.com
d.agkn.com
3 KB
2 pagefair.net
asset.pagefair.net
888 B
2 betrad.com
l.betrad.com
240 B
2 googletagservices.com
www.googletagservices.com
9 KB
1 googleapis.com
imasdk.googleapis.com
1 yieldmanager.com
ad.yieldmanager.com
1 KB
1 googleadservices.com
www.googleadservices.com
252 B
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
13 KB
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 linkedin.com
www.linkedin.com
388 B
1 crwdcntrl.net
sync.crwdcntrl.net
348 B
1 mathtag.com
pixel.mathtag.com
457 B
1 akamaihd.net
iicbsi-a.akamaihd.net
268 B
1 adsrvr.org
match.adsrvr.org
512 B
1 sharethrough.com
native.sharethrough.com
106 KB
1 indexww.com
js-sec.indexww.com
26 KB
0 taboola.com Failed
cdn.taboola.com Failed
0 cbsimg.net Failed
b2b.cbsimg.net Failed
318 52
Domain Requested by
24 pagead2.googlesyndication.com securepubads.g.doubleclick.net
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
www.zdnet.com
20 cbsdfp5832910442.s.moatpixel.com
19 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
18 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
16 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.zdnet.com
15 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
13 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
pagead2.googlesyndication.com
zdnet3.cbsistatic.com
13 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
pagead2.googlesyndication.com
12 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.zdnet.com
10 z.moatads.com securepubads.g.doubleclick.net
9 googleads.g.doubleclick.net 1 redirects pagead2.googlesyndication.com
8 geo.moatads.com z.moatads.com
8 ml314.com 2 redirects tags.tiqcdn.com
ml314.com
6 adservice.google.com www.googletagservices.com
pagead2.googlesyndication.com
6 adservice.google.de www.googletagservices.com
pagead2.googlesyndication.com
6 c.evidon.com www.zdnet.com
c.evidon.com
5 secure.adnxs.com js-sec.indexww.com
5 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
vidtech.cbsinteractive.com
5 www.zdnet.com 1 redirects zdnet3.cbsistatic.com
vidtech.cbsinteractive.com
4 eus.rubiconproject.com www.zdnet.com
4 beacon-eu-ams3.rubiconproject.com www.zdnet.com
4 optimized-by.rubiconproject.com ads.rubiconproject.com
4 ads.rubiconproject.com www.zdnet.com
4 dpm.demdex.net tags.tiqcdn.com
vidtech.cbsinteractive.com
4 pixel.everesttech.net 1 redirects
4 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
4 c.go-mpulse.net www.zdnet.com
c.go-mpulse.net
zdnet1.cbsistatic.com
3 sb.scorecardresearch.com 1 redirects tags.tiqcdn.com
3 ps.eyeota.net 2 redirects
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
3 dw.cbsi.com tags.tiqcdn.com
3 asset.pagefair.com zdnet3.cbsistatic.com
asset.pagefair.com
3 cdn.viglink.com tags.tiqcdn.com
2 cdn-gl.imrworldwide.com vidtech.cbsinteractive.com
cdn-gl.imrworldwide.com
2 s0.2mdn.net zdnet2.cbsistatic.com
s0.2mdn.net
2 www.facebook.com connect.facebook.net
2 as-sec.casalemedia.com js-sec.indexww.com
2 zdnet-1.disqus.com zdnet2.cbsistatic.com
zdnet-1.disqus.com
2 cm.everesttech.net 2 redirects
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 secure-us.imrworldwide.com 1 redirects
2 saa.cbsi.com tags.tiqcdn.com
2 cbsi.demdex.net tags.tiqcdn.com
2 idsync.rlcdn.com 2 redirects
2 tags.bluekai.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 asset.pagefair.net zdnet3.cbsistatic.com
2 l.betrad.com www.zdnet.com
2 www.googletagservices.com www.zdnet.com
rev.cbsi.com
1 px.moatads.com
1 imasdk.googleapis.com s0.2mdn.net
1 s.update.rubiconproject.com www.zdnet.com
1 rev.cbsi.com www.zdnet.com
1 36e4f0eb.akstat.io c.go-mpulse.net
1 ad.yieldmanager.com
1 www.google.de
1 www.google.com 1 redirects
1 www.googleadservices.com 1 redirects
1 22ffaa5b.akstat.io zdnet1.cbsistatic.com
1 cm.g.doubleclick.net 1 redirects
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 stats.pagefair.com zdnet3.cbsistatic.com
1 beacon.tru.am tru.am
1 api.viglink.com cdn.viglink.com
1 www.linkedin.com zdnet3.cbsistatic.com
1 graph.facebook.com zdnet3.cbsistatic.com
1 sync.crwdcntrl.net 1 redirects
1 pixel.mathtag.com 1 redirects
1 d.agkn.com js.agkn.com
1 in.ml314.com ml314.com
1 js.agkn.com tags.tiqcdn.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 match.adsrvr.org js-sec.indexww.com
1 native.sharethrough.com www.zdnet.com
1 js-sec.indexww.com www.zdnet.com
0 cdn.taboola.com Failed zdnet2.cbsistatic.com
0 som.cbsi.com Failed vidtech.cbsinteractive.com
0 b2b.cbsimg.net Failed
318 79
Subject Issuer Validity Valid
www.cbs.com
GeoTrust RSA CA 2018
2018-10-16 -
2019-06-22
8 months crt.sh
cc.cnetcontent.com
DigiCert SHA2 Secure Server CA
2018-10-05 -
2020-01-04
a year crt.sh
*.evidon.com
DigiCert ECC Secure Server CA
2018-02-02 -
2019-04-02
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2018-04-16 -
2019-02-06
10 months crt.sh
akstat.io
DigiCert ECC Secure Server CA
2018-03-12 -
2019-05-11
a year crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2018-10-09 -
2019-01-01
3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2
2017-09-18 -
2018-11-17
a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2
2017-04-25 -
2019-06-24
2 years crt.sh
*.google.com
Google Internet Authority G3
2018-10-09 -
2019-01-01
3 months crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2017-02-15 -
2019-04-19
2 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2017-10-25 -
2020-05-13
3 years crt.sh
a248.e.akamai.net
DigiCert ECC Secure Server CA
2018-01-23 -
2019-01-19
a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-09-22 -
2019-03-31
6 months crt.sh
asset.pagefair.com
Let's Encrypt Authority X3
2018-10-29 -
2019-01-27
3 months crt.sh
asset.pagefair.net
Let's Encrypt Authority X3
2018-10-29 -
2019-01-27
3 months crt.sh
*.ml314.com
Amazon
2018-04-14 -
2019-05-14
a year crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA
2017-11-07 -
2021-02-04
3 years crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-10-06 -
2019-04-14
6 months crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA
2018-10-15 -
2020-10-15
2 years crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2018-06-21 -
2020-09-16
2 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-08-08 -
2019-02-14
6 months crt.sh
www.eyeota.com
COMODO RSA Domain Validation Secure Server CA
2018-02-12 -
2021-02-11
3 years crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2017-12-15 -
2019-03-22
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2018-05-30 -
2020-09-01
2 years crt.sh
viglink.com
Amazon
2018-03-09 -
2019-04-09
a year crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA
2018-05-19 -
2019-08-22
a year crt.sh
*.pagefair.com
Gandi Standard SSL CA 2
2016-11-02 -
2018-11-20
2 years crt.sh
*.urbanairship.com
DigiCert SHA2 Secure Server CA
2018-04-17 -
2019-07-17
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2017-12-06 -
2018-12-26
a year crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2018-10-08 -
2021-01-06
2 years crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2018-02-15 -
2019-07-11
a year crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA
2017-04-13 -
2020-04-17
3 years crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh
www.google.de
Google Internet Authority G3
2018-10-09 -
2019-01-01
3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA
2018-07-05 -
2019-01-10
6 months crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2018-01-25 -
2019-01-25
a year crt.sh
tpc.googlesyndication.com
Google Internet Authority G3
2018-10-16 -
2019-01-08
3 months crt.sh
moatads.com
DigiCert ECC Secure Server CA
2018-01-09 -
2019-01-09
a year crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2016-01-12 -
2019-03-01
3 years crt.sh
kazfv.com
COMODO ECC Domain Validation Secure Server CA
2018-07-20 -
2019-07-20
a year crt.sh
*.doubleclick.net
Google Internet Authority G3
2018-10-16 -
2019-01-08
3 months crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2018-04-27 -
2019-04-27
a year crt.sh
*.googleapis.com
Google Internet Authority G3
2018-10-16 -
2019-01-08
3 months crt.sh

This page contains 36 frames:

Primary Page: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Frame ID: DE58158DCF84D867220F3566C16E426E
Requests: 213 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 4AF2A53FAF5EE0802474BF168F577BE0
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1540899673216&lv=1
Frame ID: CDD15535CBFB2B83049C0898C735EE63
Requests: 2 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 7DA76D6D489BE0C6FF7275430F9ACB20
Requests: 1 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/8613/?che=13663174&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bpid=cbsinteractive&c=%7B%22bpid%22%3A%22cbsinteractive%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Frame ID: B20DBC0A783825520B569DF950E0A4D4
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 3175008CF90511EA8925E036AD19D815
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: B6987249C413CEA1A3C581EF5ED346EE
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=1&prev=0&cb=636752339805538198
Frame ID: E558A339E92ADABCF94D11BD947B0EED
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: D34007ECCCB5D477F99FE2D033E26DDD
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Frame ID: 85BE4D5DE3BD1B563354C379AA19B4D8
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Frame ID: DD1644D2E1A8890D9D5D29593DF83D21
Requests: 4 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: FCD5D0B7501E6D1175794F03EC644969
Requests: 15 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: C7A08143D21591C49730F1CDF2BE8F97
Requests: 15 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: BD0936DEAF2B24FB1AE32B22DD0D10E0
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Frame ID: 717BAF128DEFF555A783F35B84D7D737
Requests: 4 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: CFCBCA064479DCB99307A852DABF624F
Requests: 15 HTTP requests in this frame

Frame: https://rev.cbsi.com/common/js/adKit.min.js?447502830
Frame ID: 48AFAA42994A649C471A4379338CF699
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Frame ID: 810F5192B5E4E7503E316A2E65C51E85
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 3EB3E1DDA4C7CCF64FC9B92B649F5E68
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Frame ID: 6976AAE0B2EB593A58BEABD4F0700FB4
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 5278B20E87F34297D7640F24D311ACDC
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Frame ID: 613DDAEC5A1163DA77C735508CADA7FA
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: DE5302CF6759279BF569DA5342E26CCD
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Frame ID: D23ED40F8D029640AAE91DD0E1AE19D7
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: D9707DC947513E8D3FAFEDFDDAD96E33
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Frame ID: 6E9ED963AADEF089FFC163C3D822F415
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Frame ID: 91D50971C5DA31CECFD958955D9D78F1
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Frame ID: A7A7B6FFE634708015CA1464D9DDF9E4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151325&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678046&bpp=72&bdt=1435&fdt=3472&idt=3462&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=2&ga_vid=254076611.1540899682&ga_sid=1540899682&ga_hid=1939467065&ga_fc=0&iag=3&icsg=693856&nhd=1&dssz=21&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=5494&biw=1585&bih=1200&isw=728&ish=90&ifk=1649710351&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C214678000&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3550
Frame ID: DDADEFD174C77D8137EA0DFD6D3A9BA2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Frame ID: 3D399A74E4A99F3B64A5EAD7FD2254C0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151321&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678160&bpp=70&bdt=1571&fdt=3514&idt=3496&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=409345978.1540899682&ga_sid=1540899682&ga_hid=349311542&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=2834320770&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3610
Frame ID: 7E0C73207B51E2FE97B6AD25A5450078
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Frame ID: 23B4609CE3396472F9CDFF24BB7AA568
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151327&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678610&bpp=205&bdt=2008&fdt=3376&idt=3328&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1634682474.1540899682&ga_sid=1540899682&ga_hid=1238526953&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1501&biw=1585&bih=1200&isw=300&ish=250&ifk=1789179933&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3434
Frame ID: FD4D1C6EFA7CB5321EC6BFB052609A38
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Frame ID: 6D66C8AB86E4B76636711779E7E89F25
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151326&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678893&bpp=155&bdt=2293&fdt=3184&idt=3175&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1562241744.1540899682&ga_sid=1540899682&ga_hid=231920648&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2180882631&scr_x=0&scr_y=0&eid=20195144%2C21060853%2C21070025%2C370204018&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3208
Frame ID: 963F9A5F173DACA384D25C4DF5E2432A
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.249.0_en.html
Frame ID: 7E6CB0CB861327644140E32595804DF3
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazi... HTTP 301
    https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazi... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • env /^requirejs$/i

Overall confidence: 100%
Detected patterns
  • env /pbjs/i

Overall confidence: 100%
Detected patterns
  • env /^DISQUS/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i

Overall confidence: 100%
Detected patterns
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • env /^googletag$/i

Overall confidence: 100%
Detected patterns
  • env /^Modernizr$/i

Overall confidence: 100%
Detected patterns
  • env /^optimizely$/i

Overall confidence: 100%
Detected patterns
  • env /^SWFObject$/i

Overall confidence: 100%
Detected patterns
  • env /^s_(?:account|objectID|code|INST)$/i


Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

318
Requests

97 %
HTTPS

28 %
IPv6

52
Domains

79
Subdomains

67
IPs

6
Countries

3861 kB
Transfer

12221 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks HTTP 301
    https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 81
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 88
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151442367944761&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151442367944761%26eid=50056 HTTP 302
  • https://tags.bluekai.com/site/20486?dt=0&r=198135980&sig=551788948&bkca=KJpn0zpBnnWND1+1LEVNBnzyBeD61EW0BMmlBeWhBpBDv6oB0u00puQovuit6+4wpEWtBBanpLdPE0brpWFVu0pm3a9N5ALgLaVJ5dvmeylN5aWN1i+/nugmpTFcqiJxwCDARtOQSQR9dLxM0Q== HTTP 302
  • https://ml314.com/csync.ashx?fp=QAIAPQ9999O4W2Cq&person_id=5978151442367944761&eid=50056
Request Chain 89
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151442367944761 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ0MjM2Nzk0NDc2MRAAGg0I2obh3gUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=&person_id=5978151442367944761&eid=50082
Request Chain 90
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151442367944761%26eid=50220 HTTP 302
  • https://ml314.com/csync.ashx?fp=3f135bd8-3b5a-4200-a3a0-3ecfd67ed7e0&person_id=5978151442367944761&eid=50220
Request Chain 91
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151442367944761 HTTP 302
  • https://ml314.com/csync.ashx?fp=daea6cafc99f9bec0d65ce3b522287b2&eid=50146&person_id=5978151442367944761
Request Chain 92
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2HVgO8y02gaDWZVFo2zAO88C27O2ziNkRPkmoC6QdWsA&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
  • https://ml314.com/csync.ashx?fp=2HVgO8y02gaDWZVFo2zAO88C27O2ziNkRPkmoC6QdWsA&person_id=5978151442367944761&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Request Chain 135
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&c9=
Request Chain 139
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compact&rnd=1540899674941 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compact&rnd=1540899674941&ja=1
Request Chain 145
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=VzloRFdRQUFBVjdkSEBuRA HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEIWAk9z2BMrlZvSsNVmtz5w&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 151
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=W0PYW9yIE4j4gAeQ87iQAg&random=1213313701&sscte=1&crd=CKrPGwiC0BsIidIb&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=3084154190 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=3084154190&ipr=y

318 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Redirect Chain
  • https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks
  • https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
228 KB
58 KB
Document
General
Full URL
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6e54e138b6fae2de8311caa399c9f4459f413e0009123f07e5e8c4c855e500f5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
cookie
aam_uuid=74926206232441188180716735996261109217; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; _fbp=fb.1.1540899669804.1874514021
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
set-cookie
ak_bmsc=4DB66A3164A7DC2847B15D8B2695174D48F7B3641F6100005643D85BF894B60F~plazfXEeWcx1UXM/q/316LJcyGdDYjfxcPvo8qQlVhwQAQuyeJiv5fBlj5aZpkbudLSFC/7OyuMvNt4vmaMsxrw15zaEhz9cn55I5Qjv3y2WR+4w5TFPH/ntDEj+ahs6gFEGKSWWL1LyS8F0RTv2eZ6R6iQNuwcEA4nY/7oFGqOsmmFAWFbX3gYnUG2S1WL9YJgCbPr/Fn9j5EHdnFt3BebJX+M+akCAzJcD2D+w4YJbg=; expires=Tue, 30 Oct 2018 13:41:10 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly nemo_highlander-video_focus=video_focus%3a1%3aexclude; expires=Tue, 06 Nov 2018 07:59:59 GMT; path=/; domain=.zdnet.com; secure; bm_mi=1967C0463FE9C4B298ECD7C6FEBBD78E~uYSLpIlvXNPyorCATevpk0NnH5c37qCM8clOVyksSayXlnBel5qnVVFQLfhICmFMDARLLwkT8sDPzAJSJ1kkVV4uG0kr8n4OF40bmfr0BT1a2Pzf1KD2OyMAeuv877zDAaKgGGmxFcj3AlLDvb1SUh6O1kpBxq1yXQSzbZCe8D9wujjqEd1lcvglWvGXUNYvlea9Hpp0AxUc0svw8uSJ0Ggc0Nytvdu4Hq6dQFyyoJTrRTQCrFsTOWjVdJbjtRYBEA8l8l7Cp3ambXPbGBl655lssK/CbU+CZ10ZyUTFeqzycbu0y+w00f47vdsNr1/Gux7SicOwDQPjh6P3cGTkNA==; Domain=.zdnet.com; Path=/; Max-Age=0; HttpOnly bm_mi=1967C0463FE9C4B298ECD7C6FEBBD78E~uYSLpIlvXNPyorCATevpk0NnH5c37qCM8clOVyksSayXlnBel5qnVVFQLfhICmFMDARLLwkT8sDPzAJSJ1kkVV4uG0kr8n4OF40bmfr0BT3shDqIMYHzW6tFZxyGayO7MMBMrQ8G8Ab0pI/zKRrOBHOrw5BNWDJ2DHxSVSLm5uIfQNnF3PBiEX578n5+HIxfHOYxDLnQIg1Y0WGtT54KPK2wVFSaMuAuWus6YqgTXgipdCK640oh8f+Yd4juFIhjrBeEv/903uopxz/OCjrf294GXXPPrX478WSDJWxaqgHuk7EzQBUIjOZa8mvaIixoaRubo8Ib/SEmEIE5RAO9vg==; Domain=.zdnet.com; Path=/; Max-Age=0; HttpOnly
x-enable-esi
true
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding, User-Agent
x-akamai-transformed
9 2872 0 pmb=mTOE,2
access-control-allow-origin
https://www.zdnet.com
x-frame-options
SAMEORIGIN
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
expires
Tue, 30 Oct 2018 11:39:51 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
referrer-policy
no-referrer-when-downgrade
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-tx-id
6b431e4a-53e9-40de-84c9-cb11949c39d4
content-encoding
gzip
date
Tue, 30 Oct 2018 11:41:10 GMT

Redirect headers

status
301
server
nginx
content-type
text/html
content-length
178
location
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
access-control-allow-origin
https://www.zdnet.com
date
Tue, 30 Oct 2018 11:41:09 GMT
set-cookie
fly_device=desktop; expires=Tue, 06-Nov-2018 11:41:09 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Tue, 06-Nov-2018 11:41:09 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary
Accept-Encoding, User-Agent
strict-transport-security
max-age=63072000; includeSubDomains; preload
main-6743c8f11b-rev.css
zdnet1.cbsistatic.com/fly/1531-fly/css/core/
340 KB
62 KB
Stylesheet
General
Full URL
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1850ed533f7bef263c3b15379882c2ff9a33ac1d097864dd0c600633665f334d

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:41:02 GMT
server
nginx
etag
W/"5bd7462e-5507b"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
63430
expires
Tue, 06 Nov 2018 11:41:10 GMT
controls-ebaf8ad91a-rev.css
zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/
42 KB
7 KB
Stylesheet
General
Full URL
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ebaf8ad91a-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b47241eabf30c18bf1761e363bdc9e5b755ea4b60d71ca9d1a0b3c4f7ffefdb7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:41:16 GMT
server
nginx
etag
W/"5bd7463c-a910"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
6704
expires
Tue, 06 Nov 2018 11:41:10 GMT
catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/
910 B
1 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
server
nginx
status
200
etag
"c3829e4116c9d009ce51c32b304b9e46"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
public, max-age=26578272, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
868
5b72aa0160b2e1568893d64a-1280x7201aug152018113829poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2018/08/15/691aecd3-728b-47a4-abe2-3742b658b4b1/thumbnail/570x322/444fcf3d71222b689b04787946295715/
7 KB
7 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/08/15/691aecd3-728b-47a4-abe2-3742b658b4b1/thumbnail/570x322/444fcf3d71222b689b04787946295715/5b72aa0160b2e1568893d64a-1280x7201aug152018113829poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0d6baa46c3cd463a5d3f967d89f7cf48d5909c34b22f6d671cc9f0c4f929611c

