www.trendmicro.com
23.58.108.159 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html 13yr old
Submission: On March 15 via api (March 15th 2026, 4:57:14 pm UTC) from IN — Scanned from IL

Summary HTTP 186 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 44 IPs in 5 countries across 36 domains to perform 186 HTTP transactions. The main IP is 23.58.108.159, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.trendmicro.com. 13yr old
TLS certificate: Issued by Sectigo Public Server Authentication ... on October 23rd 2025. Valid for: 1yr.

This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
39	23.58.108.159 23.58.108.159	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
8	104.18.86.42 104.18.86.42	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	142.251.208.170 142.251.208.170	15169 (GOOGLE) (GOOGLE - Google LLC)
2	108.138.7.97 108.138.7.97	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
20	13.33.187.58 13.33.187.58	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
11	2.16.10.185 2.16.10.185	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
3	142.251.127.190 142.251.127.190	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.201.125.192 35.201.125.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1	104.18.32.137 104.18.32.137	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	34.111.194.12 34.111.194.12	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
2	142.251.141.131 142.251.141.131	15169 (GOOGLE) (GOOGLE - Google LLC)
7	216.58.206.72 216.58.206.72	15169 (GOOGLE) (GOOGLE - Google LLC)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY - Fastly)
1	2.18.64.212 2.18.64.212	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
7	142.251.127.113 142.251.127.113	15169 (GOOGLE) (GOOGLE - Google LLC)
2	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	23.67.142.205 23.67.142.205	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4 18	23.50.131.146 23.50.131.146	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
3	52.222.136.121 52.222.136.121	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	142.251.127.154 142.251.127.154	15169 (GOOGLE) (GOOGLE - Google LLC)
3	104.20.20.192 104.20.20.192	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	20.250.198.32 20.250.198.32	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 2	95.101.111.156 95.101.111.156	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	3.120.53.250 3.120.53.250	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 5	150.171.22.12 150.171.22.12	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1	172.64.146.215 172.64.146.215	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.66.171.172 172.66.171.172	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	185.89.210.212 185.89.210.212	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - Xandr Inc.)
1	192.28.153.119 192.28.153.119	15224 (OMNITURE) (OMNITURE - Adobe Inc.)
1 4	150.171.27.10 150.171.27.10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2	18.172.114.101 18.172.114.101	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 5	142.251.141.100 142.251.141.100	15169 (GOOGLE) (GOOGLE - Google LLC)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 3	13.107.246.44 13.107.246.44	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 3	142.251.140.162 142.251.140.162	15169 (GOOGLE) (GOOGLE - Google LLC)
3	142.250.201.67 142.250.201.67	15169 (GOOGLE) (GOOGLE - Google LLC)
4	157.240.234.35 157.240.234.35	32934 (FACEBOOK) (FACEBOOK - Facebook)
3	20.231.53.73 20.231.53.73	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2 4	172.217.16.166 172.217.16.166	15169 (GOOGLE) (GOOGLE - Google LLC)
2 4	142.251.141.102 142.251.141.102	15169 (GOOGLE) (GOOGLE - Google LLC)
4	34.228.93.103 34.228.93.103	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
186	44

39 23.58.108.159 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-58-108-159.deploy.static.akamaitechnologies.com

www.trendmicro.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

8 104.18.86.42 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.cookielaw.org 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.251.208.170 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfraa-bl-in-f10.1e100.net

fonts.googleapis.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 108.138.7.97 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-7-97.fra56.r.cloudfront.net

customer.cludo.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

20 13.33.187.58 (New York, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-33-187-58.fra60.r.cloudfront.net

tags.tiqcdn.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 2.16.10.185 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-16-10-185.deploy.static.akamaitechnologies.com

trendmicro.scene7.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.251.127.190 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfrai-in-f190.1e100.net

www.youtube.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 192.125.201.35.bc.googleusercontent.com

cdn.bc0a.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.18.32.137 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

geolocation.onetrust.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 34.111.194.12 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 12.194.111.34.bc.googleusercontent.com

ixfd2-api.bc0a.com 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.251.141.131 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-aj-in-f3.1e100.net

fonts.gstatic.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 216.58.206.72 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-aa-in-f8.1e100.net

www.googletagmanager.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, Inc., US)

static.ads-twitter.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 2.18.64.212 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-18-64-212.deploy.static.akamaitechnologies.com

snap.licdn.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 142.251.127.113 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfrai-in-f113.1e100.net

www.google-analytics.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

connect.facebook.net 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 23.67.142.205 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-67-142-205.deploy.static.akamaitechnologies.com

munchkin.marketo.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

18 23.50.131.146 (Frankfurt am Main, Germany) 4 redirects

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-50-131-146.deploy.static.akamaitechnologies.com

j.6sc.co 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
c.6sc.co 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
ipv6.6sc.co 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
b.6sc.co 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 52.222.136.121 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-136-121.fra50.r.cloudfront.net

widget.equally.ai 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.251.127.154 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfrai-in-f154.1e100.net

www.googleadservices.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 104.20.20.192 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

static.addtoany.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 20.250.198.32 (Zurich, Switzerland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

www.clarity.ms 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 95.101.111.156 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a95-101-111-156.deploy.static.akamaitechnologies.com

trkn.us 11yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 3.120.53.250 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-120-53-250.eu-central-1.compute.amazonaws.com

collect.tealiumiq.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 162.159.140.229 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

t.co 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
analytics.twitter.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 150.171.22.12 (United States) 2 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

px.ads.linkedin.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.64.146.215 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.linkedin.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.66.171.172 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

static.addtoany.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 185.89.210.212 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEXUS - Xandr Inc., US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 192.28.153.119 (United States)

ASN15224 (OMNITURE - Adobe Inc., US)

605-sfw-393.mktoresp.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 150.171.27.10 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
c.bing.com 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 18.172.114.101 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-172-114-101.fra60.r.cloudfront.net

js.adsrvr.org 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 142.251.141.100 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-ai-in-f4.1e100.net

www.google.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

epsilon.6sense.com 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 13.107.246.44 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

scripts.clarity.ms 9mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
c.clarity.ms 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.251.140.162 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfraa-bt-in-f2.1e100.net

googleads.g.doubleclick.net 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 142.250.201.67 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-aq-in-f3.1e100.net

www.google.co.il 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 157.240.234.35 (Sofia, Bulgaria)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: edge-star-mini-shv-02-sof1.facebook.com

www.facebook.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 20.231.53.73 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

q.clarity.ms 3yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 172.217.16.166 (United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f6.1e100.net

ad.doubleclick.net 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 142.251.141.102 (United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-ai-in-f6.1e100.net

5427711.fls.doubleclick.net 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
9572106.fls.doubleclick.net 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 34.228.93.103 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-228-93-103.compute-1.amazonaws.com

lb.prod.equally.ai 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 172.217.16.162 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f2.1e100.net

adservice.google.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.71.131.137 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
match.adsrvr.org 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
39	trendmicro.com www.trendmicro.com 13yr old	5 MB
20	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1415 56yr old	97 KB
18	6sc.co 4 redirects j.6sc.co — Cisco Umbrella Rank: 10259 9yr old c.6sc.co — Cisco Umbrella Rank: 17168 9yr old ipv6.6sc.co — Cisco Umbrella Rank: 10349 4yr old b.6sc.co — Cisco Umbrella Rank: 6060 11yr old	23 KB
11	doubleclick.net 5 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 63 56yr old ad.doubleclick.net — Cisco Umbrella Rank: 208 9yr old 5427711.fls.doubleclick.net 8yr old 9572106.fls.doubleclick.net 5yr old	8 KB
11	scene7.com trendmicro.scene7.com 4yr old	278 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 498 9yr old	227 KB
7	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 4 56yr old adservice.google.com — Cisco Umbrella Rank: 692 9yr old	278 B
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 621 8yr old scripts.clarity.ms — Cisco Umbrella Rank: 962 9mo old q.clarity.ms — Cisco Umbrella Rank: 7433 3yr old c.clarity.ms — Cisco Umbrella Rank: 1398 5yr old	29 KB
7	equally.ai widget.equally.ai — Cisco Umbrella Rank: 282778 5yr old lb.prod.equally.ai — Cisco Umbrella Rank: 90221 1yr old	102 KB
7	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96 56yr old	23 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 71 56yr old	1 MB
6	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 480 9yr old www.linkedin.com — Cisco Umbrella Rank: 769 56yr old	3 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 143 56yr old	423 B
4	adsrvr.org 1 redirects js.adsrvr.org — Cisco Umbrella Rank: 1537 9yr old insight.adsrvr.org — Cisco Umbrella Rank: 1255 9yr old match.adsrvr.org — Cisco Umbrella Rank: 555 9yr old	13 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 423 56yr old c.bing.com — Cisco Umbrella Rank: 300 13yr old	17 KB
4	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 5418 13yr old	31 KB
3	google.co.il www.google.co.il — Cisco Umbrella Rank: 17992 9yr old	671 B
3	youtube.com www.youtube.com — Cisco Umbrella Rank: 89 56yr old	15 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 13958 8yr old	652 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 1408 9yr old	2 KB
2	t.co t.co — Cisco Umbrella Rank: 1251 13yr old	1 KB
2	trkn.us 1 redirects trkn.us — Cisco Umbrella Rank: 2854 11yr old	1 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 137 56yr old	25 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 5987 9yr old	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 290 56yr old	133 KB
2	gstatic.com fonts.gstatic.com 9yr old	96 KB
2	bc0a.com cdn.bc0a.com — Cisco Umbrella Rank: 13494 8yr old ixfd2-api.bc0a.com — Cisco Umbrella Rank: 14801 4yr old	26 KB
2	cludo.com customer.cludo.com — Cisco Umbrella Rank: 30032 9yr old	83 KB
1	mktoresp.com 605-sfw-393.mktoresp.com 1yr old	318 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 805 9yr old ib.adnxs.com Failed — Cisco Umbrella Rank: 418 9yr old	577 B
1	tealiumiq.com collect.tealiumiq.com — Cisco Umbrella Rank: 3722 9yr old	786 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1270 9yr old	19 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1485 10yr old	13 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 835 8yr old	321 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81 56yr old	2 KB
0	ml-attr.com Failed s.ml-attr.com Failed 10yr old
186	36