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Wed, 15 Aug 2018 11:52:32 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31536000
timing-allow-origin
*
content-length
6765
expires
Wed, 30 Oct 2019 11:41:10 GMT
advertisement.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/
53 B
280 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Thu, 01 Mar 2018 17:42:54 GMT
server
nginx
etag
"5a983b9e-35"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
71
expires
Tue, 06 Nov 2018 11:41:10 GMT
brazil-botnet-log.png
zdnet4.cbsistatic.com/hub/i/r/2018/09/30/7555210c-aeb1-48bb-946b-3f8e992d040c/resize/370xauto/40b9a8e2f51fd67c056d19136e0bf20e/
150 KB
150 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/09/30/7555210c-aeb1-48bb-946b-3f8e992d040c/resize/370xauto/40b9a8e2f51fd67c056d19136e0bf20e/brazil-botnet-log.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
61fdf37d30bf412dd87c52565f2b227ce9c3b57030950437fd0bd650d11bc035

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
server
nginx
status
200
etag
"c25007eca40e6838db7ef8e80145c70f"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
public, max-age=31535993, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
a-1-dhs.jpg
zdnet4.cbsistatic.com/hub/i/r/2018/07/24/7aa8a1bb-780a-4d41-9464-2427956f7a6d/thumbnail/170x128/67b517226b29a2c342262671913d5966/
8 KB
9 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/07/24/7aa8a1bb-780a-4d41-9464-2427956f7a6d/thumbnail/170x128/67b517226b29a2c342262671913d5966/a-1-dhs.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4ab6a27e7fab0d1aa86e5fb3cef44c53865862b2c8d6c076ee44409a12e6b644

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Tue, 24 Jul 2018 13:43:38 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27794913
timing-allow-origin
*
content-length
8605
expires
Tue, 17 Sep 2019 04:29:43 GMT
a-2-fedex.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/07/24/dd303a4a-5b12-4709-bef7-a35b361d8799/thumbnail/170x128/340415a9086f0e182e4b49fa34c6e277/
6 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/07/24/dd303a4a-5b12-4709-bef7-a35b361d8799/thumbnail/170x128/340415a9086f0e182e4b49fa34c6e277/a-2-fedex.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d05a0088d1a2c67e0707be3f7ff1823683ba849a3d3d4004d971cb58eb40d08a

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:16 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27792651
timing-allow-origin
*
content-length
6301
expires
Tue, 17 Sep 2019 03:52:01 GMT
a-3-orbitz.jpg
zdnet1.cbsistatic.com/hub/i/r/2018/07/24/a80ee1f5-4daa-4d79-9f51-e490df5e4e78/thumbnail/170x128/5b7f27009156f63c204e0bb342bf80e2/
5 KB
5 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/07/24/a80ee1f5-4daa-4d79-9f51-e490df5e4e78/thumbnail/170x128/5b7f27009156f63c204e0bb342bf80e2/a-3-orbitz.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6777cc97d90b6e3773b62f12dfc047362dd55f7610369239eafd46c109cd5380

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:16 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27792854
timing-allow-origin
*
content-length
5115
expires
Tue, 17 Sep 2019 03:55:24 GMT
a-4-aadhaar.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/07/24/3c85daea-5f11-4c91-a118-4fb0e51a1436/thumbnail/170x128/3f448909d2b440331eb0428dccbd624b/
6 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/07/24/3c85daea-5f11-4c91-a118-4fb0e51a1436/thumbnail/170x128/3f448909d2b440331eb0428dccbd624b/a-4-aadhaar.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2651576977d18928324a68a053a929a1acddffbbc6a04c8face239c5b489b34a

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:16 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27792742
timing-allow-origin
*
content-length
5937
expires
Tue, 17 Sep 2019 03:53:32 GMT
a-5-lexpress.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/07/24/474ea969-3cc4-4e1c-bc66-a98fe8264033/thumbnail/170x128/5aee2ed8558e0adb2c8e84b318597a04/
6 KB
6 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/07/24/474ea969-3cc4-4e1c-bc66-a98fe8264033/thumbnail/170x128/5aee2ed8558e0adb2c8e84b318597a04/a-5-lexpress.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ee58d451d4c826e171525a0fb417343a42ae338fd8afb6b77613235476f89dfe

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:16 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27792591
timing-allow-origin
*
content-length
5631
expires
Tue, 17 Sep 2019 03:51:01 GMT
burgess-macgibbon.png
zdnet3.cbsistatic.com/hub/i/r/2018/05/30/bfbf0b33-c0c8-41cd-a5f5-f56f66e2972b/thumbnail/170x128/cfe30ce517576a41e1aa67d7124b036a/
38 KB
39 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/05/30/bfbf0b33-c0c8-41cd-a5f5-f56f66e2972b/thumbnail/170x128/cfe30ce517576a41e1aa67d7124b036a/burgess-macgibbon.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2bb8e607aa914110121eb1e2d4a65514285c78342811558156449443f644cf7b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Wed, 30 May 2018 02:19:54 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31495954
timing-allow-origin
*
content-length
39249
expires
Wed, 30 Oct 2019 00:33:44 GMT
recaptchav3.png
zdnet1.cbsistatic.com/hub/i/r/2018/10/30/c23ac0b1-25b8-447a-8425-75e04bce7b0f/thumbnail/170x128/f6737f13d21313c4decedacde0a58f60/
6 KB
6 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/10/30/c23ac0b1-25b8-447a-8425-75e04bce7b0f/thumbnail/170x128/f6737f13d21313c4decedacde0a58f60/recaptchav3.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3988f709c09d423be46f08ad2547895597522365a2ef41a233f6d270d284e5a6

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
server
nginx
status
200
etag
"17b65afe58c49edc1bdd812c554ee3bb"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
public, max-age=31494821, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
5954
security-privacy-hackers-locks-key-6778.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/01/25/b953bd40-15b0-4720-bcd3-6f29f7a3bb16/thumbnail/170x128/6c6c20d56ceb4c89448ec8c281ff4627/
6 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/01/25/b953bd40-15b0-4720-bcd3-6f29f7a3bb16/thumbnail/170x128/6c6c20d56ceb4c89448ec8c281ff4627/security-privacy-hackers-locks-key-6778.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f158dee56c879e346479ff65c3a3f9135fbae73d8757264df8239dd0e5809e95

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Fri, 08 Jun 2018 05:16:54 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31490967
timing-allow-origin
*
content-length
5359
expires
Tue, 29 Oct 2019 23:10:37 GMT
hero-opensource.jpg
zdnet2.cbsistatic.com/hub/i/r/2014/12/29/6c38a8b1-94eb-48fb-abd6-426d6cbb4c85/thumbnail/170x128/d4fee7edc71b7d390eaf564eb7b2960d/
9 KB
8 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2014/12/29/6c38a8b1-94eb-48fb-abd6-426d6cbb4c85/thumbnail/170x128/d4fee7edc71b7d390eaf564eb7b2960d/hero-opensource.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
453cb692f7616556511f28fdf07f53d8e36e149c0e71941b04fed49d3f1ed4b1

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Tue, 17 Oct 2017 13:24:17 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31466505
timing-allow-origin
*
content-length
8431
expires
Tue, 29 Oct 2019 16:22:55 GMT
urna.jpg
zdnet4.cbsistatic.com/hub/i/r/2018/10/29/1a9c4493-54b4-414c-b05f-e2bb345f12e5/thumbnail/170x128/70457828e9be8e9b75af2d2056438a8a/
7 KB
7 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/10/29/1a9c4493-54b4-414c-b05f-e2bb345f12e5/thumbnail/170x128/70457828e9be8e9b75af2d2056438a8a/urna.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d87e7ae7ae26449d10b981391c33bcb99233194abe70be20d2da093e1bde1215

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
server
nginx
status
200
etag
"80177fe965b78111f4dfee80cfdc3689"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
public, max-age=31490027, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
7012
ram-thumb.jpg
zdnet2.cbsistatic.com/hub/i/r/2017/12/19/81c5270a-5370-42e5-b6f7-6cd30ba350de/thumbnail/170x128/fdeb33b0eeac0ba16bfdf0e81f0d852d/
12 KB
11 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2017/12/19/81c5270a-5370-42e5-b6f7-6cd30ba350de/thumbnail/170x128/fdeb33b0eeac0ba16bfdf0e81f0d852d/ram-thumb.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c01a8a2706b50bde5231da184eaa7ad2fb277aa2fc94efd6945181cdac490db4

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Tue, 19 Dec 2017 18:13:37 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31480740
timing-allow-origin
*
content-length
11228
expires
Tue, 29 Oct 2019 20:20:10 GMT
istock-bank.jpg
zdnet1.cbsistatic.com/hub/i/r/2018/08/30/6e18d51e-2cdb-4c2f-bf60-b6ef2eefbca7/thumbnail/170x128/9a476cbcd2361c3aefc8752bec1c1e44/
8 KB
8 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/08/30/6e18d51e-2cdb-4c2f-bf60-b6ef2eefbca7/thumbnail/170x128/9a476cbcd2361c3aefc8752bec1c1e44/istock-bank.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
eb579f6589e12694342b61e319630262ef1bf724e1dd61e2e74e5416860f0c6c

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 15:04:00 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31472601
timing-allow-origin
*
content-length
7726
expires
Tue, 29 Oct 2019 18:04:31 GMT
vote.jpg
zdnet3.cbsistatic.com/hub/i/r/2017/09/14/e8bba12f-6963-4232-a99b-1e25d8363c2a/thumbnail/170x128/406f4f6e01a38c35788ec59343f6f049/
5 KB
5 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2017/09/14/e8bba12f-6963-4232-a99b-1e25d8363c2a/thumbnail/170x128/406f4f6e01a38c35788ec59343f6f049/vote.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
48f9f52eab0cf9438927a201b28ddc42bac3bda7080b80b0db4cc913fccb3514

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Thu, 14 Sep 2017 18:00:21 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31462639
timing-allow-origin
*
content-length
4952
expires
Tue, 29 Oct 2019 15:18:29 GMT
bugcode.jpg
zdnet3.cbsistatic.com/hub/i/r/2017/05/30/0196d722-9903-4486-a29b-293dd3e3a108/thumbnail/170x128/e6efaef3fd3d3796e64ec14110778c0b/
6 KB
6 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2017/05/30/0196d722-9903-4486-a29b-293dd3e3a108/thumbnail/170x128/e6efaef3fd3d3796e64ec14110778c0b/bugcode.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
cd63ae8e997a18c10bfd698381945cd74fcb8ae84e45fbcbbab48a37d9b33a1b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Wed, 12 Jul 2017 13:00:21 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31453901
timing-allow-origin
*
content-length
5846
expires
Tue, 29 Oct 2019 12:52:51 GMT
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1531-fly/js/libs/
16 KB
6 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:40:51 GMT
server
nginx
etag
W/"5bd74623-3f09"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
6305
expires
Tue, 06 Nov 2018 11:41:10 GMT
evidon-sitenotice-tag.js
c.evidon.com/sitenotice/
35 KB
10 KB
Script
General
Full URL
https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
89b08981d2dcbbc50524744f8d3beee8e325096b9030f5bbb0244f5e93bc57dc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:10 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Oct 2018 19:32:09 GMT
Server
Apache
ETag
"34aa447057e60d0ba6fc437edc504c4a:1540495929"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=86400, private;max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
9531
Expires
Wed, 31 Oct 2018 11:41:10 GMT
country.js
c.evidon.com/geo/
260 B
490 B
Script
General
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:10 GMT
Content-Encoding
gzip
Last-Modified
Wed, 30 May 2018 22:23:16 GMT
Server
Apache
ETag
"c1e367d098d326049811561575dbda4a:1527718996"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
165
snthemes.js
c.evidon.com/sitenotice/425/
65 KB
4 KB
Script
General
Full URL
https://c.evidon.com/sitenotice/425/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b50a701e3677d3b9810ddf2d0a775c976210f5c433926d515b24e0d62b6e3af4

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:10 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 Oct 2018 17:28:06 GMT
Server
Apache
ETag
"86a61dd217ea8f7fd69b9bda762e95e6:1539624486"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=86400, private;max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3602
Expires
Wed, 31 Oct 2018 11:41:10 GMT
settings.js
c.evidon.com/sitenotice/425/zdnet/
15 KB
2 KB
Script
General
Full URL
https://c.evidon.com/sitenotice/425/zdnet/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1b91058b5969c2319ee3f3efb2b91ccf388c64fe22f806e59b0edb43694150d4

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:10 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Aug 2018 21:08:55 GMT
Server
Apache
ETag
"09891370db88cdd3a58c49f5cd396b85:1535490535"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=86400, private;max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1239
Expires
Wed, 31 Oct 2018 11:41:10 GMT
truncated
/
917 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
mag-white01.png
zdnet2.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/core/
1 KB
1 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
etag
W/"5bd74555-4f1"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
936
expires
Tue, 06 Nov 2018 11:41:10 GMT
Raleway-Bold.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
25 KB
25 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bf413671ac4278a51bc9621af98e7f5a6cdbb228ecda66602f7e02ea27b28d13

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
last-modified
Wed, 20 Jun 2018 16:56:01 GMT
server
nginx
etag
"5b2a8721-6348"
status
200
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=23847113
accept-ranges
bytes
timing-allow-origin
*
content-length
25416
expires
Fri, 02 Aug 2019 11:53:03 GMT
Raleway-Regular.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
25 KB
25 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6987f5dab3ced7612887b80ca2de81041654a6434970e1cbbb03c293dd47ce0b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
last-modified
Wed, 20 Jun 2018 16:56:01 GMT
server
nginx
etag
"5b2a8721-6398"
status
200
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=23847132
accept-ranges
bytes
timing-allow-origin
*
content-length
25496
expires
Fri, 02 Aug 2019 11:53:22 GMT
Raleway-Light.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
25 KB
25 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7017fe26514320eea8b02069a2ec814953fc7f78d3513ab52c4c80108d112b56

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
last-modified
Wed, 20 Jun 2018 16:56:01 GMT
server
nginx
etag
"5b2a8721-63ac"
status
200
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=23847208
accept-ranges
bytes
timing-allow-origin
*
content-length
25516
expires
Fri, 02 Aug 2019 11:54:38 GMT
en.js
c.evidon.com/sitenotice/425/translations/
205 KB
7 KB
Script
General
Full URL
https://c.evidon.com/sitenotice/425/translations/en.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2b4b44954ecddf65e5391cb2df9f86cffc2979ebe88399bac1d61e5e918b8ed6

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:10 GMT
Content-Encoding
gzip
Last-Modified
Tue, 18 Sep 2018 15:06:56 GMT
Server
Apache
ETag
"c0ff937f678b15708f165faee2bf7d8f:1537283216"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=86400, private;max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6758
Expires
Wed, 31 Oct 2018 11:41:10 GMT
ring-animated.svg
zdnet3.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/video/
704 B
576 B
Image
General
Full URL
https://zdnet3.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/video/ring-animated.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ebaf8ad91a-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
status
200
etag
"5bd74555-2c0"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31478894
accept-ranges
bytes
timing-allow-origin
*
content-length
364
expires
Tue, 29 Oct 2019 19:49:24 GMT
play.svg
zdnet1.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/video/
299 B
424 B
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/video/play.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5e9dfd6066c2872be4f85c25aa0186402b124ea3f80152e2e2b767906793284

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ebaf8ad91a-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
status
200
etag
"5bd74555-12b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31478882
accept-ranges
bytes
timing-allow-origin
*
content-length
213
expires
Tue, 29 Oct 2019 19:49:12 GMT
Raleway-Black.woff2
zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/
25 KB
25 KB
Font
General
Full URL
https://zdnet1.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Black.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c9f9ded1c66d9f290eeb0fadad73f3bba0d8cc2c784b078e9b00eca200eca125

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:10 GMT
last-modified
Wed, 20 Jun 2018 16:56:01 GMT
server
nginx
etag
"5b2a8721-624c"
status
200
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=23847260
accept-ranges
bytes
timing-allow-origin
*
content-length
25164
expires
Fri, 02 Aug 2019 11:55:30 GMT
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
ls-zdnet.js
js-sec.indexww.com/ht/
85 KB
26 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d6e6bd9d40a807b7402dd2c2b74700d0790e0733718a4343c2a6fa140da3a62e

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:11 GMT
Content-Encoding
gzip
Last-Modified
Tue, 30 Oct 2018 11:15:06 GMT
Server
Apache
ETag
"9044a1-15269-579704c3f4713"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2251
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26182
Expires
Tue, 30 Oct 2018 12:18:42 GMT
logo.png
zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/core/
4 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
etag
W/"5bd74555-1009"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
4128
expires
Tue, 06 Nov 2018 11:41:11 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame 4AF2
187 KB
55 KB
Script
General
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.98.131.27 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-98-131-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:11 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
www.googletagservices.com/tag/js/
24 KB
9 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81c::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7cdcfff39260d66cc0fac190f66caf465044cba360fc5396cc98654f6d1cebc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"9 / 406 of 1000 / last-modified: 1540874150"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8986
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:11 GMT
sfp.js
native.sharethrough.com/assets/
365 KB
106 KB
Script
General
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.223.3 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-223-3.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0bf6182b8f4535dcbc60eee60753242d0c52a3eb6a5a7c8876205a60a4f051df

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 25 Oct 2018 23:45:13 GMT
content-encoding
gzip
last-modified
Thu, 25 Oct 2018 23:45:11 GMT
server
AmazonS3
age
3359
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
tkI5OZcOLfi2vMebfSUJxwV45Fb8kpkIung5hEJb0DEJhscliSp4cw==
via
1.1 c485b2484179f34bcbf59c066cc32b54.cloudfront.net (CloudFront)
expires
Fri, 26 Oct 2018 00:45:09 GMT
evidon-banner.js
c.evidon.com/sitenotice/
8 KB
3 KB
Script
General
Full URL
https://c.evidon.com/sitenotice/evidon-banner.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.96.33.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-96-33-116.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
186e5821720593367310d36fc9e71747518897853d453a6823194d0004b51f16

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:11 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Oct 2018 19:32:10 GMT
Server
Apache
ETag
"ac8d1520b10feab378ed0c2e13a475a0:1540495931"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=86400, private;max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2507
Expires
Wed, 31 Oct 2018 11:41:11 GMT
18863
l.betrad.com/site/v3/425/3445/3/1/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/3/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.136.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-72-136-100.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
main.default.js
zdnet3.cbsistatic.com/fly/1531-fly/js/
204 KB
69 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6c65a8205295ee9b8a16e60080102aa2125add70f44910fef31523649d252ac0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:40:53 GMT
server
nginx
etag
W/"5bd74625-330a4"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
70573
expires
Tue, 06 Nov 2018 11:41:11 GMT
integrator.js
adservice.google.de/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_270.js
securepubads.g.doubleclick.net/gpt/
184 KB
63 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
516b065177d1546683627fa32c8574fd59edc3eb3bf92cef5882d53e58d7a1f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 24 Oct 2018 15:56:38 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
64036
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:11 GMT
18863
l.betrad.com/site/v3/425/3445/3/4/2/2/
0
120 B
Image
General
Full URL
https://l.betrad.com/site/v3/425/3445/3/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.136.100 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-72-136-100.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
rid
match.adsrvr.org/track/
109 B
512 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.28.28 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-28-28.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
056caccc79485b128acf68f48bb455758c8a8d23f8e1bea298d34c98e159adb9

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 30 Oct 2018 11:41:12 GMT
x-aspnet-version
4.0.30319
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Thu, 29 Nov 2018 11:41:12 GMT
require.optional-dependency.js
zdnet4.cbsistatic.com/fly/js/libs/
582 B
518 B
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/libs/require.optional-dependency.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f27c0c9f284c6959dd7db1e768c6e43a518ea650afc69d7a60383f3a963cde7b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:12 GMT
content-encoding
gzip
last-modified
Tue, 31 Jul 2018 17:33:20 GMT
server
nginx
etag
"5b609d60-246"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
307
expires
Tue, 06 Nov 2018 11:41:12 GMT
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
94 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/418F) /
Resource Hash
37594bf5cea078e78adfeaee203437d94166b7d2c073b5c3c170a1ba730eca01

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:12 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:43 GMT
server
ECS (fcn/418F)
etag
"241996515"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19623
expires
Tue, 30 Oct 2018 11:46:12 GMT
config.json
c.go-mpulse.net/api/ Frame 4AF2
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5136332&v=1.571.0&if=&sl=1&si=zytyg6f1jk9-phetsl&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.98.131.27 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-98-131-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5ef59ad4dddabd3575bc297b1058ed39338fc1a1b24b9ee3119c20fc25889ac9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

Date
Tue, 30 Oct 2018 11:41:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
692
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/
28 B
268 B
Script
General
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:e7::5f65:48d0 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
3c599ef176cecdb3de25c6c36bc2945b92c12bcbc2ab03350729f4de296b53b8

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:12 GMT
Cache-Control
max-age=192983
Server
Apache
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
28
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/
81 KB
28 KB
Script
General
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
009396e873c2f93482891861160df34a0a69bd1beaad7c5fc04d8dd36e4eec44