	Domain	Requested by
39	www.trendmicro.com	www.trendmicro.com
20	tags.tiqcdn.com	www.trendmicro.com tags.tiqcdn.com
11	trendmicro.scene7.com	www.trendmicro.com
9	b.6sc.co	www.trendmicro.com
8	cdn.cookielaw.org	www.trendmicro.com cdn.cookielaw.org
7	www.google-analytics.com	tags.tiqcdn.com www.google-analytics.com www.googletagmanager.com
7	www.googletagmanager.com	tags.tiqcdn.com www.googletagmanager.com www.google-analytics.com
6	c.6sc.co	4 redirects www.trendmicro.com
5	www.google.com	1 redirects www.googletagmanager.com www.trendmicro.com
5	px.ads.linkedin.com	2 redirects snap.licdn.com www.trendmicro.com
4	lb.prod.equally.ai	widget.equally.ai
4	ad.doubleclick.net	2 redirects www.trendmicro.com
4	www.facebook.com	www.trendmicro.com
4	static.addtoany.com	tags.tiqcdn.com static.addtoany.com
3	q.clarity.ms	scripts.clarity.ms
3	www.google.co.il	www.trendmicro.com
3	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.trendmicro.com
3	widget.equally.ai	tags.tiqcdn.com widget.equally.ai
3	www.youtube.com	www.trendmicro.com www.youtube.com cdn.cookielaw.org
2	c.clarity.ms	1 redirects
2	adservice.google.com	5427711.fls.doubleclick.net 9572106.fls.doubleclick.net
2	9572106.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	5427711.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	epsilon.6sense.com	j.6sc.co
2	js.adsrvr.org	www.googletagmanager.com match.adsrvr.org
2	ipv6.6sc.co	j.6sc.co
2	analytics.twitter.com	www.trendmicro.com
2	t.co	www.trendmicro.com
2	trkn.us	1 redirects www.trendmicro.com
2	www.googleadservices.com	tags.tiqcdn.com www.googleadservices.com
2	munchkin.marketo.net	tags.tiqcdn.com munchkin.marketo.net
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	fonts.gstatic.com	fonts.googleapis.com
2	customer.cludo.com	www.trendmicro.com
1	match.adsrvr.org	js.adsrvr.org match.adsrvr.org
1	insight.adsrvr.org	1 redirects js.adsrvr.org
1	c.bing.com	1 redirects
1	scripts.clarity.ms	www.clarity.ms
1	605-sfw-393.mktoresp.com	munchkin.marketo.net
1	secure.adnxs.com	j.6sc.co
1	www.linkedin.com	1 redirects
1	collect.tealiumiq.com	tags.tiqcdn.com
1	www.clarity.ms	tags.tiqcdn.com
1	j.6sc.co	tags.tiqcdn.com
1	snap.licdn.com	tags.tiqcdn.com
1	static.ads-twitter.com	tags.tiqcdn.com
1	ixfd2-api.bc0a.com	cdn.bc0a.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdn.bc0a.com	tags.tiqcdn.com
1	fonts.googleapis.com	www.trendmicro.com
0	ib.adnxs.com Failed	match.adsrvr.org
0	s.ml-attr.com Failed	www.trendmicro.com
186	53

This site contains links to these domains. Also see Links.

Domain
vicone.com
partner.trendmicro.com
newsroom.trendmicro.com
resources.trendmicro.com
trendmicro.zoom.us
success.trendmicro.com
helpcenter.trendmicro.com
signin.v1.trendmicro.com
cloudone.trendmicro.com
tm.login.trendmicro.com
signup.cj.com
www.addtoany.com
www.huntress.com
www.levelblue.com
alertoverload.com
www.virustotal.com
portal.xdr.trendmicro.com
www.linkedin.com
www.facebook.com
x.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
www.trendmicro.com Sectigo Public Server Authentication CA OV R36	`2025-10-23` - `2026-11-23`	1yr	crt.sh
cookielaw.org WE1	`2026-01-26` - `2026-04-26`	3mo	crt.sh
upload.video.google.com WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
cludo.com Amazon RSA 2048 M04	`2025-06-02` - `2026-07-01`	1yr	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M01	`2026-03-09` - `2026-09-22`	7mo	crt.sh
*.scene7.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2025-09-19` - `2026-09-19`	1yr	crt.sh
*.google.com WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
cdn.bc0a.com WR3	`2026-01-24` - `2026-04-24`	3mo	crt.sh
geolocation.onetrust.com WE1	`2026-01-26` - `2026-04-26`	3mo	crt.sh
ixfd-api.bc0a.com WR3	`2026-03-04` - `2026-06-02`	3mo	crt.sh
*.gstatic.com WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
*.google-analytics.com WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
ads-twitter.com R12	`2026-01-31` - `2026-05-01`	3mo	crt.sh
*.licdn.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-14` - `2026-10-13`	1yr	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-12-23` - `2026-03-23`	3mo	crt.sh
*.marketo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-22` - `2026-10-21`	1yr	crt.sh
6sc.co R12	`2026-01-10` - `2026-04-10`	3mo	crt.sh
equally.ai Amazon RSA 2048 M01	`2026-02-03` - `2027-03-03`	1yr	crt.sh
*.googleadservices.com WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
static.addtoany.com WE1	`2026-02-19` - `2026-05-20`	3mo	crt.sh
a.tag.clarity.ms Microsoft TLS G2 RSA CA OCSP 10	`2026-03-04` - `2026-08-31`	6mo	crt.sh
*.tealiumiq.com Amazon RSA 2048 M04	`2025-05-26` - `2026-06-23`	1yr	crt.sh
t.co E8	`2026-03-13` - `2026-06-11`	3mo	crt.sh
twitter.com E7	`2026-02-01` - `2026-05-02`	3mo	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2026-02-11` - `2026-08-11`	6mo	crt.sh
*.adnxs.com GeoTrust TLS ECC CA G1	`2025-09-25` - `2026-10-26`	1yr	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-07-22` - `2026-08-22`	1yr	crt.sh
www.bing.com Microsoft TLS G2 RSA CA OCSP 04	`2026-02-02` - `2026-08-01`	6mo	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2026-03-04` - `2027-04-02`	1yr	crt.sh
epsilon.6sense.com Amazon RSA 2048 M04	`2025-09-02` - `2026-10-01`	1yr	crt.sh
scripts.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2025-07-29` - `2026-04-14`	9mo	crt.sh
a.clarity.ms Microsoft TLS G2 RSA CA OCSP 10	`2026-03-04` - `2026-08-31`	6mo	crt.sh
*.doubleclick.net WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
*.g.doubleclick.net WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh
*.prod.equally.ai Sectigo Public Server Authentication CA DV R36	`2025-12-19` - `2027-01-19`	1yr	crt.sh
*.google.co.il WE2	`2026-02-02` - `2026-04-27`	3mo	crt.sh

This page contains 8 frames:

Primary Page: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Frame ID: 18EC12A4643906FE46141EF13731A4C5
Requests: 172 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 91C92AC7BB78667603063771BE2B4597
Requests: 1 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Frame ID: F053FE39403FB9A83249E656B2DE6D1A
Requests: 2 HTTP requests in this frame

Frame: https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Frame ID: 84E0580D47904A50ED7D43F289A54712
Requests: 2 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1
Frame ID: E282A2EF3947F9C544596A2DC85112F1
Requests: 2 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&google_gid=CAESEAi-QQdKPenyBkOdlGXPjqc&google_cver=1
Frame ID: F4A64B84EDDEF73F2D62A09883ABBBA4
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Frame ID: 76BF7015E3258B62C573AF2DF5EA7AC2
Requests: 1 HTTP requests in this frame

Frame: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D52a00601-e4c2-4c88-b3fd-0a5ebc62d888
Frame ID: B628D9D25B62FC5AD80CB8030E3137BB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites | Trend Micro

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

Cludo (Search engines) Expand

Overall confidence: 100%
Detected patterns

customer\.cludo\.com/

YouTube (Video players) Expand

Overall confidence: 100%
Detected patterns

\.youtube\.com/

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

AppNexus (Advertising) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Floodlight (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.doubleclick\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js
googletagmanager\.com/gtag/js

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
\.googletagmanager\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Tealium (Tag managers) Expand

Overall confidence: 100%
Detected patterns

^(?:https?:)?//tags\.tiqcdn\.com/

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery

6sense (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

\.6sc\.co/

Cloudflare Bot Management (Security) Expand

Overall confidence: 100%
Detected patterns

Facebook Pixel (Analytics) Expand

Overall confidence: 100%
Detected patterns

connect\.facebook\.\w+/.+/fbevents\.js
connect\.facebook.\w+/signals/config/\d+\?v=([\d\.]+)