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:12 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
BC4F97BA1F106EBB
status
200
content-length
28397
x-amz-id-2
J8zmvgfNzG4CAbCbuLht/1b8lYutez8aSXvKTUEfg4it7wLnVKLnn+V6bClwRuRWkmHXuBQrHDM=
last-modified
Wed, 24 Oct 2018 20:32:46 GMT
server
cloudflare
etag
"8132bd22613a0bbbdd73866340c33ab1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1800
accept-ranges
bytes
cf-ray
471d9c8bcbc8bef8-FRA
expires
Tue, 30 Oct 2018 12:11:12 GMT
utag.1783.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1783.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40B0) /
Resource Hash
4d049d83eef469c1f2cc0f5df820144ff6c5eb896b4e4aa2e681a1cba7d622a9

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 15 Mar 2017 15:25:15 GMT
server
ECS (fcn/40B0)
etag
"3913321605"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1130
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A3) /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:57 GMT
server
ECS (fcn/41A3)
etag
"392561602"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40DB) /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:42 GMT
server
ECS (fcn/40DB)
etag
"3447796852+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
142 KB
48 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D9) /
Resource Hash
694d40f6c8eb9760993e74b773dbb2cf3822ccb7f14a6d28320927cc5f9bad90

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 19 Sep 2018 18:08:20 GMT
server
ECS (fcn/40D9)
etag
"2497861228"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
48637
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
920 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AF) /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECS (fcn/41AF)
etag
"2267415266"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E6) /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:10 GMT
server
ECS (fcn/40E6)
etag
"3334871598"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4195) /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:28:47 GMT
server
ECS (fcn/4195)
etag
"2022868805"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
931 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40AE) /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:07:58 GMT
server
ECS (fcn/40AE)
etag
"1907756232"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Wed, 14 Nov 2018 11:41:13 GMT
utag.1800.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
959 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1800.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D7) /
Resource Hash
e9b3eb7f022396e969766ad5e908b21df0b646c943e149902c64de590e9549d9

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 07 Aug 2017 22:40:35 GMT
server
ECS (fcn/40D7)
etag
"3890296134"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
912
expires
Wed, 14 Nov 2018 11:41:13 GMT
article-24f3426aea-rev.js
zdnet4.cbsistatic.com/fly/js/pages/
125 KB
35 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-24f3426aea-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b836eb7325ac607513eaacb51a19639451d3fb357168f991c29bd6e9d9f250af

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Thu, 11 Oct 2018 15:17:41 GMT
server
nginx
etag
W/"5bbf6995-1f441"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
35342
expires
Tue, 06 Nov 2018 11:41:13 GMT
measure.min.js
asset.pagefair.com/
11 KB
4 KB
Script
General
Full URL
https://asset.pagefair.com/measure.min.js?_=1540899673204
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.248 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
94.31.29.248.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
6ac72fa11e76ea6fdbb1b310f67b3b9b24c11da94774a89323b71930ae544eee

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 11 Jun 2018 11:42:29 GMT
server
NetDNA-cache/2.2
x-amz-request-id
89AFA13F0C60ED99
etag
W/"5631e8df5abfee420cd07a2737665a78"
x-cache
MISS
content-type
application/x-javascript
status
200
cache-control
max-age=86400
x-amz-id-2
P7fnlKgnOMxYSkJMnx8+aX6rXPgOBOXGBtbRv+Ij2FniLAgTh5jUiwnOL/DFL/LEb2JZJQm3wSs=
expires
Wed, 31 Oct 2018 11:41:13 GMT
ads.min.js
asset.pagefair.net/
0
348 B
Script
General
Full URL
https://asset.pagefair.net/ads.min.js?_=1540899673207
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.161.188.128 Los Angeles, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Fri, 09 Mar 2018 17:19:02 GMT
server
NetDNA-cache/2.2
x-amz-request-id
B8113A2AFB30DE7D
etag
"263dfc0b0e2e32b880781aa6f238a031"
x-cache
MISS
content-type
application/x-javascript
status
200
cache-control
max-age=7200
accept-ranges
bytes
content-length
31
x-amz-id-2
tb6aferGpqNW3LPR6jCRANb6N7e6G+UA+cDbna9zNH93n89G0zkSlH13Byzr1c62Yndo+bMu6mw=
tag.aspx
ml314.com/
23 KB
11 KB
Script
General
Full URL
https://ml314.com/tag.aspx?3092018
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
2ccd728594ce65fa7e6651109e3bbd61877e548c4dab5480cafa6965f358a4e0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 30 Oct 2018 11:23:38 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=85344
Connection
keep-alive
Content-Length
11039
Expires
Wed, 31 Oct 2018 11:23:38 GMT
ds.js
dw.cbsi.com/js/cbsi/
18 KB
7 KB
Script
General
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=446
Content-Length
6423
Expires
Tue, 30 Oct 2018 12:11:13 GMT
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame CDD1
321 B
349 B
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1540899673216&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
18e110ff918c99541657918aa03e2f59e43e5490ac8f7d7fa84ad19ab622db0c

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
471d9c8dbdb5c2c9-FRA
pixel.gif
cdn.viglink.com/images/
43 B
125 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=7.376042954488355
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
cf-cache-status
HIT
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
x-amz-request-id
16F2CAE6550D8A7A
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
471d9c8dfd9cbef8-FRA
content-length
43
x-amz-id-2
kn9W1C5w2RdjvPchL5jhV5QRYPujzpKW6xws+vl851eH3ychyZod7sgg6E5NuBtnLDBs+JbcXHQ=
pixel.gif
cdn.viglink.com/images/
43 B
102 B
Image
General
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=7.376042954488355
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:a00d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
cf-cache-status
HIT
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
x-amz-request-id
16F2CAE6550D8A7A
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
471d9c8e0da6bef8-FRA
content-length
43
x-amz-id-2
kn9W1C5w2RdjvPchL5jhV5QRYPujzpKW6xws+vl851eH3ychyZod7sgg6E5NuBtnLDBs+JbcXHQ=
st.v3.js
www.everestjs.net/static/
17 KB
6 KB
Script
General
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.133.222 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
35733dd71de077b039d2bac6614c78eb3ab7d3879cb307cc10cc1907d2f61eb6

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Oct 2018 10:27:09 GMT
Server
Apache
ETag
"12803d6-4205-577c92e263c39"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=56430
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5509
Expires
Wed, 31 Oct 2018 03:21:43 GMT
tag.js
js.agkn.com/prod/v0/
3 KB
3 KB
Script
General
Full URL
https://js.agkn.com/prod/v0/tag.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1800.js?utv=ut4.43.201805241512
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20bb:8600:15:efbc:e300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
faf50b9ffe58f834c4796d588923150c2a2ed752b0d670e32293827b6038c758

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 18 Oct 2018 23:15:24 GMT
via
1.1 e430a35037c484cf19f375480cabfca3.cloudfront.net (CloudFront)
last-modified
Thu, 18 Oct 2018 23:14:55 GMT
server
AmazonS3
age
44746
etag
"3523ddc9e3dce225ce1cfd9244246dc3"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3134
x-amz-cf-id
kzs8TymsMdHsx4nVgxajFH7Uv-nQkAKIjs5iaYiRE_GRaD_k09WMkA==
cbsinteractive.js
tru.am/scripts/custom/
2 KB
1 KB
Script
General
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a27fab6c5a0b1db438219c7d24ce2fff95e0910378fe4bdeb64b4f970eebccc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 23 Jan 2018 19:10:31 GMT
server
cloudflare
etag
"8c3752e674fdabefc911d5c40f71780d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
471d9c8e3ac826ea-FRA
expires
Tue, 30 Oct 2018 15:41:13 GMT
anonc.js
dw.cbsi.com/
73 B
620 B
Script
General
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e12006702d63c047122ecce41f04cff2209a5448ae8aea0ebdfd8512f161d1a4

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Apache/2.4.25
Etag
Bzc6UlvYQ1kXeX5ROhs.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=246
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
utsync.ashx
ml314.com/
906 B
1 KB
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&pv=1540899673418_siv7cn4e1&bl=en-us&cb=7302986&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1540899673418_siv7cn4e1&cid=8eece63f-8ee4-43a8-8409-71f624b5334d&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?3092018
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
aa039913574a9fc246c8bdbb10f92acad18940eb239ac6719a6681717114df81

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:12 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
521
Expires
0
ud.ashx
in.ml314.com/
20 B
698 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=3092018
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?3092018
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.154.145 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-154-145.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Wed, 31 Oct 2018 11:41:13 GMT
zdnet-video-62b9e41c43-rev.js
zdnet1.cbsistatic.com/fly/js/components/
23 KB
8 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/zdnet-video-62b9e41c43-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
901fc3206be099c4dc64931428fe93dc4a2130063aaba7e94090303ded1397a0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:40:49 GMT
server
nginx
etag
W/"5bd74621-5c35"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
7534
expires
Tue, 06 Nov 2018 11:41:13 GMT
video-playlist-connector-008b49b7a1-rev.js
zdnet2.cbsistatic.com/fly/js/components/
4 KB
2 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/video-playlist-connector-008b49b7a1-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a20c788fad1957d4bcd135b761c2ede3fd3ddc4a1b9a5ed0c565be047fe7e3f0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 18:58:31 GMT
server
nginx
etag
W/"5b883e57-1194"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1560
expires
Tue, 06 Nov 2018 11:41:13 GMT
pixel_details.html
www.everestjs.net/static/ Frame 7DA7
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0
Document
General
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.133.222 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Content-Encoding
gzip
Content-Length
146
Cache-Control
max-age=69709
Expires
Wed, 31 Oct 2018 07:03:02 GMT
Date
Tue, 30 Oct 2018 11:41:13 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Apache
Set-Cookie
everest_session_v2=W9hDWQAAAV7dH@nD; path=/; domain=.everesttech.net everest_g_v2=g_surferid~W9hDWQAAAV7dH@nD; path=/; domain=.everesttech.net; expires=Wed, 23-Sep-2020 22:21:13 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=W9hDWQAAAV7dH@nD&gsurfer=W9hDWQAAAV7dH@nD&optout=0&throttleCookie=&time=20181030114113
Content-Length
345
Keep-Alive
timeout=15, max=997923
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame CDD1
551 KB
120 KB
Script
General
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636754604557185965
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1540899673216&lv=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3544c18bb4d954e8f42793b40c495a703718155222054639fd3be53139e0a363

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
content-md5
BsS3lyySk0m16t32fpLXVA==
cf-polished
origSize=915904
status
200
last-modified
Mon, 15 Oct 2018 20:59:40 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
54cc4450-d01e-00ca-094a-6ac60c000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
471d9c8fab68c2c9-FRA
expires
Wed, 30 Oct 2019 11:41:13 GMT
Cookie set /
d.agkn.com/iframe/8613/ Frame B20D
0
0
Document
General
Full URL
https://d.agkn.com/iframe/8613/?che=13663174&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bpid=cbsinteractive&c=%7B%22bpid%22%3A%22cbsinteractive%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F%22%2C%22ref%22%3A%22-1%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Requested by
Host: js.agkn.com
URL: https://js.agkn.com/prod/v0/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.47.36 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-47-36.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash

Request headers

Host
d.agkn.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Cache-Control
no-cache, must-revalidate
Content-Type
text/html;charset=UTF-8
Date
Tue, 30 Oct 2018 11:41:12 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
Server
Apache-Coyote/1.1
Set-Cookie
ab=0001%3AB5s%2BqnChAhgY9FFn5aw0nryJMllN2CI9;Max-Age=31536000;domain=agkn.com;path=/ u=C|0AEAjav_ZI2r_2QAAAAAAAg1RAQCADVIBAIA;Max-Age=31536000;domain=agkn.com;path=/
Content-Length
503
Connection
keep-alive
ta-pagesocial-sdk.js
tru.am/scripts/
34 KB
14 KB
Script
General
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb9007c254c493be4a067de535b19a30f5e5aef3d5b19f58b1c72d2c65a04f79

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 21 May 2018 10:49:23 GMT
server
cloudflare
etag
"8761e04182a1c11ff30f706f8052c8d6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
471d9c903c4426ea-FRA
expires
Wed, 31 Oct 2018 11:41:13 GMT
adsense.js
asset.pagefair.com/adimages/
0
380 B
Script
General
Full URL
https://asset.pagefair.com/adimages/adsense.js
Requested by
Host: asset.pagefair.com
URL: https://asset.pagefair.com/measure.min.js?_=1540899673204
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.248 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
94.31.29.248.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Fri, 09 Mar 2018 17:19:01 GMT
server
NetDNA-cache/2.2
x-amz-request-id
0427A69F411C4F0B
etag
"8193452d6ae440ec23eff2e1559d5461"
x-cache
HIT
content-type
application/x-javascript
status
200
cache-control
max-age=86400
accept-ranges
bytes
content-length
31
x-amz-id-2
FZjxXrqvqqaIc8ny8ITVP56nM+xhQjK7xujpyyjsvBz7psllpr+CSJG0R9QjymZOCgi+1HHEtDc=
expires
Wed, 31 Oct 2018 11:41:13 GMT
textlink-ads.jpg
asset.pagefair.net/adimages/
518 B
540 B
Image
General
Full URL
https://asset.pagefair.net/adimages/textlink-ads.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.161.188.128 Los Angeles, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Fri, 09 Mar 2018 17:19:02 GMT
server
NetDNA-cache/2.2
x-amz-request-id
E17B31B952B346AB
etag
"262857636d8f02be18171bed8e10c82b"
x-cache
HIT
content-type
image/jpeg
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
229
x-amz-id-2
0c0Jadcy4863JsOsVxRBN1dnrHwY0gGkgn+IvIq6QYjrMoRbaFgTXqcLprTJN4PS5OAkt+h6bOk=
textlink-ads.jpg
asset.pagefair.com/adimages/
518 B
569 B
Image
General
Full URL
https://asset.pagefair.com/adimages/textlink-ads.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.248 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
94.31.29.248.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Fri, 09 Mar 2018 17:19:02 GMT
server
NetDNA-cache/2.2
x-amz-request-id
8AB5C0BC188A2F0D
etag
"262857636d8f02be18171bed8e10c82b"
x-cache
HIT
content-type
image/jpeg
status
200
cache-control
max-age=86400
accept-ranges
bytes
content-length
229
x-amz-id-2
GjVx1HQZOSNZL37Gw0cZ6x4na4NALpnnTF8YpdejlM3zc4SiwTTZbVV/5KsRyXsayK70WPZbqpc=
expires
Wed, 31 Oct 2018 11:41:13 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151442367944761&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151442367944761%26eid=50056
  • https://tags.bluekai.com/site/20486?dt=0&r=198135980&sig=551788948&bkca=KJpn0zpBnnWND1+1LEVNBnzyBeD61EW0BMmlBeWhBpBDv6oB0u00puQovuit6+4wpEWtBBanpLdPE0brpWFVu0pm3a9N5ALgLaVJ5dvmeylN5aWN1i+/nugmpTFcq...
  • https://ml314.com/csync.ashx?fp=QAIAPQ9999O4W2Cq&person_id=5978151442367944761&eid=50056
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=QAIAPQ9999O4W2Cq&person_id=5978151442367944761&eid=50056
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 31 Oct 2018 07:41:14 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:14 GMT
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Location
https://ml314.com/csync.ashx?fp=QAIAPQ9999O4W2Cq&person_id=5978151442367944761&eid=50056
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
0
BK-Server
2d60
Expires
Thu, 01 Dec 1994 16:00:00 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151442367944761
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ0MjM2Nzk0NDc2MRAAGg0I2obh3gUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=&person_id=5978151442367944761&eid=50082
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=&person_id=5978151442367944761&eid=50082
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 31 Oct 2018 07:41:14 GMT

Redirect headers

status
307
date
Tue, 30 Oct 2018 11:41:14 GMT
cache-control
no-cache, no-store
timing-allow-origin
*
content-length
0
location
https://ml314.com/csync.ashx?fp=&person_id=5978151442367944761&eid=50082
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151442367944761%26eid=50220
  • https://ml314.com/csync.ashx?fp=3f135bd8-3b5a-4200-a3a0-3ecfd67ed7e0&person_id=5978151442367944761&eid=50220
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=3f135bd8-3b5a-4200-a3a0-3ecfd67ed7e0&person_id=5978151442367944761&eid=50220
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 31 Oct 2018 07:41:14 GMT

Redirect headers

Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
MT3 1.26.12.0 f85fe72 RELEASE cdg-pixel-x19
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=3f135bd8-3b5a-4200-a3a0-3ecfd67ed7e0&person_id=5978151442367944761&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Tue, 30 Oct 2018 11:41:12 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151442367944761
  • https://ml314.com/csync.ashx?fp=daea6cafc99f9bec0d65ce3b522287b2&eid=50146&person_id=5978151442367944761
43 B
312 B
Image
General
Full URL
https://ml314.com/csync.ashx?fp=daea6cafc99f9bec0d65ce3b522287b2&eid=50146&person_id=5978151442367944761
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 31 Oct 2018 07:41:14 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:13 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=daea6cafc99f9bec0d65ce3b522287b2&eid=50146&person_id=5978151442367944761
Cache-Control
no-cache
X-Server
10.26.27.225
Connection
keep-alive
Content-Length
0
Expires
0
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2HVgO8y02gaDWZVFo2zAO88C27O2ziNkRPkmoC6QdWsA&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
  • https://ml314.com/csync.ashx?fp=2HVgO8y02gaDWZVFo2zAO88C27O2ziNkRPkmoC6QdWsA&person_id=5978151442367944761&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
70 B
171 B
Image
General
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.57.223.246 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-223-246.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Length
70
Content-Type
image/gif

Redirect headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control
private
Connection
keep-alive
Content-Length
168
Expires
Wed, 31 Oct 2018 07:41:15 GMT
ibs:dpid=22052&dpuuid=5978151442367944761&redir=
dpm.demdex.net/
42 B
769 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151442367944761&redir=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.219.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-219-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v006-08ff79e81.edge-irl1.demdex.com 5.41.0.20181011114220 2ms
Pragma
no-cache
X-TID
ZpEecBQFRQU=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
uvpjs-0826cffc14-rev.js
zdnet1.cbsistatic.com/fly/js/managers/
800 B
644 B
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/managers/uvpjs-0826cffc14-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9242cae28bc65d0b14fc566242452e05bdce12813551d6bb027c066d54bbf2f7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:22 GMT
server
nginx
etag
"5b58bf66-320"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
419
nncoection
close
expires
Tue, 06 Nov 2018 11:41:13 GMT
video-28e1825085-rev.js
zdnet1.cbsistatic.com/fly/js/translations/
702 B
649 B
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/translations/video-28e1825085-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f8ab45ee0969bb98916fa2ba950a26e40d4039a8d402bc661bd99ee0392edbc0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:30 GMT
server
nginx
etag
"5b58bf6e-2be"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
438
expires
Tue, 06 Nov 2018 11:41:13 GMT
video-controls-039169d901-rev.js
zdnet4.cbsistatic.com/fly/js/components/
21 KB
6 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/video-controls-039169d901-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
579e81f46017126d8f898dd79dc3930782f6e9e41d0537e9050310cc8dadc73e

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Tue, 16 Oct 2018 16:40:20 GMT
server
nginx
etag
W/"5bc61474-52f1"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
5619
expires
Tue, 06 Nov 2018 11:41:13 GMT
swfobject-c3dea6a493-rev.js
zdnet3.cbsistatic.com/fly/js/components/
9 KB
4 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/swfobject-c3dea6a493-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
40c707d407e524f6e535fe307be27c3d79067da9cbf8fa9eef3c9ec1933e12df

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Tue, 04 Sep 2018 15:22:12 GMT
server
nginx
etag
W/"5b8ea324-245c"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
3904
expires
Tue, 06 Nov 2018 11:41:13 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1540899673839
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.219.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-219-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
d2c77b8eaa09d5efbdaced4a423d42fb03ddc3322f005c7d51d108fb13ff58bc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v006-0d92ff21f.edge-irl1.demdex.com 5.41.0.20181011114220 5ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
E6PRF8KFQQ0=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
701
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
68 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201810291711&cb=1540899673841
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D1) /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
last-modified
Thu, 14 Apr 2016 16:59:33 GMT
server
ECS (fcn/40D1)
etag
"144534940"
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Tue, 30 Oct 2018 11:51:13 GMT
c.gif
dw.cbsi.com/clear/
42 B
346 B
Image
General
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=7a12161d-2a5f-4793-b0a4-9fac038733de&assettitle=gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20brazilian%20banks&assettype=content_article&pubdate=2018-10-01%2004%3A20%3A22&viewguid=8eece63f-8ee4-43a8-8409-71f624b5334d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1540899673731&ld=www.zdnet.com&ldc=08c9bf23-6efc-488b-83b3-35bd8a8213cb&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=Bzc6UlvYQ1kXeX5ROhs&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&title=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=179
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/
12 KB
5 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 17:00:19 GMT
server
nginx
etag
"5b2a8823-2fdf"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
4822
expires
Tue, 06 Nov 2018 11:41:13 GMT
ad-ef5cb79eaf-rev.js
zdnet2.cbsistatic.com/fly/js/managers/
7 KB
3 KB
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/managers/ad-ef5cb79eaf-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
56bf714084093ce2762a223acbaee3f925b631b6fb24aee9f2f96c09bcc94c66