Google Ads Conversion Tracking (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.googleadservices\.com/pagead/conversion_async\.js

Microsoft Advertising (Advertising) Expand

Overall confidence: 100%
Detected patterns

bat\.bing\.com/bat\.js
\w+

Tealium AudienceStream (Segmentation) Expand

Overall confidence: 100%
Detected patterns

\.tealiumiq\.com

Twitter Ads (Advertising) Expand

Overall confidence: 100%
Detected patterns

static\.ads-twitter\.com/uwt\.js

Twitter Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

analytics\.twitter\.com

theTradeDesk (Advertising) Expand

Overall confidence: 100%
Detected patterns

\.adsrvr\.org/

PyScript (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

186
Requests

92 %
HTTPS

0 %
IPv6

36
Domains

53
Subdomains

44
IPs

5
Countries

6953 kB
Transfer

13272 kB
Size

59
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: https://vicone.com/en
Title: Automotiveopen on a new tab

Search URL Search Domain Scan URL

URL: https://partner.trendmicro.com/
Title: Partner Portal Loginopen on a new tab

Search URL Search Domain Scan URL

URL: https://partner.trendmicro.com/pr-register-home/
Title: Become a Partneropen on a new tab

Search URL Search Domain Scan URL

URL: https://partner.trendmicro.com/partner-locator-home/
Title: Find Partnersopen on a new tab

Search URL Search Domain Scan URL

URL: https://newsroom.trendmicro.com/
Title: Connect With Usopen on a new tab

Search URL Search Domain Scan URL

URL: https://resources.trendmicro.com/GLB-Under-Attack-Form.html
Title: Under Attack?

Search URL Search Domain Scan URL

URL: https://trendmicro.zoom.us/webinar/register/6917533633873/WN_aVeYZcQPTNyUFAJDibiD3A#/
Title: Demo: Stopping Exploits Before the CVE Even Exists open on a new tab

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/en-US/
Title: Business Solutions open on a new tab

Search URL Search Domain Scan URL

URL: https://helpcenter.trendmicro.com/en-us/
Title: Consumer Solutions open on a new tab

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/en-US/contactus/
Title: Contact Support open on a new tab

Search URL Search Domain Scan URL

URL: https://signin.v1.trendmicro.com/
Title: Trend Vision One open on a new tab

Search URL Search Domain Scan URL

URL: https://cloudone.trendmicro.com/
Title: Cloud One open on a new tab

Search URL Search Domain Scan URL

URL: https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php
Title: Product Activation and Management open on a new tab

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t
Title: Referral Affiliate open on a new tab

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&title=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro

Search URL Search Domain Scan URL

URL: https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke
Title: researchers

Search URL Search Domain Scan URL

URL: https://www.levelblue.com/blogs/spiderlabs-blog/yet-another-nodejs-backdoor-yanb-a-modern-challenge
Title: report

Search URL Search Domain Scan URL

URL: https://alertoverload.com/posts/2026/01/kongtuke---clickfix-on-steroids/
Title: January 2026 finding

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/search/content%253A%2522script%2520data-cfasync%253D'false'%2520async%2520src%2522%2520fs%253A2026-02-24-?type=files
Title: Recent VirusTotal submissions

Search URL Search Domain Scan URL

URL: https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence_insights?name=KongTuke's%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites
Title: KongTuke's ClickFix Abuse of Compromised WordPress Sites

Search URL Search Domain Scan URL

URL: https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence?intrusionSet=KongTuke's%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites
Title: KongTuke's ClickFix Abuse of Compromised WordPress Sites

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trendai-security
Title: open on a new tab

Search URL Search Domain Scan URL

URL: https://www.facebook.com/trendaisecurity/
Title: open on a new tab

Search URL Search Domain Scan URL

URL: https://x.com/trendaisecurity
Title: open on a new tab

Search URL Search Domain Scan URL

URL: https://www.instagram.com/trendaisecurity/
Title: open on a new tab

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@trendaisecurity
Title: open on a new tab

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAnyopen on a new tab

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://trkn.us/pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072 HTTP 302
https://trkn.us/pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072;ip=31.187.78.112;cuidchk=1

Request Chain 107

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1773593838059%26li_adsId%3D71496df1-4ed2-4a19-8219-929873a728a9%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen%252Fresearch%252F26%252Fc%252Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&cookiesTest=true&liSync=true

Request Chain 115

https://c.6sc.co/ HTTP 302
https://c.6sc.co/refresh HTTP 302
https://c.6sc.co/?m=1

Request Chain 117

https://c.6sc.co/ HTTP 302
https://c.6sc.co/refresh HTTP 302
https://c.6sc.co/?m=1

Request Chain 133

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&cerd=CgSH3b0t&fsk=ChAI8LHZzQYQgp7vmeO2zdUoEiwAphwSfGnQpzltUkwHGAn2aYAZz6y1VxUaa7QNU6mM7h0Xm5e6uTtixgrDPxoCrqg&pscrd=IhMI8LrG9a-ikwMVE0IdCR2FOwvAMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS96DAgJYggIABAAGAAgAA HTTP 302
https://www.google.com/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&cerd=CgSH3b0t&fsk=ChAI8LHZzQYQgp7vmeO2zdUoEiwAphwSfGnQpzltUkwHGAn2aYAZz6y1VxUaa7QNU6mM7h0Xm5e6uTtixgrDPxoCrqg&pscrd=IhMI8LrG9a-ikwMVE0IdCR2FOwvAMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS96DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSsQEA56J1eZ0DDA-mWSkzJ70cgPoBahTOzgGd0pRnK5pF0UlHywgkYBnr50-FHuXcIOzMYopQle6XxbY0sPukvwaRXViMKEq_QcTaAPKzrNnwXRuCfkqfmZUmnrvf_N3Vo7eVF8NFIQVAIN8Z_ym4AxA9dAOD2we7ayAgXiJPUM5Hp56Ni5Ukj1smGzQxfJtPLVcdshE6uNFSETWMZzKB25FBoT51d-69Y_RK4tMAgnTD7rk&random=219767792&resp=GooglemKTybQhCsO HTTP 302
https://www.google.co.il/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&cerd=CgSH3b0t&fsk=ChAI8LHZzQYQgp7vmeO2zdUoEiwAphwSfGnQpzltUkwHGAn2aYAZz6y1VxUaa7QNU6mM7h0Xm5e6uTtixgrDPxoCrqg&is_vtc=1&cid=CAQSsQEA56J1eZ0DDA-mWSkzJ70cgPoBahTOzgGd0pRnK5pF0UlHywgkYBnr50-FHuXcIOzMYopQle6XxbY0sPukvwaRXViMKEq_QcTaAPKzrNnwXRuCfkqfmZUmnrvf_N3Vo7eVF8NFIQVAIN8Z_ym4AxA9dAOD2we7ayAgXiJPUM5Hp56Ni5Ukj1smGzQxfJtPLVcdshE6uNFSETWMZzKB25FBoT51d-69Y_RK4tMAgnTD7rk&random=219767792&resp=GooglemKTybQhCsO&ipr=y&pscrd=IhMI8LrG9a-ikwMVE0IdCR2FOwvAMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS96DAgJYggIABAAGAAgAIIBAnAB

Request Chain 148

https://ad.doubleclick.net/activity;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CO7MrvavopMDFQkiogMdXDI7Dg;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Request Chain 149

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Request Chain 153

https://ad.doubleclick.net/activity;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CLTSrvavopMDFXQZogMdee8cYg;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Request Chain 154

https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Request Chain 174

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&RedC=c.clarity.ms&MXFR=1B58384DF8D7660736532F50FCD768B5 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&MUID=0B680FBF75AF6E030EC218A274D26F3B

Request Chain 176

https://insight.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html HTTP 302
https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1

Request Chain 179

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NTJhMDA2MDEtZTRjMi00Yzg4LWIzZmQtMGE1ZWJjNjJkODg4&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888 HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&google_gid=CAESEAi-QQdKPenyBkOdlGXPjqc&google_cver=1

Request Chain 180

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

Request Chain 181

https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D52a00601-e4c2-4c88-b3fd-0a5ebc62d888

186 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html Show response
www.trendmicro.com/en/research/26/c/ 172 KB
27 KB 864ms
504ms Document
text/html 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

06fa22e6381b5f48caf52270f6e47d08a6a752c8c466504be817071fa8910f33

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com https://resources.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-length: 27046
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com https://resources.trendmicro.com
content-type: text/html;charset=utf-8
date: Sun, 15 Mar 2026 16:57:15 GMT
etag: "2aec3-64cdc73bddc67-gzip"
last-modified: Thu, 12 Mar 2026 23:52:58 GMT
server: nginx
vary: Accept-Encoding
x-content-type-options: nosniff
x-country-code: IL
x-frame-options: SAMEORIGIN
x-prod-n-01: Yes
x-xss-protection: 1;mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 457 KB
59 KB 309ms
125ms Script
application/javascript 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