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Thu, 09 Aug 2018 17:36:29 GMT
server
nginx
etag
W/"5b6c7b9d-1ad5"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2431
expires
Tue, 06 Nov 2018 11:41:13 GMT
/
www.zdnet.com/components/breaking-news/xhr/
1 KB
1 KB
XHR
General
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1035f2104deed99e4df4725f40be064c22306533cd921e9be7584e87513ee7cb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/components/breaking-news/xhr/?slug=breaking-news-banner
pragma
no-cache
cookie
aam_uuid=74926206232441188180716735996261109217; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; _fbp=fb.1.1540899669804.1874514021; __gads=ID=dd9ba7ceed81f671:T=1540899669:S=ALNI_MbNPfHitTNDI4immFxZGnvnes0X2g; ak_bmsc=4DB66A3164A7DC2847B15D8B2695174D48F7B3641F6100005643D85BF894B60F~plazfXEeWcx1UXM/q/316LJcyGdDYjfxcPvo8qQlVhwQAQuyeJiv5fBlj5aZpkbudLSFC/7OyuMvNt4vmaMsxrw15zaEhz9cn55I5Qjv3y2WR+4w5TFPH/ntDEj+ahs6gFEGKSWWL1LyS8F0RTv2eZ6R6iQNuwcEA4nY/7oFGqOsmmFAWFbX3gYnUG2S1WL9YJgCbPr/Fn9j5EHdnFt3BebJX+M+akCAzJcD2D+w4YJbg=; nemo_highlander-video_focus=video_focus%3a1%3aexclude; utag_main=v_id:0166c4c7132b000140a855628dd200078006d07000b08$_sn:1$_ss:1$_st:1540901472890$ses_id:1540899672890%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session; _ccmsi=1540899673418_siv7cn4e1|1540899673425; viewGuid=8eece63f-8ee4-43a8-8409-71f624b5334d; LDCLGFbrowser=08c9bf23-6efc-488b-83b3-35bd8a8213cb; _ccmaid=5978151442367944761; XCLGFbrowser=Bzc6UlvYQ1kXeX5ROhs; s_vnum=1543491673813%26vn%3D1; s_invisit=true; s_getNewRepeat=1540899673819-New; s_lv_zdnet=1540899673822; s_lv_zdnet_s=First%20Visit; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=T
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
497
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Oct 2018 11:39:35 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 30 Oct 2018 11:41:14 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
fa28bce9-3555-4d4a-aeeb-014b0f90c2af
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
bm_sv=B832F91ED90978D82116E9FDC790879B~aj76zVGdV2l3uDfSdJpe1VuvldsHBzO2Enf7dA3apf8BhznbbvRLG3hKUilLEeen25rkGYAM/Fy5o+xQcEulErbHSpEiKwzMjH1nAwyQpWGwMdmWVuwfegy/VwDDQeSvqFQ/oGLy7Iq2X35apzgHFmsgMhdVJPKg18jOrKM2vj4=; Domain=.zdnet.com; Path=/; Max-Age=7199; HttpOnly
accept-ranges
bytes
expires
Tue, 30 Oct 2018 13:09:35 GMT
/
graph.facebook.com/
571 B
557 B
Script
General
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&callback=jQuery18309101376336435265_1540899672445&_=1540899673901
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01a:1:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
a9da93f742d8d4eddc134562058f80e83370887054382b222f5529a964a072b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
etag
"ece2d8d8ecf397d0f3becc71e40522b89302352e"
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
x-fb-rev
4477684
content-length
369
pragma
no-cache
x-fb-debug
93jWpbxCvXGy0kisPleelI9SQWj1JIEI/NR0rA+vESvzSYNVXGB0xz79ieTDpi5BANy58+zT+LaPss6ZSImofA==
x-fb-trace-id
B5i3a12Et67
date
Tue, 30 Oct 2018 11:41:13 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.8
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
206 B
388 B
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&callback=jQuery18309101376336435265_1540899672446&_=1540899673902
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9101 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
ea3caa8c8f60b47efc50f2b57918f76502e713f09caeb0123e4349710455d70e
Security Headers
Name Value
Content-Security-Policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding
x-li-uuid
lYCj4RZgYhVAC3EQ2CoAAA==
server
Apache-Coyote/1.1
pragma
no-cache
x-li-pop
prod-efr5
x-frame-options
sameorigin
strict-transport-security
max-age=2592000
content-type
text/javascript;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
x-li-fabric
prod-lva1
expires
Thu, 01 Jan 1970 00:00:00 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/
406 B
480 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Tue, 31 Jul 2018 17:33:08 GMT
server
nginx
etag
"5b609d54-196"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
270
expires
Tue, 06 Nov 2018 11:41:13 GMT
image-gallery-modal-6c21b7dcbf-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-6c21b7dcbf-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b34a764a54cd042f769a2e1a002a27c14132167d8ab9967bc49419c87b694d99

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:13 GMT
content-encoding
gzip
last-modified
Tue, 31 Jul 2018 17:33:08 GMT
server
nginx
etag
W/"5b609d54-1503"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2003
expires
Tue, 06 Nov 2018 11:41:13 GMT
a-6-cambridge.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/07/24/7846cf7a-419e-4111-8a58-6119d0635e38/thumbnail/170x128/374809ede18d88b93f6aaa16332611b4/
4 KB
4 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/07/24/7846cf7a-419e-4111-8a58-6119d0635e38/thumbnail/170x128/374809ede18d88b93f6aaa16332611b4/a-6-cambridge.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3abead375bb8d384d18dd455d548fa9d94dfd5a876dd8be9b3a5235c771abfec

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:18 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27794478
timing-allow-origin
*
content-length
4321
expires
Tue, 17 Sep 2019 04:22:32 GMT
a-7-twitter.jpg
zdnet1.cbsistatic.com/hub/i/r/2018/07/24/43d0ec30-3aa9-4aa6-a680-9d91b6093b8d/thumbnail/170x128/9bd5990d0c901cf70c41161c1762e64b/
6 KB
6 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/07/24/43d0ec30-3aa9-4aa6-a680-9d91b6093b8d/thumbnail/170x128/9bd5990d0c901cf70c41161c1762e64b/a-7-twitter.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
31f2502985cd82156618c2842decdd66226091e4f616c8cd3867a9ead2c8a9e3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Fri, 27 Jul 2018 14:03:05 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27794395
timing-allow-origin
*
content-length
5716
expires
Tue, 17 Sep 2019 04:21:09 GMT
a-8-tmobile.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/07/24/c7a2b93b-8e6f-4c7e-a63c-7b4301d2a618/thumbnail/170x128/0d2049ff0b22993517383a83b1615952/
8 KB
8 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/07/24/c7a2b93b-8e6f-4c7e-a63c-7b4301d2a618/thumbnail/170x128/0d2049ff0b22993517383a83b1615952/a-8-tmobile.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b2816ae41889388360482588c8af317634fce4179e6cfdad21f26e23ab6a9f7e

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:18 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27794399
timing-allow-origin
*
content-length
7820
expires
Tue, 17 Sep 2019 04:21:13 GMT
b-1-jira.jpg
zdnet4.cbsistatic.com/hub/i/r/2018/07/24/0d4315b4-d3f1-49b0-85f5-b29eeacbd413/thumbnail/170x128/feaaa90fe1d813c719d7f9508ea15efe/
3 KB
4 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/07/24/0d4315b4-d3f1-49b0-85f5-b29eeacbd413/thumbnail/170x128/feaaa90fe1d813c719d7f9508ea15efe/b-1-jira.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2dbd42e5d6b936274e0cf1688678f567784f89ae4f350d3eaee2dd6b86f65075

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:18 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=31096824
timing-allow-origin
*
content-length
3425
expires
Fri, 25 Oct 2019 09:41:38 GMT
b-2-raileurope.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/07/24/6f624ea0-dabf-4ae6-a828-b863f83d7f07/thumbnail/170x128/5040b91fae3f612b107fbd27ad2cb882/
7 KB
7 KB
Image
General
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/07/24/6f624ea0-dabf-4ae6-a828-b863f83d7f07/thumbnail/170x128/5040b91fae3f612b107fbd27ad2cb882/b-2-raileurope.jpg
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
35c04e5b7a4044d3d19a6ccd99871a0e7d999570e2c5cfca5c91837e54ebfc9f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 12:48:18 GMT
server
nginx
status
200
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
http://origin.img.hub.zdnet.com
cache-control
max-age=27794505
timing-allow-origin
*
content-length
6847
expires
Tue, 17 Sep 2019 04:22:59 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/
2 KB
2 KB
XHR
General
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c29aede9b733e2630e614ca4ddd82b140700d3e5f735ff52fc90d95d92d20274
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/newsletter/xhr/widget-login/?topic=security
pragma
no-cache
cookie
aam_uuid=74926206232441188180716735996261109217; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; _fbp=fb.1.1540899669804.1874514021; __gads=ID=dd9ba7ceed81f671:T=1540899669:S=ALNI_MbNPfHitTNDI4immFxZGnvnes0X2g; ak_bmsc=4DB66A3164A7DC2847B15D8B2695174D48F7B3641F6100005643D85BF894B60F~plazfXEeWcx1UXM/q/316LJcyGdDYjfxcPvo8qQlVhwQAQuyeJiv5fBlj5aZpkbudLSFC/7OyuMvNt4vmaMsxrw15zaEhz9cn55I5Qjv3y2WR+4w5TFPH/ntDEj+ahs6gFEGKSWWL1LyS8F0RTv2eZ6R6iQNuwcEA4nY/7oFGqOsmmFAWFbX3gYnUG2S1WL9YJgCbPr/Fn9j5EHdnFt3BebJX+M+akCAzJcD2D+w4YJbg=; nemo_highlander-video_focus=video_focus%3a1%3aexclude; utag_main=v_id:0166c4c7132b000140a855628dd200078006d07000b08$_sn:1$_ss:1$_st:1540901472890$ses_id:1540899672890%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session; _ccmsi=1540899673418_siv7cn4e1|1540899673425; viewGuid=8eece63f-8ee4-43a8-8409-71f624b5334d; LDCLGFbrowser=08c9bf23-6efc-488b-83b3-35bd8a8213cb; _ccmaid=5978151442367944761; XCLGFbrowser=Bzc6UlvYQ1kXeX5ROhs; s_vnum=1543491673813%26vn%3D1; s_invisit=true; s_getNewRepeat=1540899673819-New; s_lv_zdnet=1540899673822; s_lv_zdnet_s=First%20Visit; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=T; bm_sv=B832F91ED90978D82116E9FDC790879B~aj76zVGdV2l3uDfSdJpe1VuvldsHBzO2Enf7dA3apf8BhznbbvRLG3hKUilLEeen25rkGYAM/Fy5o+xQcEulErbHSpEiKwzMjH1nAwyQpWGwMdmWVuwfegy/VwDDQeSvqFQ/oGLy7Iq2X35apzgHFmsgMhdVJPKg18jOrKM2vj4=
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
732
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 30 Oct 2018 11:41:14 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
ddd35dac-3e47-4fd1-918c-8610691fdee5
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
set-cookie
fly_session=lp58m01ovdejjlmj2qbmssk974; path=/; domain=.zdnet.com; secure; HttpOnly bm_sv=B832F91ED90978D82116E9FDC790879B~aj76zVGdV2l3uDfSdJpe1VuvldsHBzO2Enf7dA3apf8BhznbbvRLG3hKUilLEeen25rkGYAM/Fy5o+xQcEulErbHSpEiKwzMjH1nAwyQpWG6l9gT3+PjGXUiwk5bAnw+rVccpYYlmfgdDRFZ9AqJ/LP/NOdp7rnsnAzTRGgTP38=; Domain=.zdnet.com; Path=/; Max-Age=7199; HttpOnly
accept-ranges
bytes
expires
Tue, 30 Oct 2018 11:41:14 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/
5 KB
2 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Tue, 21 Aug 2018 14:13:15 GMT
server
nginx
etag
W/"5b7c1dfb-124a"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1564
expires
Tue, 06 Nov 2018 11:41:14 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/
1 KB
1 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Wed, 29 Aug 2018 13:13:23 GMT
server
nginx
etag
W/"5b869bf3-514"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
827
expires
Tue, 06 Nov 2018 11:41:14 GMT
ping
api.viglink.com/api/
265 B
945 B
XHR
General
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.175.204 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-175-204.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
42a485fb7d29e8c8425e408bfd87c206d0abd194e53a5828fde88fba1a6b1410

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:13 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
265
Expires
Thu, 01 Jan 1970 00:00:00 GMT
jquery.ui.position-1.9.2.js
zdnet3.cbsistatic.com/fly/js/libs/jquery/ui/
7 KB
3 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/libs/jquery/ui/jquery.ui.position-1.9.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ee221041a905f4b0fbe76dc05e44575523fd26a93f9e038bcb19d16e4155ee5b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:18 GMT
server
nginx
etag
W/"5b58bf62-1a3e"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2661
expires
Tue, 06 Nov 2018 11:41:14 GMT
jquery.ui.draggable-1.9.2.js
zdnet4.cbsistatic.com/fly/js/libs/jquery/ui/
18 KB
5 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/libs/jquery/ui/jquery.ui.draggable-1.9.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6d4dc28c491ca7ff1c86fa292821d3174e2c7638170628e1daa411da61d10684

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:18 GMT
server
nginx
etag
W/"5b58bf62-48d5"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
4875
expires
Tue, 06 Nov 2018 11:41:14 GMT
beacon
beacon.tru.am/
17 B
214 B
Fetch
General
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27676ea482895bdddd3f3796f430a812e11364efc224227c86973a52398966c2

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
471d9c93aaa4bef8-FRA
content-length
41
expires
Thu, 01 Jan 1970 00:00:00 UTC
Cookie set dest5.html
cbsi.demdex.net/ Frame 3175
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.249.86.253 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-249-86-253.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Cookie
demdex=44405579072602280193589910786788338080; dextp=269-1-1540899669933|3-1-1540899670041|477-1-1540899670166|771-1-1540899670287|22052-1-1540899670431|30646-1-1540899670566|121998-1-1540899670685|127444-1-1540899670785
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Tue, 23 Oct 2018 15:14:16 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=44405579072602280193589910786788338080;Path=/;Domain=.demdex.net;Expires=Sun, 28-Apr-2019 11:41:14 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
+Xj46X1RThI=
Content-Length
2766
Connection
keep-alive
id
saa.cbsi.com/
90 B
717 B
XHR
General
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=44651926678504419313568652070212299992&ts=1540899674263
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
65f5e636f6cedbc5d6f04b8d440b438444ef01d6e39df092ee30799e5c72c2d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
X-Content-Type-Options
nosniff
Server
Omniture DC/2.0.0
xserver
www248
Vary
Origin
X-C
ms-6.5.1
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
90
X-XSS-Protection
1; mode=block
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/
0
178 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
last-modified
Thu, 14 Jun 2018 17:23:42 GMT
server
nginx
etag
"5b22a49e-0"
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
0
expires
Tue, 06 Nov 2018 11:41:14 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
26 KB
9 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4192) /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:41:55 GMT
server
ECS (fcn/4192)
etag
"1112944691+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Wed, 14 Nov 2018 11:41:14 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
915 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AD) /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECS (fcn/41AD)
etag
"461771432+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Wed, 14 Nov 2018 11:41:14 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
2 KB
1012 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419E) /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:43:58 GMT
server
ECS (fcn/419E)
etag
"4198895974+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Wed, 14 Nov 2018 11:41:14 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/
8 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4198) /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:09:53 GMT
server
ECS (fcn/4198)
etag
"931235332+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Wed, 14 Nov 2018 11:41:14 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/
760 KB
203 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1491a1594a4058a62ea4c08441cfcbbfe82a0916b4f26b55f3605af896766dd7

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 26 Mar 2018 15:42:34 GMT
server
Apache
etag
"ffe80da4a589534ffbb17f46d6ef50a3:1522078954"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
expires
Thu, 29 Nov 2018 11:41:14 GMT
a.js
stats.pagefair.com/stats/page_view_event/3393B7A52D1447DD/
25 B
722 B
XHR
General
Full URL
https://stats.pagefair.com/stats/page_view_event/3393B7A52D1447DD/a.js?wl_div_hid_t0=0&div_hid_t0=0&s_blk=0&i_blk=0&wl_i_blk=0&is_ab=0&is_wl=1&new_monthly=1&new_daily=1&_=1540899674587
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.196.204 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-76-196-204.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
2671d72b96d6d9a1b8bbc1429048505ea6dbc3514daf22ab6dd6dfc8a70ce8d3

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
CP="NID DSP ALL COR"
Access-Control-Allow-Origin
https://www.zdnet.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript
Access-Control-Allow-Headers
Authorization,Content-Type,Accept,Origin,User-Agent,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since,X-CSRF-TOKEN
Content-Length
25
autoplay-controls-e5333d6243-rev.js
zdnet3.cbsistatic.com/fly/js/components/
3 KB
1 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/autoplay-controls-e5333d6243-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
40d317f999e71c7635619879cf4c5901505ea487011a00a220e560996f7557b1

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Tue, 16 Oct 2018 16:40:19 GMT
server
nginx
etag
W/"5bc61473-c8d"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1149
expires
Tue, 06 Nov 2018 11:41:14 GMT
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1540899674613&s=335e637a88d4c4d9649ec69119acc5e3cdd1f7f679f855672f88dbab4869910b
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.98.131.27 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-98-131-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
08a3665f18455a87378690736743cd9a199c38bd7d9fea5df993e21fa6120a68

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
718
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/
882 B
670 B
Script
General
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Mon, 11 Jun 2018 15:19:55 GMT
server
nginx
etag
"5b1e931b-372"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
460
expires
Tue, 06 Nov 2018 11:41:14 GMT
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/
78 KB
17 KB
Script
General
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:10:28b::e3d , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
UploadServer /
Resource Hash
1ff53412e0f7149ee0e54173d5681958ad656643e3213acdd588941c89642f9e

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1538677181
x-guploader-uploadid
AEnB2UqqNR4wk19g2tb73nuacsujibGNsep56eyKg2AAQHmN9zM-JuHosoBENlEbE24CHAOLBA7mSn6E37SJiiFRs5XWCq1sUA
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-length
16960
last-modified
Thu, 04 Oct 2018 18:57:14 GMT
server
UploadServer
etag
"66b301ea9923f38e2300df3d9e6b1156"
vary
Accept-Encoding
x-goog-hash
crc32c=1WWWOQ==, md5=ZrMB6pkj844jAN89nmsRVg==
x-goog-generation
1538679434316060
cache-control
public, max-age=300
x-goog-stored-content-length
79839
accept-ranges
bytes
content-type
application/x-javascript
expires
Tue, 30 Oct 2018 11:46:14 GMT
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=44651926678504419313568652070212299992&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012DEC21AD05313CCD-4000012600000B4E&ts=1540899674828
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.219.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-219-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
52d07282ab84dbb43f7267311c7dc10af8c18bc40245f2f79876da58bb44afa2

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v006-02eccd0a9.edge-irl1.demdex.com 5.41.0.20181011114220 6ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
Q7wYTcWITFU=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
702
Expires
Thu, 01 Jan 1970 00:00:00 GMT
cs.js
sb.scorecardresearch.com/c2/3005086/
0
400 B
Script
General
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.152.143 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-152-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Fri, 02 Nov 2018 11:41:14 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZD...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20Z...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&c9=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.84.146.193 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-84-146-193.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:15 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1540899674905&ns_c=UTF-8&c8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&c9=
Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:14 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/
51 KB
13 KB
Script
General
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201810291720
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.101.171 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-101-171.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9acc0eb4103d7b741c330849d8234002afa518fd931f8dc964dd3824298d41a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
status
200
cache-control
public, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
servershortname
content-type
application/javascript
content-length
12663
expires
Tue, 30 Oct 2018 11:42:14 GMT
jquery.ui.slider-1.9.2.js
zdnet1.cbsistatic.com/fly/js/libs/jquery/ui/
10 KB
3 KB
Script
General
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/jquery/ui/jquery.ui.slider-1.9.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fa107680c3e0cfd1620aebe62462103703993ada997d84aa6d5f55ce0ea3cba0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:18 GMT
server
nginx
etag
W/"5b58bf62-278e"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2914
expires
Tue, 06 Nov 2018 11:41:14 GMT
ad-2.0.js
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/managers/
19 KB
5 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/managers/ad-2.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
de749bdbeeb7bb7f79cb31ff00fe6830004064419f73fe9a6ec982e9de8bf19d