73be518187f34046c101627800ac5a8f21820e7735f3fcfe60e4b0ce6e35d357

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: CUNuPfTMF88Ceqr41H7P0w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding, X-OneTrust-IsBot
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DE26F20A56004F
age: 50717
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Mon, 16 Mar 2026 16:57:16 GMT
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript
last-modified: Tue, 18 Nov 2025 22:30:13 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-onetrust-isbot: false
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 63c14bab-301e-002d-17db-58104a000000
cf-ray: 9dcd0e6358907da1-TLV
accept-ranges: bytes
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 26 KB
9 KB 286ms
103ms Script
application/javascript 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

15a5a919d4b2c63b74bac3c0752f7faa08675d5ecaab478032a0232013a2ba6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: obJk4xP/fYkFcpWKSqgpJw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DE77857ACD4C9B
x-ms-lease-status: unlocked
age: 38033
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript
last-modified: Sun, 01 Mar 2026 11:27:10 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 92052e0b-101e-009b-2c0d-aa1eb2000000
cf-ray: 9dcd0e63588a7da1-TLV
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8694
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 jquery.min.f65891607efbe75b84a8031849cec6c7.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 111 KB
37 KB 282ms
281ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.f65891607efbe75b84a8031849cec6c7.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 37487
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Fri, 26 Jan 2024 19:25:44 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 utils.min.899004cc02c33efc1f6694b1aee587fd.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 8 KB
3 KB 326ms
325ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.899004cc02c33efc1f6694b1aee587fd.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

377e9731df07066631dc615291a3dbdbc923893629702f2e3b9b7a5775cc027b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
content-length: 3339
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Sat, 01 Feb 2025 16:27:56 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 css
fonts.googleapis.com/ 28 KB
2 KB 450ms
157ms Stylesheet
text/css 142.251.208.170
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

142.251.208.170 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraa-bl-in-f10.1e100.net

Software

ESF /

Resource Hash

b2112e201afda27eaa87eefa81cec837cbc2757b32ecae5e3b35efb6b8517981

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sun, 15 Mar 2026 16:57:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 cludo-search.min.css
customer.cludo.com/css/296/1798/ 16 KB
3 KB 455ms
148ms Stylesheet
text/css 108.138.7.97
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.97 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-7-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-amz-cf-pop: FRA56-P6
content-encoding: gzip
x-amz-version-id: 6o2QMfbcY3fhs8F4if.PiKsSNQSLmE.O
etag: W/"c03ac60defadb2e59ca2bdf4227eb7d2"
age: 7084
via: 1.1 e016ea20838aeed1d878a5244c9e2552.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: -CK32JR7oDhhsKMA0hvn-6mMaYz077aEPbWymosFbzsikXZgJXp8Pw==
date: Sun, 15 Mar 2026 15:00:42 GMT
content-type: text/css
vary: accept-encoding, Origin
server: AmazonS3
last-modified: Thu, 18 Sep 2025 12:03:41 GMT

GET
H2 200 header-footer.min.cc255fd374a145c2653503eb2da45983.css
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 74 KB
8 KB 159ms
158ms Stylesheet
text/css 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.cc255fd374a145c2653503eb2da45983.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-58-108-159.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 4f92e8a70f4aec9b8bf224c48f0e105584fa1cba6e076ea5cae712f262a61aad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

cache-control: public, max-age=289697
content-encoding: br
expires: Thu, 19 Mar 2026 01:25:32 GMT
content-length: 7980
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: text/css;charset=utf-8
last-modified: Thu, 05 Mar 2026 17:58:19 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 361 KB
46 KB 169ms
168ms Stylesheet
text/css 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

60b17a76e4ecaeae677bb2ea4f0bc9f0286563dd7f60a11c831fa6530b726e80

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 46507
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: text/css;charset=utf-8
last-modified: Wed, 24 Sep 2025 17:00:03 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
1 KB 438ms
140ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c1afa7aee2a145fe0d29f740e96eadd66eeddbcd1c52990e018f25aa5e4c027f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"aa40f8c9afdbdd9f670d5bb43a53ca84"
x-amz-version-id: uZG5MzpV52NsK72jB2Mu6R51xmnfFqIU
age: 129
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: qgU4LnxxCsGuPTu_PzrYjllGyygjZjT0UvCTSfsbYNgBK1_mjpqhIQ==
date: Sun, 15 Mar 2026 16:57:10 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:47 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 tm-logo-red-white-t.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/ 5 KB
2 KB 329ms
329ms Image
image/svg+xml 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

content-encoding: br
etag: "154e-5f3af05760400"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:17 GMT
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/svg+xml
vary: Accept-Encoding
content-disposition: attachment; filename="tm-logo-red-white-t.svg"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
last-modified: Thu, 02 Feb 2023 03:18:40 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 2049
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 trend-vision-one-laptop-console-nav
trendmicro.scene7.com/is/image/trendmicro/ 28 KB
29 KB 457ms
147ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/trend-vision-one-laptop-console-nav?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