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:14 GMT
content-encoding
gzip
last-modified
Thu, 19 Apr 2018 09:47:08 GMT
server
nginx
etag
"5ad8659c-4c22"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
4885
expires
Tue, 06 Nov 2018 11:41:14 GMT
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compac...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compac...
44 B
332 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compact&rnd=1540899674941&ja=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.76.181 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-242-76-181.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:15 GMT
server
nginx
status
200
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:14 GMT
server
nginx
status
302
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp=&ts=compact&rnd=1540899674941&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/
45 KB
14 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
8896bd9aad2399ee52a9878c7ada2e49df2f66ba91afd102244018c25ffd88e2
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
14136
x-xss-protection
0
pragma
public
x-fb-debug
wrytAJHar/2DxN8xrwbjeUENJ49O+4HntjF2CVaqljitdcjHGpX6UQKSDXyVNcPVcpcc9TFv1RwK0E+i51nayA==
x-frame-options
DENY
date
Tue, 30 Oct 2018 11:41:14 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
expires
Sat, 01 Jan 2000 00:00:00 GMT
jquery.ui.core-1.9.2.js
zdnet3.cbsistatic.com/fly/js/libs/jquery/ui/
5 KB
2 KB
Script
General
Full URL
https://zdnet3.cbsistatic.com/fly/js/libs/jquery/ui/jquery.ui.core-1.9.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
965b325924d7bd803f6fb1007b982eeb412ebfd696a20986fd4e6bc221daf413

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:15 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:17 GMT
server
nginx
etag
W/"5b58bf61-128b"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2096
expires
Tue, 06 Nov 2018 11:41:15 GMT
jquery.ui.mouse-1.9.2.js
zdnet4.cbsistatic.com/fly/js/libs/jquery/ui/
3 KB
1 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/js/libs/jquery/ui/jquery.ui.mouse-1.9.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ddfc91f954a7df70ddb1b6d0265eb1792d1c7922d50463d968159e7a4403fb1c

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:15 GMT
content-encoding
gzip
last-modified
Wed, 25 Jul 2018 18:20:18 GMT
server
nginx
etag
W/"5b58bf62-bca"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1002
expires
Tue, 06 Nov 2018 11:41:15 GMT
4083-12969.js
www.everestjs.net/dl/4083/
484 B
655 B
Script
General
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.133.222 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=41915
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Tue, 30 Oct 2018 23:19:50 GMT
v
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ev___ref=%2F%2F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c37b1-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=997457
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=VzloRFdRQUFBVjdkSEBuRA
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEIWAk9z2BMrlZvSsNVmtz5w&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B
Image
General
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"4436fc-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=995098
Content-Length
128

Redirect headers

Date
Tue, 30 Oct 2018 11:41:14 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
Cookie set dest5.html
cbsi.demdex.net/ Frame B698
0
0
Document
General
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.249.86.253 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-249-86-253.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Cookie
demdex=44405579072602280193589910786788338080; dextp=269-1-1540899669933|3-1-1540899670041|477-1-1540899670166|771-1-1540899670287|22052-1-1540899670431|30646-1-1540899670566|121998-1-1540899670685|127444-1-1540899670785
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 24 Oct 2018 19:38:33 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=44405579072602280193589910786788338080;Path=/;Domain=.demdex.net;Expires=Sun, 28-Apr-2019 11:41:15 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
71jKZaQ8SQM=
Content-Length
2766
Connection
keep-alive
s5357845669249
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/
2 KB
2 KB
Script
General
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s5357845669249?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=30%2F9%2F2018%2011%3A41%3A15%202%200&d.&nsid=0&jsonv=1&.d&mid=44651926678504419313568652070212299992&aid=2DEC21AD05313CCD-4000012600000B4E&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C54795830-f620-4b12-bd83-5740537be838&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20Brazilian%20banks%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v11=D%3Dch%2B%22%3A%22%2Bv10&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=gigantic%20100%2C000-strong%20botnet%20used%20to%20hijack%20traffic%20meant%20for%20brazilian%20banks&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=8eece63f-8ee4-43a8-8409-71f624b5334d&c25=D%3Dv25&c26=D%3Dv26&v26=bfccdd23-ed4a-11e3-95d2-02911863765e&c28=D%3Dv28&c30=D%3Dv30&v30=7a12161d-2a5f-4793-b0a4-9fac038733de&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=Bzc6UlvYQ1kXeX5ROhs&v44=zdnet&c50=D%3Dv50&v50=7%3A30AM&c51=D%3Dv51&v51=Tuesday&c52=D%3Dv52&v52=1&c53=D%3Dv53&v53=New&c54=D%3Dv54&v54=First%20Visit&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
fde388282164f37b534118bfd3711ff04b903976d8413d7c3f0caa17b5157afa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-AAM-TID
hH6EL84DSLg=
Date
Tue, 30 Oct 2018 11:41:15 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.5.1
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
1721
X-XSS-Protection
1; mode=block
DCS
dcs-prod-irl1-v006-0e0b2be49.edge-irl1.demdex.com 5.41.0.20181011114220 8ms
Pragma
no-cache
Last-Modified
Wed, 31 Oct 2018 11:41:15 GMT
Server
Omniture DC
xserver
www296
ETag
"3309056855358111744-6698437231134120419"
Vary
*
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Mon, 29 Oct 2018 11:41:15 GMT
/
22ffaa5b.akstat.io/
0
354 B
XHR
General
Full URL
https://22ffaa5b.akstat.io/?h.pg=article&when=1540899674628&t_other=custom4%7C1033&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=701b5f712dfee31d3be18622102806eeb3878b85&h.t=1540899674654&http.initiator=api&rt.start=api&rt.si=f3e68485-6792-4398-8022-086fd4a9cfa2&rt.ss=1540899679735&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
184.30.223.226 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-30-223-226.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Tue, 30 Oct 2018 11:41:15 GMT
count.js
zdnet-1.disqus.com/
1 KB
1 KB
Script
General
Full URL
https://zdnet-1.disqus.com/count.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
1484273
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 12 Oct 2018 17:48:14 GMT
Server
nginx
ETag
"5bc0de5e-367"
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=2592000
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Expires
Mon, 12 Nov 2018 07:23:22 GMT
309391486091569
connect.facebook.net/signals/config/
104 KB
19 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.8.30&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
78e6c9bd32bac30d3171f0257ad9961c141202694725e96d005fd11a8281f556
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
19056
x-xss-protection
0
pragma
public
x-fb-debug
n+PoLye/9IQMflo/RrHWma25+rVCERf6HNveEXZVhEdO/VgRx7nF3CxLDPLxXjG1fsFXsPvkHyD9m6VO8vbdog==
x-frame-options
DENY
date
Tue, 30 Oct 2018 11:41:15 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=W0PYW9yIE4j4gA...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=308415...
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=3084154...
42 B
109 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=3084154190&ipr=y
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:15 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1213313701&crd=CKrPGwiJ0hsIhNAb&cdct=2&is_vtc=1&random=3084154190&ipr=y
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/
0
1 KB
Image
General
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:833::4000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Public-Key-Pins-Report-Only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cGuxAXyFXFkWm61cF4HPWX8S0srS9j0aSqN0k4AP+4A="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/
128 B
716 B
Image
General
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"143362-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=990320
Content-Length
128
gpt-4.3.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/managers/
52 KB
10 KB
Script
General
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/managers/gpt-4.3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d48e0904f1b40972f1fc6dac3f358719e080fab3291d13d2ca4a60405707a88b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:15 GMT
content-encoding
gzip
last-modified
Thu, 19 Apr 2018 09:47:08 GMT
server
nginx
etag
"5ad8659c-d143"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
10133
expires
Tue, 06 Nov 2018 11:41:15 GMT
count-data.js
zdnet-1.disqus.com/
243 B
769 B
Script
General
Full URL
https://zdnet-1.disqus.com/count-data.js?1=7a12161d-2a5f-4793-b0a4-9fac038733de
Requested by
Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
ebff5e526eaecb20e91c2af0476f72cdae479b8e36b89f4e3068ce46dd1db96f
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Age
3080
X-Frame-Options
SAMEORIGIN
Connection
keep-alive
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Vary
Accept-Encoding
Cache-Control
public, max-age=600
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=UTF-8
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
205
X-XSS-Protection
1; mode=block
jpt
secure.adnxs.com/
0
684 B
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=3UxDJus8&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.137:80
AN-X-Request-Uuid
bbc6bc9b-499d-4f68-95b9-8a20c31cf3b2
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
0
683 B
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=7LQDd6rK&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.72:80
AN-X-Request-Uuid
3f046bc8-88af-4978-baad-0b110b9bcbb8
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
0
684 B
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=CFpoJCKs&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.167:80
AN-X-Request-Uuid
df91c34e-c181-4f38-9e8e-0d4b04943019
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
0
684 B
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=yz8Ie6sO&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.108:80
AN-X-Request-Uuid
d0c34cd4-1a86-4e1b-b57b-f44ed777fa0e
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/
0
684 B
XHR
General
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=KPDEeesL&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.173:80
AN-X-Request-Uuid
c5c93181-c068-430d-89fc-48e7ddc46d42
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/
66 B
1001 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A45061423%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229c657ecc-15b2-4e38-8724-d9778cfece15%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222018-10-30T11%3A41%3A12%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.9.164 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-9-164.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b910af5bf47dfe51e609aa609f4f0782d332155b50b3b5181e6d10116f9bbec6

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:15 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Tue, 30 Oct 2018 11:41:15 GMT
/
www.facebook.com/tr/
44 B
245 B
Image
General
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&rl=&if=false&ts=1540899675677&sw=1600&sh=1200&v=2.8.30&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1540899675677.1941439428&it=1540899675269&coo=false
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:15 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Tue, 30 Oct 2018 11:41:15 GMT
/
36e4f0eb.akstat.io/
0
354 B
Other
General
Full URL
https://36e4f0eb.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
184.30.223.226 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-30-223-226.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:16 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Tue, 30 Oct 2018 11:41:16 GMT
ads
securepubads.g.doubleclick.net/gampad/
113 KB
16 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4345151355105253&correlator=3769617958676665&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21062069%2C21062454%2C21062576&vrg=270&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C1600x1000%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=128&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cinternet-of-things%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%26env%3Dprod%26firstpg%3D1%26vguid%3D8eece63f-8ee4-43a8-8409-71f624b5334d%26session%3Da%26subses%3D4&cookie_enabled=1&bc=7&abxe=1&lmt=1540899676&dt=1540899676241&dlt=1540899670520&idt=1839&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&adys=0%2C116%2C0%2C0%2C0%2C0%2C0%2C0%2C0&adks=489353864%2C142327462%2C1330711698%2C2311868658%2C1017379368%2C1036307118%2C1534057941%2C1980649094%2C3494418061&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&dssz=90&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x5674%7C1585x0%7C1585x-1%7C1585x-1%7C370x-1%7C370x-1%7C370x-1%7C1210x-1%7C370x-1&msz=7x30%7C1585x0%7C1600x-1%7C688x-1%7C300x-1%7C300x-1%7C300x-1%7C728x-1%7C371x-1&ga_vid=2091878002.1540899676&ga_sid=1540899676&ga_hid=461652935&fws=128%2C4%2C128%2C128%2C128%2C128%2C128%2C128%2C128
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
cce2434b8d369c899222952dfae5ec6c72c74f4f6909041db6d0500858909bc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
16486
x-xss-protection
1; mode=block
google-lineitem-id
4745699004,-2,4745166436,253246569,253246569,241984809,4745571990,241984809,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138245072116,-2,138239321298,75374362809,75375443409,75375443409,138247985753,75374362809,138247024569
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_270.js
securepubads.g.doubleclick.net/gpt/
54 KB
20 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
f7739b424d4acd048d584bf1bfa99a1ea5481989d1abb8948e9bf571729f2c72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 24 Oct 2018 15:56:38 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
20717
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:16 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires
Sat, 12 Oct 2019 19:46:32 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Fri, 12 Oct 2018 04:28:13 GMT
content-type
text/html
fb_digioh.2.1.5.css
www.lightboxcdn.com/static/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.lightboxcdn.com/static/fb_digioh.2.1.5.css?cb=636752339805538198
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636754604557185965
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
802446cd0aefe1f43030cf3e02eddbbbec61e27e62479d990d8889266943a650

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 30 Oct 2018 11:41:16 GMT
content-encoding
gzip
cf-cache-status
HIT
content-md5
SPXkOHRrmvkdtUVAkMsWtg==
cf-polished
origSize=5365
status
200
last-modified
Thu, 22 Jun 2017 21:54:44 GMT
x-ms-lease-status
unlocked
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
80c90c48-e01e-00e0-4e47-65b349000000
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
471d9ca2bda5c2c9-FRA
expires
Wed, 30 Oct 2019 11:41:16 GMT
headerstats
as-sec.casalemedia.com/
0
337 B
XHR
General
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:16 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Tue, 30 Oct 2018 11:41:16 GMT
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame E558
0
0
Document
General
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=1&prev=0&cb=636752339805538198
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636754604557185965
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=1&prev=0&cb=636752339805538198
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
__cfduid=d99d391ef0c4362ba22157ec835265af31540899676
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
date
Tue, 30 Oct 2018 11:41:16 GMT
content-type
text/html
content-md5
2QlVA6sVmgJp4XZ5c8SrrQ==
last-modified
Mon, 15 Oct 2018 20:59:40 GMT
x-ms-request-id
237ee6fc-601e-0097-6887-693608000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
HIT
expires
Wed, 30 Oct 2019 11:41:16 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
471d9ca40904c2c9-FRA
content-encoding
gzip
/
www.facebook.com/tr/ Frame D340
0
0
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
4577
pragma
no-cache
cache-control
no-cache
origin
https://www.zdnet.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
fr=0ebXsjPuxnkqdWlBL..Bb2ENb...1.0.Bb2ENb.
Origin
https://www.zdnet.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
content-type
text/plain
content-length
0
server
proxygen-bolt
date
Tue, 30 Oct 2018 11:41:16 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 85BE
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498466
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 85BE
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:16 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61466
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
osd.js
pagead2.googlesyndication.com/pagead/
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:29:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
721
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 12:29:15 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame DD16
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame DD16
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
9818.js
ads.rubiconproject.com/ad/ Frame FCD5
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.129.200 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-129-200.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4671
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Tue, 30 Oct 2018 12:59:08 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame FCD5
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame FCD5
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
9818.js
ads.rubiconproject.com/ad/ Frame C7A0
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.129.200 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-129-200.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4671
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Tue, 30 Oct 2018 12:59:08 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame C7A0
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame C7A0
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
9818.js
ads.rubiconproject.com/ad/ Frame BD09
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.129.200 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-129-200.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4671
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Tue, 30 Oct 2018 12:59:08 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame BD09
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame BD09
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 717B
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 717B
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
9818.js
ads.rubiconproject.com/ad/ Frame CFCB
26 KB
8 KB
Script
General
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.129.200 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-129-200.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=4671
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Tue, 30 Oct 2018 12:59:08 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame CFCB
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame CFCB
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
adKit.min.js
rev.cbsi.com/common/js/ Frame 48AF
6 KB
2 KB
Script
General
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?447502830
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Nov 2016 21:14:51 GMT
Server
Apache
ETag
"61acd092be7016e54f2dac81f3076225:1478553291"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2158
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 48AF
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 48AF
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61465
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
view
securepubads.g.doubleclick.net/pcs/ Frame 85BE
0
56 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstM5P26ndE-nkd7CcFj_TFWQwK36C-VgIs41hVYAg7rfhZ3yKyXoEnFAAG8kBpFG_xL1RkS-ak8qwxz46TrsiYPRPEcT6xY9mnB3ol-YQ7ZyEgpUW_B8wN2CvNiO8sgxDfn8_a3W5dPjBSppznRBnwuwGas_ROtkUBhLKwYO9BkrIEozE4xzJ6ksGFRROBdAIwRrbEh9bwxM3LK4U5ZAWykqusJKjYmJ99Iq_OYiqxrcdgKONhHfgD18bJkdIuWOg&sai=AMfl-YSM7uIN81xsY4QiKBqEhCH6Kl-KQhrq09OaUCzufGM26gXpn5KdF44k7fvhgLU6XCYh4i3BxW_LfdydpSGC8iVXExw8IlB6gclO6hrI_w-a3sudujwdBhebT10&sig=Cg0ArKJSzCmr6jQC0m-MEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame DD16
0
56 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstp8OjqQji8Pc0tv-4E2xtCQLoUsrlEcZIARZc_kFBfA9OKM3HFbc1mq8CKvXuSdLN3fmanTKUOfNYbBIc0CAlURDG8iE2jtZIgYdtjmg9JU20E3LwlQZykAkkZEGwcob0yojv-2jVrdvF5_DuviY3IXDQ96RA2tGEaLlc_VeSo3KTx0jiDVF65lzRIaPTnpinYWxZ2i7XCKdcxyQk_iR6T72yJhXlZSVZaz7vfqP3B-QdtIsUdE3vfJtbChz6msw&sai=AMfl-YShJF9hBQjO-xdV0kiqQm_iYQzv-ItGmZ5I9PODzA0EJ6EZJ6Bsc3TAemEA91ZEogul0IP3nTzeKl4OVtMiXrn_ZKPHryCLSiV-jq9vfrghMbHrNZtz3czSr4U&sig=Cg0ArKJSzAeS2pYdzUPuEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame FCD5
0
56 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvv_t9sXLkunvNX5mu8EEQEjHQgHFJQ6gfscMhcWe8cOF550xRQM94MCEiEyj-OGvSiJsDY3kuPIbrAwTatr7QttjqiiktJcEdo7kO8GNe_QOWwcPUPftKzkP9n09App3VJObU-HY8WDWHT-NY0jxmNNU7Ane6-yK7iyzHGllYZwsxoUf_piWampitoCyi45hczMzMycp1K5mT_e76AewtKmKRAkR6z0Vf8TMrWNzwgDuZn5om_kcYh7Szd&sai=AMfl-YT4FHHU3S7736vp9i6tOfa8SH6JYdYmrxNtDb_MP32rnLo5H_LrTykDM6Ls0sLD2tqN9MG4PFRtICPq_lpO-9bAeXUPhIr38OMoIR0c0W26_pAJhE3n62G3wPE&sig=Cg0ArKJSzHAfXsuQhblEEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame C7A0
0
47 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvNqkT-WibRz5Y2u1X1j4-zTJPRDEAh_wN4RNRsirQoux5foQWfZh2tg2_36-1zniAHvLiB5bYU2h-6lDEvookGRiaM0DVJl0bKP3UWqfcKRaoaYxDD9wOUqZY5dW318XE1Eq2gbDZkLCNTAcrflX9H-8BdJ-Gd3wOio4FWz_RWt22UkBi_drfVqxYrbb9KRe9UM1oFKgUw7sHwQe6qd2V0HdzsPsyNIMD3ikPVwhVKR4XXWPbi756eSmpU&sai=AMfl-YQKeXcRqg03N-9jRf3QSf1c9su4Zif_vpDULaNPqRR4i_Sj7I6xvH-rtf7wBahJaLcOj0RJariBC3qMDJe4h5G7lgBid1UktHLdaW3OCTfui8SAZClh3bEqsXA&sig=Cg0ArKJSzEVqqPt0foTrEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame BD09
0
47 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssg8pBmS6-8LbqaMpCdRLlAWQYdFgEjff4qcIZBEJ5z66RFY_0kdkT2OsnkJ6gcROi7SQDOJjYeYTersdiSpOsvMdxWEPr7tAM385iE5WSNKrpamUkfD0zdgYjH-VTk7l75Lt0gL_s6rP1WUF1gkJ67nmQmQ-q-EdYx5hHbDFdeGk1HixWZV9VLkJ8mgjc48mYydbY2Wl7R914kpO8-5cMCPMXlbz2ebckD2yM48-7KtKQ3B1XU50ez93Eo&sai=AMfl-YRx-wt48_EpcdhkRBURmaQI82Ilp_nBDI3mdQ9UJQOdYm8FB-EQEiq_DsQr2U5WsQj7TskYgH5hd4DvWhhMgVyEODMQPMfNuWj68GGyvV_RT8Dvf87AZnDzWnc&sig=Cg0ArKJSzCq1SCU2Gw4mEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 717B
0
47 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvJf5-Mm1H632n8s1GLgbZoMmvYC6bHchAJtlh2WDmqhmmzHAiNedWf9si9gpPqF6dNGbZhYrEBp0n9_lE3-Vv29OXfd_iBlNyAjq3278lB7dO7ahRYKwy-ifyjjC4uOU9RJb1kPrA_eO_tumYFuNP8lMJWZm1tcZOH5yfV74geVqtFn-dPmkzXo5I8lhQKKUVTH4lMQsvwm4bBXOiNyr1hgz7Gn6s0oSgRrz-_k8Ivmq61vrPrVI2Hsta8vcQLCQ&sai=AMfl-YQ6ROTnNyIltnZ1FdH3Ymol1LuVBVFDGuQ4TEFACtAeV4NDDINjl8crpeRnHj5msukGHPOOeYReG5jSWLs5kQGTuRGzhnAPgjfngOPkpjl7EqcqAVcOQ0vGn2E&sig=Cg0ArKJSzGVVpvRWfMK6EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame CFCB
0
56 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstGZJrb-sML8pj5n6SozcwDcCC8qBeIIQlvtjL5HB6sJXGH0bCHZWjAe2bC1VJTsZSSSDmhh9Pmcc4fYCFBTfLDo_NBIpRsX2ShkVZcCAdarSM516g-TCF0hasvDp-lxX0tqGzvLREUsrzIbKgFnK78ZftUu-CT_53V1H4SO1B0SRkmi-FGgyZxHDV-fQAwkQOI6mINSqoU7bxDsMYDp3qB1MWd-dVOZo2Rpk0GJURmBGjztnzyu23UKizb&sai=AMfl-YRNRDOBQHizu3Zu2btf8C301Bm3aiX9Voyli1lu4Sj4qEf6AcMpin3Kbou2zyY7CvtlPxeH7y1P6bLInVPsy84f54yuYnG0siGsGyjziUT6SlYUUZH9gx-LtK0&sig=Cg0ArKJSzLXTAvZgM0xyEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 48AF
0
47 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvjxsaua5MPQZWLeJ6TosPqrS76CamvQuPr0bdXmgoVTxlJlbHk_fmLuxenvtw5dJ89CW6LHhpxaqgbwv1WwnkfqwVh2HqJG7L_oVk5ygh0q-8Y28509L947rmS6WQkibngtF8ykfSW_9tJHs5qVExO8U_TLfkZRxRUkUSxpuR6e-1TsvbaKMFeYukVm6BjLQ40VjIy6k4CgNeBTJBs6fE0T-XoHk8-6ZHg2If2G4-s8OyB-kebyBIDSSwibNOMuw&sai=AMfl-YThA9DNiwFqJK_NugqFPQCGvaB_dIKaZDZ5Z2Ffqy3r2VsHmjev8OBG0oXK5Q9NNGzWPwcOWunYm9QA3Bza0ffoLSaf6Mo9sO6wM3PMXHavCUreQ9D3zWhT1e8&sig=Cg0ArKJSzMS_fdTg2tX1EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:17 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame FCD5
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.6879044305847886&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.21 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
066c53137145d00c341b96b0513eb555b7be7c94f0cff9ce33cb3561921e6988

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=10
Content-Length
920
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame C7A0
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.17203318014802815&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.31 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
59fa64ad7c24c69c82afa4a5e644c2ff8ed1b74617c935385f91618ac7ac1e66

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=6
Content-Length
921
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame BD09
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.923282996495149&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.31 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
692eceed814a31459176da6b273b242072c774b1b74c38b64a1ce6f97f478ded

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=2
Content-Length
921
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame CFCB
2 KB
1 KB
Script
General
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.4048138489929429&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.31 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
b515dddfa0a3c384975254674f077a147742c15807ac2deed1f5768eb5665bd1

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=3
Content-Length
1070
Expires
Wed, 17 Sep 1975 21:32:10 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 48AF
24 KB
0
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?447502830
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81c::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7cdcfff39260d66cc0fac190f66caf465044cba360fc5396cc98654f6d1cebc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"9 / 406 of 1000 / last-modified: 1540874150"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8986
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:11 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame BD09
54 KB
21 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.923282996495149&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
334ecb5de067cf73650b13cd8a01b4493877bdbcb41405cde049e4fdcb14d487
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21089
x-xss-protection
1; mode=block
server
cafe
etag
1636307937246973836
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:17 GMT
e1e7a1ab-dba3-4cd0-b956-34b8ed94648d
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame BD09
43 B
268 B
Image
General
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/e1e7a1ab-dba3-4cd0-b956-34b8ed94648d?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BA24604655BA8E9275B10F56231C810F652BB7DE7443E2EB3B23A1DDA26060B5065C8F48EEC5B8A529F0BE1F8337FD75D1F88D01A39A65AF0F5B5FBD9296A178F3570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308CBCD217B6DB3796EF5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.67 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:16 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame CFCB
54 KB
21 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.4048138489929429&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
334ecb5de067cf73650b13cd8a01b4493877bdbcb41405cde049e4fdcb14d487
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21089
x-xss-protection
1; mode=block
server
cafe
etag
1636307937246973836
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:17 GMT
e107c5f0-f98e-4923-9709-09bfffb7ab94
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame CFCB
43 B
268 B
Image
General
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/e107c5f0-f98e-4923-9709-09bfffb7ab94?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B2C5477EB0AC0D942367F93A72F1869546D8FCF702CC4528511204F9D3CCE9C8E82564BF49FEB0FB89F0BE1F8337FD75DF6096CC6C1E54D27F5B5FBD9296A178F3570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308E1D85EE479FB0DE6F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.27 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame C7A0
54 KB
21 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.17203318014802815&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
334ecb5de067cf73650b13cd8a01b4493877bdbcb41405cde049e4fdcb14d487
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21089
x-xss-protection
1; mode=block
server
cafe
etag
1636307937246973836
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:17 GMT
80e562c4-d776-43e6-a2ad-6b7b32f20cd9
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame C7A0
43 B
268 B
Image
General
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/80e562c4-d776-43e6-a2ad-6b7b32f20cd9?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563B60DCEB3E8261B3EE2DE221FA5543B24CD2DBADA3A8B6C48E8948964F328223600674C7456E53F5319F0BE1F8337FD75DE7ED433BEB1DD5C0F5B5FBD9296A178F3570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308E1D85EE479FB0DE6F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.27 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:17 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame FCD5
54 KB
21 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.6879044305847886&tk_st=1&rf=https%3A//www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
334ecb5de067cf73650b13cd8a01b4493877bdbcb41405cde049e4fdcb14d487
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21089
x-xss-protection
1; mode=block
server
cafe
etag
1636307937246973836
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:17 GMT
2bbffca5-2cb0-4e2a-af97-4cb38d8104c3
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame FCD5
43 B
268 B
Image
General
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/2bbffca5-2cb0-4e2a-af97-4cb38d8104c3?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B22BE02DC8E639056A0B27007202A64E8B7826559D012708FF963CDCBE8BBF57E2189E1A43DD7530C347417BE7FFEFA4D124EBB34033350300B021FEA6586017FB4243BD7F3A6BBEB9E3C1C10F9FC8DCDB602FF66AE46020F5F302EC7D1FF5D2F109478760DFABCFE32997889F1DA11D8
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.67 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:16 GMT
Cache-Control
private, max-age=0, no-cache
Server
Rubicon Project
Content-Type
image/webp
Content-Length
43
Expires
01 Jan 1970 10:00:00 GMT
comscore.streaming.6.1.1.171219.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/comscore/
104 KB
19 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:17 GMT
content-encoding
gzip
last-modified
Mon, 26 Mar 2018 15:42:35 GMT
server
Apache
etag
"c3c30c0ebfc35a9426296256fc3133d8:1522078959"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
18881
expires
Thu, 29 Nov 2018 11:41:17 GMT
integrator.js
adservice.google.de/adsid/ Frame 48AF
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 48AF
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_270.js
securepubads.g.doubleclick.net/gpt/ Frame 48AF
184 KB
0
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
516b065177d1546683627fa32c8574fd59edc3eb3bf92cef5882d53e58d7a1f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 30 Oct 2018 11:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 24 Oct 2018 15:56:38 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
64036
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:11 GMT
integrator.js
adservice.google.de/adsid/ Frame CFCB
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame CFCB
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame CFCB
68 B
149 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 10:33:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
4066
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
88
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 22:33:32 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame CFCB
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame 810F
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
analytics.js
s.update.rubiconproject.com/2/873648/ Frame CFCB
0
75 B
Script
General
Full URL
https://s.update.rubiconproject.com/2/873648/analytics.js?si=59604&di=www.zdnet.com&ap=&dm=2&pi=283812&ti=e107c5f0-f98e-4923-9709-09bfffb7ab94&r5=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&dt=8736481428691810142000
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
34.226.72.85 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-226-72-85.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:17 GMT
Content-Length
0
usync.html
eus.rubiconproject.com/ Frame 3EB3
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.57.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-57-157.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Tue, 09 Oct 2018 10:25:22 GMT
Content-Encoding
gzip
Content-Length
7377
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=68529
Expires
Wed, 31 Oct 2018 06:43:27 GMT
Date
Tue, 30 Oct 2018 11:41:18 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame FCD5
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame FCD5
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame FCD5
68 B
145 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 10:33:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
4066
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
88
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 22:33:32 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame FCD5
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame 6976
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
usync.html
eus.rubiconproject.com/ Frame 5278
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.57.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-57-157.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Tue, 09 Oct 2018 10:25:22 GMT
Content-Encoding
gzip
Content-Length
7377
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=68529
Expires
Wed, 31 Oct 2018 06:43:27 GMT
Date
Tue, 30 Oct 2018 11:41:18 GMT
Connection
keep-alive
Vary
Accept-Encoding
ima3.js
s0.2mdn.net/instream/html5/
238 KB
82 KB
Script
General
Full URL
https://s0.2mdn.net/instream/html5/ima3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1531-fly/js/libs/require-2.1.2.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f6.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
83722
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:18 GMT
config.json
c.go-mpulse.net/api/v2/
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1540899678332&s=2526416f775ff3eae9d448326a602b62c7069b5dd8bca520782c87261a3e4a88
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.98.131.27 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-98-131-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e82d3b944d1db43508e51de2d0257293d32a72f2a0df458c0862c88fadef5daf

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

Date
Tue, 30 Oct 2018 11:41:18 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
716
truncated
/ Frame FCD5
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
791fe98fa98194a44df29618bccc78966b210dde241867fc772872d9fa45a1dd

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ Frame CFCB
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03e9600c1dc7c553a30f637b10e37d03ed2ef8fb2b9dc4354f95f72d14d00547

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
ads
securepubads.g.doubleclick.net/gampad/ Frame 48AF
27 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2497611688697553&correlator=350770963842286&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&json_a=1&eid=21061645%2C21062069&vrg=270&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A32776&sc=1&sfv=1-0-30&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Da%26subses%3D4%26ptype%3Darticle%26vguid%3D8eece63f-8ee4-43a8-8409-71f624b5334d%7Cenv%3Dprod%26session%3Da%26subses%3D4%26ptype%3Darticle%26vguid%3D8eece63f-8ee4-43a8-8409-71f624b5334d&cookie=ID%3D79dd9d227d35ff9e%3AT%3D1540899676%3AS%3DALNI_MYouMJ9W_pkGQOhzgFkQm2mqH9Ysg&cdm=www.zdnet.com&bc=7&lmt=1540899678&dt=1540899678411&dlt=1540899676613&idt=1750&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=0%2C0&adys=0%2C0&adks=3261246841%2C3261246840&ucis=mi4jvc91lbqh%7C1yoy9mqtpvlb&gut=v2&ifi=1&ifk=2513249266&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&dssz=12&icsg=2722&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1824477950.1540899678&ga_sid=1540899678&ga_hid=81036106&fws=384%2C384
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
f36898b72fa83b9cf7cd832935a5c06658a7c3b55d35c200a1ecff3360384f18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
7092
x-xss-protection
1; mode=block
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239375180,138239479696
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_270.js
securepubads.g.doubleclick.net/gpt/ Frame 48AF
54 KB
0
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
sffe /
Resource Hash
f7739b424d4acd048d584bf1bfa99a1ea5481989d1abb8948e9bf571729f2c72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Tue, 30 Oct 2018 11:41:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 24 Oct 2018 15:56:38 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
20717
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:16 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-30/html/ Frame 48AF
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-30/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires
Sat, 12 Oct 2019 19:46:34 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Fri, 12 Oct 2018 04:28:13 GMT
content-type
text/html
truncated
/ Frame 48AF
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2fda304c399fb1d750521411baea266a28f130d6d603aaf5c0bdbcbcae5225ff

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
integrator.js
adservice.google.de/adsid/ Frame BD09
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame BD09
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame BD09
68 B
145 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 10:33:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
4066
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
88
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 22:33:32 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame BD09
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame 613D
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
usync.html
eus.rubiconproject.com/ Frame DE53
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.57.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-57-157.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Tue, 09 Oct 2018 10:25:22 GMT
Content-Encoding
gzip
Content-Length
7377
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=68529
Expires
Wed, 31 Oct 2018 06:43:27 GMT
Date
Tue, 30 Oct 2018 11:41:18 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame C7A0
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame C7A0
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81a::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame C7A0
68 B
145 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 10:33:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
4066
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
88
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 22:33:32 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame C7A0
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:18 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame D23E
201 KB
75 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
76196
x-xss-protection
1; mode=block
server
cafe
etag
4706987710021974220
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 11:41:19 GMT
usync.html
eus.rubiconproject.com/ Frame D970
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.57.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-101-57-157.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Tue, 09 Oct 2018 10:25:22 GMT
Content-Encoding
gzip
Content-Length
7377
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=68528
Expires
Wed, 31 Oct 2018 06:43:27 GMT
Date
Tue, 30 Oct 2018 11:41:19 GMT
Connection
keep-alive
Vary
Accept-Encoding
n.js
geo.moatads.com/ Frame 85BE
106 B
370 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899679292&de=293219911877&m=0&ar=7554d5b-clean&q=2&cb=0&cu=1540899679292&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=nav-ad&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=nav-ad-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=nav-ad&fs=152610&na=525016383&cs=0&callback=MoatSuperV26.gna531366
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
8ecd26fc9c655b3733446067ac52df91613ada52eefb870c5f5b9eb26c958e6e

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:19 GMT
Server
nginx/1.7.9
Etag
"c4dd51291117a820c027ab1aabfcf1f40c6bead5"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
106
n.js
geo.moatads.com/ Frame DD16
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=12&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899679452&de=571611697009&m=0&ar=7554d5b-clean&q=6&cb=0&cu=1540899679452&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745166436%3A138239321298&zMoatPS=top&zMoatPT=article&zMoatW=1600&zMoatH=1000&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=skin&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=skin-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=1600x1000&zMoatSZPS=1600x1000%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=skin&fs=152610&na=1875746058&cs=0&callback=MoatSuperV26.gna272018
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
a9ce98163501d06cddc5df8965646c53641b881907052534d08b10f79cdae6f5

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:19 GMT
Server
nginx/1.7.9
Etag
"a0585b0b920be11ec7fa3026d6d1ca0bd5b4ea4f"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
truncated
/ Frame C7A0
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7494b5f117bd3a5e1356482231a366d54cece4fcc1db312e00e4ee136a15bff6

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/ Frame BD09
219 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
12ad8239fdc7df2d9d55a4b95c50889ee71c967abf315581ccfa26eb5dc46b63

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
n.js
geo.moatads.com/ Frame FCD5
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=43&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899679745&de=571763131993&m=0&ar=7554d5b-clean&q=10&cb=0&cu=1540899679745&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75374362809&zMoatPS=top&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=leader-plus-top&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=leader-plus-top-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=leader-plus-top&fs=152610&na=1569840848&cs=0&callback=MoatSuperV26.gna267912
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
732228e83d21cc7301ad8d797375488ecc5083accaee96ee37d709de23492edb

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:19 GMT
Server
nginx/1.7.9
Etag
"74f9b65b8a9f032396ca7b23119a881213b78eb8"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
n.js
geo.moatads.com/ Frame BD09
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=20&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899680006&de=851642892997&m=0&ar=7554d5b-clean&q=14&cb=0&cu=1540899680006&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A241984809%3A75375443409&zMoatPS=middle&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=mpu-middle&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=mpu-middle-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=middle&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=mpu-middle&fs=152610&na=303926514&cs=0&callback=MoatSuperV26.gna759593
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
e7997017dc260134fdebbcb6f5250d90c2f81e1949f98efa254001282674f60f

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Server
nginx/1.7.9
Etag
"b78f017fc5ca3a9b8741e7fb75b98df73ff49111"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
n.js
geo.moatads.com/ Frame C7A0
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=20&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899680324&de=923319536227&m=0&ar=7554d5b-clean&q=18&cb=0&cu=1540899680324&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A253246569%3A75375443409&zMoatPS=top&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=mpu-plus-top&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=mpu-plus-top-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=mpu-plus-top&fs=152610&na=1584494772&cs=0&callback=MoatSuperV26.gna761662
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
66f72553111483f0e64c9f9eeccd9e3ec7b6b2de9f48041f4ed63b95919d1ba8

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Server
nginx/1.7.9
Etag
"507d55be100dddad0fe177e9f00ca0470592ac55"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 6E9E
73 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 6E9E
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61462
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
osd.js
pagead2.googlesyndication.com/pagead/ Frame 48AF
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_270.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:29:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
725
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Oct 2018 12:29:15 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/ Frame 91D5
73 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20181024/r20110914/activeview/osd_listener.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 24 Oct 2018 17:13:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
498467
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27234
x-xss-protection
1; mode=block
server
cafe
etag
10801174140179827322
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 07 Nov 2018 17:13:30 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 91D5
282 KB
87 KB
Script
General
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_270.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Content-Encoding
gzip
Last-Modified
Tue, 16 Oct 2018 15:02:25 GMT
Server
AmazonS3
x-amz-request-id
042C6E681D3B8472
ETag
"de2606cae8bdc1e40ebf6e50b8adf558"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=61462
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88514
x-amz-id-2
VH5kWZPBWRhOJV3unQqyHUMBFL5fvqMmS9PvW6ck6djw0i8rwOf4oVexaSy7vp+pQlFv8Gjdncw=
view
securepubads.g.doubleclick.net/pcs/ Frame 6E9E
0
165 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLOcGQxWpKoDnp9ZiHGjpT_vlSV1-B1JzgpFn1avGSXVwTRK0LC58gQP5U8ZA9GkyQGDdSKf4S95bcs9KQXmtajOR52yrc65QNicH3G3wqVhdSO2m6Lg5-zsuGnYT4aknBdrAlvi4ywNidoJ9t1xa6fFElvbg_d6Vzim1_vFEna1S2a9smPzvLaudj4AxcDMzJvkkg4HlvWWOqsSOtX0dwdbeyCN6hCj6e8qtxNOxvKardeFZmsKPjJyXJMOy55w&sai=AMfl-YQTZ6FOYVEHEsXxi7JvSrcffeYsc2oGDTKyXno6a2471O0rqJVaWNtCgiPqed1KU3SKKvJmbaM3tZXJ4Lal5RMHdqFBR7OxrJbdKi2axuFtUVHFVchS2KsMfrY&sig=Cg0ArKJSzAkESUDVQMXLEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:20 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:20 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 91D5
0
133 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssYPzic5q7d10jfbAznrVZMi-gR-0sxnYG0iF86fJ5On14lKunMId3ZiRVBkbsSt0DBCaxgMX0sWwB-H8sOkmjpKh7ZU0vwNUHGcknjUEK1sWW8xBZ5nXDSrw17_Ybly2B9bEgOVr6VoYnu0cAt8YNDtugLM-32dkRVwo2qp98lfH24BSKyIzy0B_vpzUsTEewFFmqmk0vZAizRNomvow1fTGEB6Y6mrrjJ1Aee1_sC8FlLYyrpOMFG_BUosWhn_g&sai=AMfl-YRE1rQ_RgAVIPbQyReWKwnY9hCciHU-0tflxAy0Su4_DlaTkJqceF6nf2erVItyG0idefX0EO-fqphfD-VshaJYhczsrFxgdZo0ayWdk77zoaaISKJFM_wnITs&sig=Cg0ArKJSzJdGsg20TbWnEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Oct 2018 11:41:20 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:20 GMT
n.js
geo.moatads.com/ Frame 717B
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=11&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899680638&de=766458763869&m=0&ar=7554d5b-clean&q=22&cb=0&cu=1540899680638&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138247985753&zMoatPS=bottom&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=mpu-bottom-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=mpu-bottom&fs=152610&na=2144145571&cs=0&callback=MoatSuperV26.gna232596
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Server
nginx/1.7.9
Etag
"365527b841a9b886766d11101197473eb4f983b6"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
activeview
pagead2.googlesyndication.com/pcs/ Frame FCD5
42 B
112 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssYM-RQO3X0KYT9-TGbcsGXH_rwunUmMmir9R0LNA7TPWf0-CpJfub32WFnXt-loSJmMgecI3Wk5nWR4bbkidcf2Hhq5qjeJaPmNNg&sig=Cg0ArKJSzO7lNocCX4r0EAE&adk=2311868658&tt=2459&bs=1585%2C1200&mtos=1286,1286,1286,1286,1286&tos=1286,0,0,0,0&p=393,429,483,1157&mcvt=1286&rs=3&ht=0&tfs=1217&tls=2503&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540899677043&rpt=2110&ps=1585%2C5909&ss=1600%2C1200&pt=50&deb=1-8-8-38-7-50-15-0&tvt=2462&r=v&id=osdim&uc=3&tgt=DIV&cl=1&cec=14&clc=1&cac=0&cd=728x94&v=r20181024
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
n.js
geo.moatads.com/ Frame CFCB
106 B
370 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=31&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899680845&de=345378867908&m=0&ar=7554d5b-clean&q=26&cb=0&cu=1540899680845&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25299489%3A251370729%3A241984809%3A75374362809&zMoatPS=bottom&zMoatPT=article&zMoatW=728&zMoatH=90&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=leader-plus-bottom&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=leader-plus-bottom-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=leader-plus-bottom&fs=152610&na=252606660&cs=0&callback=MoatSuperV26.gna395809
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:20 GMT
Server
nginx/1.7.9
Etag
"0724e9a14f3d4e5e41def6657fdddf6b1a3fdf88"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
106
n.js
geo.moatads.com/ Frame 48AF
107 B
371 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&i=CBSDFPCW2&hp=1&cm=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&o=3&t=1540899681018&de=117296074897&m=0&ar=7554d5b-clean&q=30&cb=0&cu=1540899681018&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=dynamic-showcase-top&zMoatAType=content_article&zMoatTest=zdnet&zMoatDfpSlotId=dynamic-showcase-top-5bd82def2bc25&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=dynamic-showcase-top&fs=152610&na=992517084&cs=0&callback=MoatSuperV26.gna833042
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.60.241 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-56-60-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 30 Oct 2018 11:41:21 GMT
Server
nginx/1.7.9
Etag
"c073484afffc40ab265b15b5ba2836902a37d354"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=155&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680006&r=851642892997&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=766&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680006&r=851642892997&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=18&fi=1&apd=36&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680324&r=923319536227&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=18&fi=1&apd=36&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680324&r=923319536227&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=726&fi=1&apd=744&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680324&r=923319536227&t=hdn&os=1&fi2=0&div1=0&ait=354&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=71&fi=1&apd=142&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25477209&L2id=2356361194&L3id=4745166436&L4id=138239321298&S1id=23605329&S2id=23619609&ord=1540899679452&r=571611697009&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=71&fi=1&apd=142&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25477209&L2id=2356361194&L3id=4745166436&L4id=138239321298&S1id=23605329&S2id=23619609&ord=1540899679452&r=571611697009&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=142&tet=1055&fi=1&apd=1126&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25477209&L2id=2356361194&L3id=4745166436&L4id=138239321298&S1id=23605329&S2id=23619609&ord=1540899679452&r=571611697009&t=iv&os=1&fi2=0&div1=1&ait=492&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=142&tet=1055&fi=1&apd=1126&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25477209&L2id=2356361194&L3id=4745166436&L4id=138239321298&S1id=23605329&S2id=23619609&ord=1540899679452&r=571611697009&t=hdn&os=1&fi2=0&div1=1&ait=492&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=4&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=30&fi=0&apd=60&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899679745&r=571763131993&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=987&fi=0&apd=1017&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899679745&r=571763131993&t=hdn&os=1&fi2=0&div1=0&ait=479&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=142&tet=1683&fi=1&apd=1754&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25477209&L2id=2356361194&L3id=4745166436&L4id=138239321298&S1id=23605329&S2id=23619609&ord=1540899679452&r=571611697009&t=nht&os=1&fi2=0&div1=1&ait=1120&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=5&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=1325&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680006&r=851642892997&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1017&tet=1574&fi=0&apd=1604&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899679745&r=571763131993&t=iv&os=1&fi2=0&div1=1&ait=1066&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1017&tet=1574&fi=0&apd=1604&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899679745&r=571763131993&t=nht&os=1&fi2=0&div1=1&ait=1066&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=4&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/ Frame A7A7
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20181024/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 25 Oct 2018 07:00:28 GMT
expires
Thu, 08 Nov 2018 07:00:28 GMT
content-type
text/html; charset=UTF-8
etag
12810928231326100212
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6940
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
448853
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
ads
googleads.g.doubleclick.net/pagead/ Frame DDAD
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151325&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678046&bpp=72&bdt=1435&fdt=3472&idt=3462&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=2&ga_vid=254076611.1540899682&ga_sid=1540899682&ga_hid=1939467065&ga_fc=0&iag=3&icsg=693856&nhd=1&dssz=21&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=5494&biw=1585&bih=1200&isw=728&ish=90&ifk=1649710351&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C214678000&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3550
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151325&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678046&bpp=72&bdt=1435&fdt=3472&idt=3462&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=2&ga_vid=254076611.1540899682&ga_sid=1540899682&ga_hid=1939467065&ga_fc=0&iag=3&icsg=693856&nhd=1&dssz=21&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=5494&biw=1585&bih=1200&isw=728&ish=90&ifk=1649710351&scr_x=0&scr_y=0&eid=21060853%2C21070025%2C214678000&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3550
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Oct 2018 11:41:21 GMT
server
cafe
cache-control
private
content-length
82
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUkzOfTTM8k-HjXTRlDR4NMhzBJAedI-FlCNdOXufd2fVEisLbOdXUNMnUB6; expires=Sun, 24-Nov-2019 11:41:21 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
expires
Tue, 30 Oct 2018 11:41:21 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame CFCB
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 25 Oct 2018 04:46:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
456873
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 08 Nov 2018 04:46:48 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/ Frame 3D39
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20181024/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 25 Oct 2018 07:00:28 GMT
expires
Thu, 08 Nov 2018 07:00:28 GMT
content-type
text/html; charset=UTF-8
etag
12810928231326100212
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6940
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
448853
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
ads
googleads.g.doubleclick.net/pagead/ Frame 7E0C
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151321&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678160&bpp=70&bdt=1571&fdt=3514&idt=3496&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=409345978.1540899682&ga_sid=1540899682&ga_hid=349311542&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=2834320770&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3610
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151321&w=728&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678160&bpp=70&bdt=1571&fdt=3514&idt=3496&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=409345978.1540899682&ga_sid=1540899682&ga_hid=349311542&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=2834320770&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=4066913089&ifi=1&fsb=1&dtd=3610
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Oct 2018 11:41:22 GMT
server
cafe
cache-control
private
content-length
82
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUlzlqzPNQmx3-jBSMnkHPMlE-GXDWFNrO9QblYjZyi5atjlK1zd44fIO1mM; expires=Sun, 24-Nov-2019 11:41:21 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
expires
Tue, 30 Oct 2018 11:41:22 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame FCD5
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 25 Oct 2018 04:46:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
456873
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 08 Nov 2018 04:46:48 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=744&tet=1499&fi=1&apd=1517&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680324&r=923319536227&t=iv&os=1&fi2=0&div1=1&ait=1127&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=4&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=744&tet=1499&fi=1&apd=1517&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1540899680324&r=923319536227&t=nht&os=1&fi2=0&div1=1&ait=1127&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=5&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=95&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899680845&r=345378867908&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=552&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899680845&r=345378867908&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:21 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:21 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/ Frame 23B4
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20181024/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
IDE=AHWqTUkzOfTTM8k-HjXTRlDR4NMhzBJAedI-FlCNdOXufd2fVEisLbOdXUNMnUB6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 25 Oct 2018 07:00:28 GMT
expires
Thu, 08 Nov 2018 07:00:28 GMT
content-type
text/html; charset=UTF-8
etag
12810928231326100212
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6940
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
448853
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
ads
googleads.g.doubleclick.net/pagead/ Frame FD4D
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151327&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678610&bpp=205&bdt=2008&fdt=3376&idt=3328&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1634682474.1540899682&ga_sid=1540899682&ga_hid=1238526953&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1501&biw=1585&bih=1200&isw=300&ish=250&ifk=1789179933&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3434
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151327&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678610&bpp=205&bdt=2008&fdt=3376&idt=3328&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1634682474.1540899682&ga_sid=1540899682&ga_hid=1238526953&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1501&biw=1585&bih=1200&isw=300&ish=250&ifk=1789179933&scr_x=0&scr_y=0&eid=21060853%2C21070025&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3434
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
IDE=AHWqTUkzOfTTM8k-HjXTRlDR4NMhzBJAedI-FlCNdOXufd2fVEisLbOdXUNMnUB6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Oct 2018 11:41:22 GMT
server
cafe
cache-control
private
content-length
82
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
osd.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame BD09
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 25 Oct 2018 04:46:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
456874
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 08 Nov 2018 04:46:48 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/
43 B
409 B
Image
General
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=1194&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1540899680845&r=345378867908&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.210.250.213 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:22 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:22 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/ Frame 6D66
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20181024/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20181024/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
IDE=AHWqTUkzOfTTM8k-HjXTRlDR4NMhzBJAedI-FlCNdOXufd2fVEisLbOdXUNMnUB6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Thu, 25 Oct 2018 07:00:28 GMT
expires
Thu, 08 Nov 2018 07:00:28 GMT
content-type
text/html; charset=UTF-8
etag
12810928231326100212
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6940
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
448854
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
ads
googleads.g.doubleclick.net/pagead/ Frame 963F
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151326&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678893&bpp=155&bdt=2293&fdt=3184&idt=3175&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1562241744.1540899682&ga_sid=1540899682&ga_hid=231920648&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2180882631&scr_x=0&scr_y=0&eid=20195144%2C21060853%2C21070025%2C370204018&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3208
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151326&w=300&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1540899678893&bpp=155&bdt=2293&fdt=3184&idt=3175&shv=r20181024&cbv=r20180604&saldr=sa&correlator=1813276275095&frm=23&ife=5&pv=1&ga_vid=1562241744.1540899682&ga_sid=1540899682&ga_hid=231920648&ga_fc=0&iag=3&icsg=173472&nhd=1&dssz=19&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2180882631&scr_x=0&scr_y=0&eid=20195144%2C21060853%2C21070025%2C370204018&oid=3&rx=0&eae=2&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=7&osw_key=3832671437&ifi=1&fsb=1&dtd=3208
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
cookie
IDE=AHWqTUlzlqzPNQmx3-jBSMnkHPMlE-GXDWFNrO9QblYjZyi5atjlK1zd44fIO1mM
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Oct 2018 11:41:22 GMT
server
cafe
cache-control
private
content-length
82
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
osd.js
pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/ Frame C7A0
73 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/show_ads_impl.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 25 Oct 2018 04:46:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
456874
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
server
cafe
etag
6345757217691752979
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 08 Nov 2018 04:46:48 GMT
mux.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/
70 KB
22 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/mux.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:22 GMT
content-encoding
gzip
last-modified
Mon, 26 Mar 2018 15:42:36 GMT
server
Apache
etag
"6ff5de35d5b5d1d667e341d5109a9c19:1522078959"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
21978
expires
Thu, 29 Nov 2018 11:41:22 GMT
ggcmb510.js
cdn-gl.imrworldwide.com/novms/js/2/
12 KB
5 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.223.143 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-223-143.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 04 Oct 2018 18:49:05 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Oct 2018 17:26:15 GMT
Server
AmazonS3
Age
60734
x-amz-server-side-encryption
AES256
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
DqBXYNAeWk9c9ecQe6fCjbgUkjUpFyFY
Via
1.1 40b36a86ab4ea993a78087b1ceb80e25.cloudfront.net (CloudFront)
Cache-Control
max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
X-Amz-Cf-Id
22t1Mp-_8wu5PAk487wlR_ILRWYVIQeEMT5EzppTy_2qzD-GW6VeDA==
AppMeasurement-2.3.0.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/
77 KB
27 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:22 GMT
content-encoding
gzip
last-modified
Mon, 26 Mar 2018 15:42:35 GMT
server
Apache
etag
"d71ba6c9a930b6864408830c3e2705f9:1522078958"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
27260
expires
Thu, 29 Nov 2018 11:41:22 GMT
VideoHeartbeat-2.0.2.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/
143 KB
29 KB
Script
General
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:22 GMT
content-encoding
gzip
last-modified
Mon, 26 Mar 2018 15:42:35 GMT
server
Apache
etag
"215943f0e77b4fcc9cc72b98a8ea1cfc:1522078958"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
28977
expires
Thu, 29 Nov 2018 11:41:22 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame C7A0
42 B
112 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvzIqJq6C19QQZ9lmlNBN6RpXmiF_GLeTLKj73zhHlbCshu4jM1UECUNComp3PHSuDEafTrvs3VnQz1KRsPDDCFbyTF-x_Cg1bhPBs&sig=Cg0ArKJSzPFx6EpsI_pyEAE&adk=1017379368&tt=3881&bs=1585%2C1200&mtos=1312,1312,1312,1312,1312&tos=1312,0,0,0,0&p=513,1043,763,1343&mcvt=1312&rs=3&ht=0&tfs=2618&tls=3930&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1540899677115&rpt=3441&ps=1585%2C5909&ss=1600%2C1200&pt=50&deb=1-8-8-44-11-50-53-2&tvt=3884&r=v&id=osdim&uc=2&tgt=DIV&cl=1&cec=14&clc=1&cac=0&cd=300x254&v=r20181024
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Oct 2018 11:41:22 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/
715 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
truncated
/
2 KB
0
Media
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
video/mp4
/
www.zdnet.com/homepage/xhr/
268 KB
29 KB
XHR
General
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.64 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-64.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/homepage/xhr/
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
28721
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Oct 2018 10:36:09 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 30 Oct 2018 11:41:24 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
0a62c286-16b1-48d1-867f-b16c003db6ff
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
fly_device=desktop; expires=Tue, 06-Nov-2018 11:41:24 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Tue, 06-Nov-2018 11:41:24 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
accept-ranges
bytes
expires
Tue, 30 Oct 2018 12:06:09 GMT
ring.gif
zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/
16 KB
9 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/ring.gif
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:24 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
etag
W/"5bd74555-3f75"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
9039
expires
Tue, 06 Nov 2018 11:41:24 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet2.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20181024/r20180604/osd.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:24 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
etag
W/"5bd74555-6fa"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1513
expires
Tue, 06 Nov 2018 11:41:24 GMT
ZDLogoMicroWhite-x2.png
zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/
2 KB
2 KB
Image
General
Full URL
https://zdnet4.cbsistatic.com/fly/1540834645-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://zdnet1.cbsistatic.com/fly/1531-fly/css/core/main-6743c8f11b-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:24 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:37:25 GMT
server
nginx
etag
W/"5bd74555-691"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1398
expires
Tue, 06 Nov 2018 11:41:24 GMT
Pinkypills_iStock-511733570.jpg
b2b.cbsimg.net/images/pro/
0
0

glcfg510.js
cdn-gl.imrworldwide.com/novms/js/2/configs/
2 KB
1 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.32.223.143 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-223-143.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 04 Oct 2018 18:49:05 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Oct 2018 17:26:15 GMT
Server
AmazonS3
Age
60735
x-amz-server-side-encryption
AES256
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
l2xJuxUC0tglEkdOi9HXoncecbKiMqKp
Via
1.1 40b36a86ab4ea993a78087b1ceb80e25.cloudfront.net (CloudFront)
Cache-Control
max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
X-Amz-Cf-Id
LNiFspAy25AGLIl-APF4Qmp_mFTHrEn76r1iJiLly2I8g5prRJ_p2g==
id
dpm.demdex.net/
2 KB
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1540899685073
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.219.56 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-31-219-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v006-0bcd55556.edge-irl1.demdex.com 5.41.0.20181011114220 7ms
Pragma
no-cache
Content-Encoding
gzip
X-Error
300,300
X-TID
Nu4/DSz3TBA=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
704
Expires
Thu, 01 Jan 1970 00:00:00 GMT
bridge3.249.0_en.html
imasdk.googleapis.com/js/core/ Frame 7E6C
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.249.0_en.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.249.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
173274
date
Wed, 24 Oct 2018 23:53:58 GMT
expires
Thu, 24 Oct 2019 23:53:58 GMT
last-modified
Wed, 24 Oct 2018 23:44:32 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
1; mode=block
cache-control
public, max-age=31536000
age
474447
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
client.js
s0.2mdn.net/instream/video/
26 KB
10 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s07-in-f6.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
10523
x-xss-protection
1; mode=block
expires
Tue, 30 Oct 2018 11:41:25 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/
0
0

default-se4908240cd.png
zdnet1.cbsistatic.com/fly/images/sprites/video/controls/1x/
8 KB
8 KB
Image
General
Full URL
https://zdnet1.cbsistatic.com/fly/images/sprites/video/controls/1x/default-se4908240cd.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1531-fly/js/main.default.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.69 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-249-69.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash

Request headers

Referer
https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-ebaf8ad91a-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 30 Oct 2018 11:41:25 GMT
content-encoding
gzip
last-modified
Tue, 18 Sep 2018 08:52:10 GMT
server
nginx
etag
W/"5ba0bcba-1e14"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
7728
expires
Tue, 06 Nov 2018 11:41:25 GMT
/
www.zdnet.com/video/selector/andromeda-botnet-malware-is-still-an-infection-issue/
0
0

pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=3&q=0&x=0&y=0&hp=1&kq=1&lo=0&qs=1&ak=-&i=CBSDFPCW2&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBBBHhBBwBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&qr=0&vf=1&vg=100&bq=0&wp=3&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=1200&w=1600&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F&cm=0&f=0&j=&o=3&t=1540899679452&de=571611697009&cu=1540899679452&m=5793&ar=7554d5b-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9981&le=1&lf=1589&lg=1&lh=1023&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A20%3A-&as=1&ag=4876&an=1683&gi=1&gf=4876&gg=1683&ix=4876&ic=4876&ez=1&ck=1055&kw=142&aj=1&pg=100&pf=100&cc=1&bw=4876&bx=1683&ci=1055&jz=142&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4947&cd=1754&ah=4947&am=1754&rf=0&re=1&ft=4313&fv=1120&fw=492&wb=2&ap=4947&cl=0&av=0&at=1&d=25477209%3A2356361194%3A4745166436%3A138239321298&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=1600x1000&zMoatPS=top&zMoatSZPS=1600x1000%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&gw=cbsdfp5832910442&zMoatW=1600&zMoatH=1000&zMoatVGUID=8eece63f-8ee4-43a8-8409-71f624b5334d&zMoatSN=a&zMoatCURL=zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks&zMoatDev=Desktop&zMoatSlotId=skin&zMoatDfpSlotId=skin-5bd82def2bc25&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=1%3A1&tz=skin&fs=152610&na=1370493786&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Referer
https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Oct 2018 11:41:25 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Tue, 30 Oct 2018 11:41:25 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/
0
0

load-more-31f576808f-rev.js
zdnet3.cbsistatic.com/fly/js/components/
0
0

/
www.zdnet.com/newsletter/xhr/widget-login/
0
0

/
www.zdnet.com/m3d0s1/xhr/horizontal/
0
0

id
som.cbsi.com/
0
0

loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/
0
0

domains
api.viglink.com/api/
0
0

PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
cdn-gl.imrworldwide.com/conf/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
b2b.cbsimg.net
URL
http://b2b.cbsimg.net/images/pro/Pinkypills_iStock-511733570.jpg
Domain
www.zdnet.com
URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/?promo=2150&count=3&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&pagetype=article&topicname=security&secondarytopicnames=internet+of+things&topicbrcrm=editorial&assetguid=7a12161d-2a5f-4793-b0a4-9fac038733de&assettitle=gigantic+100%2C000-strong+botnet+used+to+hijack+traffic+meant+for+brazilian+banks&assettype=content_article&devicetype=desktop&viewguid=8eece63f-8ee4-43a8-8409-71f624b5334d&upId=189325981&template=right-rail
Domain
www.zdnet.com
URL
https://www.zdnet.com/video/selector/andromeda-botnet-malware-is-still-an-infection-issue/?acp=sz%3D640x483%26iu%3D%2F8264%2Fvaw-zdnet%2Fdesktop%2Fzdnet%26ciu_szs%3D300x60%26impl%3Ds%26gdfp_req%3D1%26env%3Dvp%26output%3Dxml_vmap1%26unviewed_position_start%3D1%26url%3Dhttps%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F%26description_url%3Dhttps%3A%2F%2Fwww.zdnet.com%2Farticle%2Fgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2F%26correlator%3D1540899685220%26cmsid%3D2289%26vid%3DWXE3_slFKFdtChIY_WrGbURUW8jGB7YM%26pp%3Dvpaid_js%26cust_params%3Dvid%253DWXE3_slFKFdtChIY_WrGbURUW8jGB7YM%2526ptype%253Darticle%2526vguid%253D8eece63f-8ee4-43a8-8409-71f624b5334d%2526session%253Da%2526subses%253D4%2526microsite%253D%2526campaign%253D%2526cid%253Dgigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks%2526collection%253D%2526mfr%253D%2526carrier%253D%2526section%253Deditorial%2526userGroup%253D%2526tag%253D%2526edition%253D%2526test%253D%2526score%253D%2526feat%253D%2526subcollection%253D%2526topic%253Dsecurity%2526sectopic%253D&m=%2Fvideo%2Fmanifest%2Fandromeda-botnet-malware-is-still-an-infection-issue.m3u8%3Fdevice%3Dott%26change-to-host%3Dtechrepublicmedia.akamaized.net%26secure%3Dtrue&callback=uvpHandleJsonpResult
Domain
zdnet4.cbsistatic.com
URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Domain
zdnet3.cbsistatic.com
URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-31f576808f-rev.js
Domain
www.zdnet.com
URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Domain
www.zdnet.com
URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/?promo=2149&count=4&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&pagetype=article&topicname=security&secondarytopicnames=internet+of+things&topicbrcrm=editorial&assetguid=7a12161d-2a5f-4793-b0a4-9fac038733de&assettitle=gigantic+100%2C000-strong+botnet+used+to+hijack+traffic+meant+for+brazilian+banks&assettype=content_article&devicetype=desktop&viewguid=8eece63f-8ee4-43a8-8409-71f624b5334d&upId=189325981&template=horizontal
Domain
som.cbsi.com
URL
https://som.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=27817561378217350444046354068183353140&ts=1540899685480
Domain
cdn.taboola.com
URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Domain
api.viglink.com
URL
https://api.viglink.com/api/domains
Domain
cdn-gl.imrworldwide.com
URL
https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| knownServiceWorkers object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define number| BOOMR_lstart object| googletag object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| headertag function| headertag_render object| pbjs object| BOOMR object| BOOMR_mq object| GPT_jstiming object| google_reactive_ads_global_state undefined| google_measure_js_timing function| $ function| jQuery undefined| easyXDM object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID number| BOOMR_onload object| fly undefined| testGroup undefined| testName object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om number| BOOMR_configt number| _uInterval object| _bmrEvents function| pf_notify string| bm_website_code object| _ml function| dw_callback function| lightboxjs function| lightboxlib function| vl_cB function| vl_disable function| vglnk_15408996732665 object| EF function| setUpAgknTag function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in function| Visitor object| visitor function| DIL number| s_objectID number| s_giq object| Modernizr function| Waypoint object| jQuery18309101376336435265 object| __ql string| path string| host object| scriptTags object| ret function| agknTagBuilder object| _agknTag string| _agknTagName object| _agknEchoTag number| _isAgknTagSet object| debug object| $tealium object| DW function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr object| TRUE_ANTHEM boolean| searchOpen object| $lastFocusedInput string| pageType undefined| jQuery18309101376336435265_1540899672445 undefined| jQuery18309101376336435265_1540899672446 string| waypointContextKey undefined| vglnk_15408996741126 object| swfobject object| CryptoJS object| mPulseApp object| UA function| udm_ function| ns_order object| ns_ object| ns_p string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url function| fbq function| _fbq string| disqus_shortname object| s_i_cnetzdnetglobalsite object| QSI number| _rnd string| __prot object| __i object| DISQUSWIDGETS undefined| disqus_domain function| renderAdCallback function| blankAdCallback string| firstpgvar boolean| google_noFetch boolean| google_DisableInitialLoad number| __google_ad_urls_id object| sticky number| google_unique_id object| gaGlobal object| DIGIOH_API function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener function| Spinner object| uvpjs function| Class object| mpulseUserTiming function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb

11 Cookies

Domain/Path Name / Value
.zdnet.com/ Name: utag_main
Value: v_id:0166c4c7132b000140a855628dd200078006d07000b08$_sn:1$_ss:1$_st:1540901472890$ses_id:1540899672890%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: ak_bmsc
Value: 4DB66A3164A7DC2847B15D8B2695174D48F7B3641F6100005643D85BF894B60F~plazfXEeWcx1UXM/q/316LJcyGdDYjfxcPvo8qQlVhwQAQuyeJiv5fBlj5aZpkbudLSFC/7OyuMvNt4vmaMsxrw15zaEhz9cn55I5Qjv3y2WR+4w5TFPH/ntDEj+ahs6gFEGKSWWL1LyS8F0RTv2eZ6R6iQNuwcEA4nY/7oFGqOsmmFAWFbX3gYnUG2S1WL9YJgCbPr/Fn9j5EHdnFt3BebJX+M+akCAzJcD2D+w4YJbg=
.zdnet.com/ Name: _fbp
Value: fb.1.1540899669804.1874514021
.zdnet.com/ Name: nemo_highlander-video_focus
Value: video_focus%3a1%3aexclude
.zdnet.com/ Name: fly_preferred_edition
Value: eu
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}
.zdnet.com/ Name: __gads
Value: ID=dd9ba7ceed81f671:T=1540899669:S=ALNI_MbNPfHitTNDI4immFxZGnvnes0X2g
.zdnet.com/ Name: fly_default_edition
Value: eu
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: aam_uuid
Value: 74926206232441188180716735996261109217
.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks Name: CBS_INTERNAL
Value: 0

66 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 732)
Message:
ADS: queuing nav-ad-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1203)
Message:
ADS: queuing intromercial-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1272)
Message:
ADS: queuing skin-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1281)
Message:
ADS: queuing leader-plus-top-5bd82def2bc25 for display
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom not ready, setting event
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1420)
Message:
ADS: queuing inpage-video-top-5bd82def2bc25 for display
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom not ready, setting event
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1430)
Message:
ADS: queuing sharethrough-top-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1653)
Message:
ADS: queuing mpu-plus-top-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1763)
Message:
ADS: queuing dynamic-showcase-top-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 1770)
Message:
ADS: queuing mpu-middle-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 2004)
Message:
ADS: queuing mpu-bottom-5bd82def2bc25 for display
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 2021)
Message:
ADS: queuing leader-plus-bottom-5bd82def2bc25 for display
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom not ready, setting event
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom ready, triggering load
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom ready, triggering load
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
dom ready, triggering load
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201809191808(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log (Line 2)
Message:
ADS: queuing mpu-bottom-5bd82def2bc25 for display
console-api log (Line 33)
Message:
blank creative loaded: 138245072116 (5 x 5, pos=nav)
console-api log (Line 33)
Message:
blank creative loaded: 138239321298 (1600 x 1000, pos=top)
console-api log (Line 33)
Message:
blank creative loaded: 138247985753 (300 x 250, pos=bottom)
console-api log URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636754604557185965(Line 1224)
Message:
DIGIOH: identityChildReady999999999: zyxcba
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_video
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log (Line 33)
Message:
blank creative loaded: 138239375180 (372 x 142, pos=)
console-api log (Line 33)
Message:
blank creative loaded: 138239479696 (372 x 142, pos=)
console-api log URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636754604557185965(Line 1224)
Message:
DIGIOH: Calling setIsCrossDomainStorageWorking using short circuit!!!!
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js(Line 20)
Message:
UVPJS 2.8.3 03/26/18 8:42:19 AM (PDT)
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): disqus_init
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/gigantic-100000-strong-botnet-used-to-hijack-traffic-meant-for-brazilian-banks/(Line 106)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api warning URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8)
Message:
mPulse: Custom Timer 'video_ploaded' is not defined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

22ffaa5b.akstat.io
36e4f0eb.akstat.io
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
as-sec.casalemedia.com
asset.pagefair.com
asset.pagefair.net
b2b.cbsimg.net
beacon-eu-ams3.rubiconproject.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cdn-gl.imrworldwide.com
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.agkn.com
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
geo.moatads.com
googleads.g.doubleclick.net
graph.facebook.com
idsync.rlcdn.com
iicbsi-a.akamaihd.net
imasdk.googleapis.com
in.ml314.com
js-sec.indexww.com
js.agkn.com
l.betrad.com
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s.update.rubiconproject.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
som.cbsi.com
stats.pagefair.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
tpc.googlesyndication.com
tru.am
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
www.everestjs.net
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.linkedin.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
api.viglink.com
b2b.cbsimg.net
cdn-gl.imrworldwide.com
cdn.taboola.com
som.cbsi.com
www.zdnet.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
104.84.146.193
104.96.33.116
104.98.131.27
108.161.188.128
13.32.223.143
13.32.223.3
151.101.120.134
172.217.22.34
184.30.223.226
185.33.223.83
2.18.233.143
2.18.234.21
2.18.235.40
213.19.162.21
213.19.162.27
213.19.162.31
213.19.162.67
216.58.206.2
216.58.210.2
216.58.210.6
23.210.249.113
23.210.249.64
23.210.249.69
23.210.250.213
23.211.152.143
23.211.9.164
23.45.101.171
23.60.196.160
23.67.129.200
23.67.133.222
2400:cb00:2048:1::6810:4ea5
2400:cb00:2048:1::6810:a00d
2600:9000:20bb:8600:15:efbc:e300:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2a00:1288:110:833::4000
2a00:1450:4001:814::2002
2a00:1450:4001:816::2001
2a00:1450:4001:816::2002
2a00:1450:4001:816::2004
2a00:1450:4001:816::200a
2a00:1450:4001:81a::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:81d::2002
2a00:1450:4001:821::2003
2a02:26f0:10:28b::e3d
2a02:26f0:e7::5f65:48d0
2a03:2880:f01a:1:face:b00c:0:1
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:10:101::b93f:9101
34.199.78.214
34.226.72.85
34.231.154.145
34.242.76.181
34.246.247.78
34.249.86.253
34.251.108.175
52.31.106.135
52.31.219.56
52.56.60.241
52.57.223.246
52.72.136.100
54.154.175.204
54.171.28.28
54.171.47.36
54.76.196.204
63.140.43.37
64.30.230.22
66.117.28.68
66.117.28.86
68.232.35.180
94.31.29.248
95.101.57.157
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
009396e873c2f93482891861160df34a0a69bd1beaad7c5fc04d8dd36e4eec44
03e9600c1dc7c553a30f637b10e37d03ed2ef8fb2b9dc4354f95f72d14d00547
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
056caccc79485b128acf68f48bb455758c8a8d23f8e1bea298d34c98e159adb9
066c53137145d00c341b96b0513eb555b7be7c94f0cff9ce33cb3561921e6988
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
08a3665f18455a87378690736743cd9a199c38bd7d9fea5df993e21fa6120a68
0bf6182b8f4535dcbc60eee60753242d0c52a3eb6a5a7c8876205a60a4f051df
0d6baa46c3cd463a5d3f967d89f7cf48d5909c34b22f6d671cc9f0c4f929611c
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
1035f2104deed99e4df4725f40be064c22306533cd921e9be7584e87513ee7cb
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12ad8239fdc7df2d9d55a4b95c50889ee71c967abf315581ccfa26eb5dc46b63
13112639ea5d320063c21803f0172ec3273678f4d8a6215df67c4774659a233e
1491a1594a4058a62ea4c08441cfcbbfe82a0916b4f26b55f3605af896766dd7
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1850ed533f7bef263c3b15379882c2ff9a33ac1d097864dd0c600633665f334d
186e5821720593367310d36fc9e71747518897853d453a6823194d0004b51f16
18e110ff918c99541657918aa03e2f59e43e5490ac8f7d7fa84ad19ab622db0c
1b91058b5969c2319ee3f3efb2b91ccf388c64fe22f806e59b0edb43694150d4
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1ff53412e0f7149ee0e54173d5681958ad656643e3213acdd588941c89642f9e
2651576977d18928324a68a053a929a1acddffbbc6a04c8face239c5b489b34a
2671d72b96d6d9a1b8bbc1429048505ea6dbc3514daf22ab6dd6dfc8a70ce8d3
27676ea482895bdddd3f3796f430a812e11364efc224227c86973a52398966c2
2b28e861a4e45fd1f546a63afabd2f757f8f9e18ec13a5316812237d02a74ecc
2b4b44954ecddf65e5391cb2df9f86cffc2979ebe88399bac1d61e5e918b8ed6
2bb8e607aa914110121eb1e2d4a65514285c78342811558156449443f644cf7b
2ccd728594ce65fa7e6651109e3bbd61877e548c4dab5480cafa6965f358a4e0
2dbd42e5d6b936274e0cf1688678f567784f89ae4f350d3eaee2dd6b86f65075
2fda304c399fb1d750521411baea266a28f130d6d603aaf5c0bdbcbcae5225ff
31f2502985cd82156618c2842decdd66226091e4f616c8cd3867a9ead2c8a9e3
334ecb5de067cf73650b13cd8a01b4493877bdbcb41405cde049e4fdcb14d487
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3544c18bb4d954e8f42793b40c495a703718155222054639fd3be53139e0a363
35733dd71de077b039d2bac6614c78eb3ab7d3879cb307cc10cc1907d2f61eb6
35c04e5b7a4044d3d19a6ccd99871a0e7d999570e2c5cfca5c91837e54ebfc9f
37594bf5cea078e78adfeaee203437d94166b7d2c073b5c3c170a1ba730eca01
3988f709c09d423be46f08ad2547895597522365a2ef41a233f6d270d284e5a6
3abead375bb8d384d18dd455d548fa9d94dfd5a876dd8be9b3a5235c771abfec
3c599ef176cecdb3de25c6c36bc2945b92c12bcbc2ab03350729f4de296b53b8
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
40c707d407e524f6e535fe307be27c3d79067da9cbf8fa9eef3c9ec1933e12df
40d317f999e71c7635619879cf4c5901505ea487011a00a220e560996f7557b1
42a485fb7d29e8c8425e408bfd87c206d0abd194e53a5828fde88fba1a6b1410
453cb692f7616556511f28fdf07f53d8e36e149c0e71941b04fed49d3f1ed4b1
48f9f52eab0cf9438927a201b28ddc42bac3bda7080b80b0db4cc913fccb3514
4ab6a27e7fab0d1aa86e5fb3cef44c53865862b2c8d6c076ee44409a12e6b644
4d049d83eef469c1f2cc0f5df820144ff6c5eb896b4e4aa2e681a1cba7d622a9
516b065177d1546683627fa32c8574fd59edc3eb3bf92cef5882d53e58d7a1f2
52d07282ab84dbb43f7267311c7dc10af8c18bc40245f2f79876da58bb44afa2
56bf714084093ce2762a223acbaee3f925b631b6fb24aee9f2f96c09bcc94c66
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4
579e81f46017126d8f898dd79dc3930782f6e9e41d0537e9050310cc8dadc73e
59fa64ad7c24c69c82afa4a5e644c2ff8ed1b74617c935385f91618ac7ac1e66
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5ef59ad4dddabd3575bc297b1058ed39338fc1a1b24b9ee3119c20fc25889ac9
61fdf37d30bf412dd87c52565f2b227ce9c3b57030950437fd0bd650d11bc035
65f5e636f6cedbc5d6f04b8d440b438444ef01d6e39df092ee30799e5c72c2d7
66f72553111483f0e64c9f9eeccd9e3ec7b6b2de9f48041f4ed63b95919d1ba8
6777cc97d90b6e3773b62f12dfc047362dd55f7610369239eafd46c109cd5380
692eceed814a31459176da6b273b242072c774b1b74c38b64a1ce6f97f478ded
694d40f6c8eb9760993e74b773dbb2cf3822ccb7f14a6d28320927cc5f9bad90
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6987f5dab3ced7612887b80ca2de81041654a6434970e1cbbb03c293dd47ce0b
6ac72fa11e76ea6fdbb1b310f67b3b9b24c11da94774a89323b71930ae544eee
6c65a8205295ee9b8a16e60080102aa2125add70f44910fef31523649d252ac0
6d4dc28c491ca7ff1c86fa292821d3174e2c7638170628e1daa411da61d10684
6e54e138b6fae2de8311caa399c9f4459f413e0009123f07e5e8c4c855e500f5
7017fe26514320eea8b02069a2ec814953fc7f78d3513ab52c4c80108d112b56
732228e83d21cc7301ad8d797375488ecc5083accaee96ee37d709de23492edb
7494b5f117bd3a5e1356482231a366d54cece4fcc1db312e00e4ee136a15bff6
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
78e6c9bd32bac30d3171f0257ad9961c141202694725e96d005fd11a8281f556
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
791fe98fa98194a44df29618bccc78966b210dde241867fc772872d9fa45a1dd
7cdcfff39260d66cc0fac190f66caf465044cba360fc5396cc98654f6d1cebc4
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
802446cd0aefe1f43030cf3e02eddbbbec61e27e62479d990d8889266943a650
87bc265dda5e31597442c420def76eeadb5c516d016213a47f570c65d5558b72
8896bd9aad2399ee52a9878c7ada2e49df2f66ba91afd102244018c25ffd88e2
89b08981d2dcbbc50524744f8d3beee8e325096b9030f5bbb0244f5e93bc57dc
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a27fab6c5a0b1db438219c7d24ce2fff95e0910378fe4bdeb64b4f970eebccc
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
8ecd26fc9c655b3733446067ac52df91613ada52eefb870c5f5b9eb26c958e6e
901fc3206be099c4dc64931428fe93dc4a2130063aaba7e94090303ded1397a0
9242cae28bc65d0b14fc566242452e05bdce12813551d6bb027c066d54bbf2f7
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
965b325924d7bd803f6fb1007b982eeb412ebfd696a20986fd4e6bc221daf413
9acc0eb4103d7b741c330849d8234002afa518fd931f8dc964dd3824298d41a1
a20c788fad1957d4bcd135b761c2ede3fd3ddc4a1b9a5ed0c565be047fe7e3f0
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a9ce98163501d06cddc5df8965646c53641b881907052534d08b10f79cdae6f5
a9da93f742d8d4eddc134562058f80e83370887054382b222f5529a964a072b8
aa039913574a9fc246c8bdbb10f92acad18940eb239ac6719a6681717114df81
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2816ae41889388360482588c8af317634fce4179e6cfdad21f26e23ab6a9f7e
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b34a764a54cd042f769a2e1a002a27c14132167d8ab9967bc49419c87b694d99
b47241eabf30c18bf1761e363bdc9e5b755ea4b60d71ca9d1a0b3c4f7ffefdb7
b50a701e3677d3b9810ddf2d0a775c976210f5c433926d515b24e0d62b6e3af4
b515dddfa0a3c384975254674f077a147742c15807ac2deed1f5768eb5665bd1
b836eb7325ac607513eaacb51a19639451d3fb357168f991c29bd6e9d9f250af
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b910af5bf47dfe51e609aa609f4f0782d332155b50b3b5181e6d10116f9bbec6
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bf413671ac4278a51bc9621af98e7f5a6cdbb228ecda66602f7e02ea27b28d13
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c01a8a2706b50bde5231da184eaa7ad2fb277aa2fc94efd6945181cdac490db4
c29aede9b733e2630e614ca4ddd82b140700d3e5f735ff52fc90d95d92d20274
c9f9ded1c66d9f290eeb0fadad73f3bba0d8cc2c784b078e9b00eca200eca125
cce2434b8d369c899222952dfae5ec6c72c74f4f6909041db6d0500858909bc8
cce5c991fc672328e8eb7e5f9026496acd4fa608d26d0df95c54b7f16a8e5cc4
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cd63ae8e997a18c10bfd698381945cd74fcb8ae84e45fbcbbab48a37d9b33a1b
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d05a0088d1a2c67e0707be3f7ff1823683ba849a3d3d4004d971cb58eb40d08a
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d2c77b8eaa09d5efbdaced4a423d42fb03ddc3322f005c7d51d108fb13ff58bc
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d48e0904f1b40972f1fc6dac3f358719e080fab3291d13d2ca4a60405707a88b
d5e9dfd6066c2872be4f85c25aa0186402b124ea3f80152e2e2b767906793284
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6e6bd9d40a807b7402dd2c2b74700d0790e0733718a4343c2a6fa140da3a62e
d87e7ae7ae26449d10b981391c33bcb99233194abe70be20d2da093e1bde1215
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
ddfc91f954a7df70ddb1b6d0265eb1792d1c7922d50463d968159e7a4403fb1c
de749bdbeeb7bb7f79cb31ff00fe6830004064419f73fe9a6ec982e9de8bf19d
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e12006702d63c047122ecce41f04cff2209a5448ae8aea0ebdfd8512f161d1a4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e7997017dc260134fdebbcb6f5250d90c2f81e1949f98efa254001282674f60f
e82d3b944d1db43508e51de2d0257293d32a72f2a0df458c0862c88fadef5daf
e9b3eb7f022396e969766ad5e908b21df0b646c943e149902c64de590e9549d9
ea3caa8c8f60b47efc50f2b57918f76502e713f09caeb0123e4349710455d70e
eb579f6589e12694342b61e319630262ef1bf724e1dd61e2e74e5416860f0c6c
ebff5e526eaecb20e91c2af0476f72cdae479b8e36b89f4e3068ce46dd1db96f
ee221041a905f4b0fbe76dc05e44575523fd26a93f9e038bcb19d16e4155ee5b
ee58d451d4c826e171525a0fb417343a42ae338fd8afb6b77613235476f89dfe
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f158dee56c879e346479ff65c3a3f9135fbae73d8757264df8239dd0e5809e95
f27c0c9f284c6959dd7db1e768c6e43a518ea650afc69d7a60383f3a963cde7b
f36898b72fa83b9cf7cd832935a5c06658a7c3b55d35c200a1ecff3360384f18
f7739b424d4acd048d584bf1bfa99a1ea5481989d1abb8948e9bf571729f2c72
f8ab45ee0969bb98916fa2ba950a26e40d4039a8d402bc661bd99ee0392edbc0
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473
fa107680c3e0cfd1620aebe62462103703993ada997d84aa6d5f55ce0ea3cba0
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
faf50b9ffe58f834c4796d588923150c2a2ed752b0d670e32293827b6038c758
fb9007c254c493be4a067de535b19a30f5e5aef3d5b19f58b1c72d2c65a04f79
fde388282164f37b534118bfd3711ff04b903976d8413d7c3f0caa17b5157afa
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097