c736034b3d0913081caf7f378d4726f2277a6fe0c1e6400e8416a474570de369

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66d87cea6414eae528cd1a22a2e7af44"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 19:25:50 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=2, origin; dur=0, cdntime; dur=2
content-length: 28972
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c51ee
last-modified: Wed, 16 Jul 2025 22:06:54 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 asrm-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 14 KB
15 KB 234ms
234ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1ac209128f661abb8a982d1bdb20d08e"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Mon, 16 Mar 2026 00:10:42 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=9, origin; dur=0, cdntime; dur=9
content-length: 14534
akamai-cache-status: Miss from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c52d2
last-modified: Wed, 04 Jan 2023 02:43:26 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 18 KB
18 KB 167ms
167ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "b3ffdce154f5ac33f90bafd0b8f52ddf"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Mon, 16 Mar 2026 00:25:09 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=19, origin; dur=0, cdntime; dur=19
content-length: 18350
akamai-cache-status: Miss from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c5cdd
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 cloud-one-workload-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 20 KB
21 KB 256ms
253ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "fd80448de919134c924f18226b59ecd2"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 18:25:00 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=3, origin; dur=0, cdntime; dur=3
content-length: 20734
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b00
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 cloud-one-container-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 22 KB
23 KB 292ms
289ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "0bd7f96f29e779fac6dc954866b8de36"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 19:25:51 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=4, origin; dur=0, cdntime; dur=4
content-length: 22816
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b01
last-modified: Wed, 04 Jan 2023 02:43:25 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 cloud-one-file-storage-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 10 KB
11 KB 152ms
149ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "81b7f638d5ac80cfde194124da99cc5e"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 21:05:28 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=1, origin; dur=0, cdntime; dur=1
content-length: 10478
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b02
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 cloud-risk-management-laptop-console-nav
trendmicro.scene7.com/is/image/trendmicro/ 11 KB
11 KB 166ms
163ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-risk-management-laptop-console-nav?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

49357cbf20c9a6d5f2698223de9baad85fff24c2dff4110920d3c8211d338209

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "c4edfdc8b841f09cf5cfbd796a4e4c3f"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 17:21:56 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=1, origin; dur=0, cdntime; dur=1
content-length: 11376
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b03
last-modified: Tue, 12 Aug 2025 18:01:30 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 zero-trust-access-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 24 KB
24 KB 181ms
178ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "54553bd846274282dee4b07c8fd3198b"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 17:43:25 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=1, origin; dur=0, cdntime; dur=1
content-length: 24410
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b04
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 email-and-collaboration-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 28 KB
28 KB 216ms
213ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/email-and-collaboration-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

4a00442af7139fa4ae1af61fc6233a678bb4a37e286114a0b6978cebcc618857

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "4fc7d80d12fba6e8bc73854d3959f201"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 19:04:45 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=1, origin; dur=0, cdntime; dur=1
content-length: 28412
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b06
last-modified: Wed, 21 May 2025 00:22:05 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 data-security-laptop-console-nav
trendmicro.scene7.com/is/image/trendmicro/ 35 KB
35 KB 311ms
309ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/data-security-laptop-console-nav?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

d997398b880ed2083b4a572dad9c5d5065f365b11dfbc5ffe713a27848b5aeae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "134f160ec1c5b685c486b3c1a0d98512"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Mon, 16 Mar 2026 00:39:14 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=5, origin; dur=0, cdntime; dur=5
content-length: 35504
akamai-cache-status: Miss from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b07
last-modified: Mon, 27 Oct 2025 22:01:36 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 all-products-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 64 KB
64 KB 340ms
337ms Image
image/webp 2.16.10.185
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.10.185 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-16-10-185.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "891ae1c6af5064a7f40d8b2f96a4ea68"
x-adobe-smart-imaging: 0
akamai-request-bc: on
expires: Sun, 15 Mar 2026 17:15:04 GMT
access-control-allow-origin: *
server-timing: clientrtt; dur=54, clienttt; dur=4, origin; dur=0, cdntime; dur=4
content-length: 65306
akamai-cache-status: Hit from child
date: Sun, 15 Mar 2026 16:57:16 GMT
akamai-grn: 0.241c1202.1773593836.8a1c6b08
last-modified: Mon, 27 Mar 2023 00:57:09 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: 1

GET
H2 200 search-script.js Show response
customer.cludo.com/scripts/bundles/ 443 KB
80 KB 181ms
180ms Script
text/javascript 108.138.7.97
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://customer.cludo.com/scripts/bundles/search-script.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.97 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-108-138-7-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 80df2c3d694aba09adc50f732985286bd1c8f123b9d00784562634713bb6ad81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-amz-cf-pop: FRA56-P6
content-encoding: gzip
x-amz-version-id: AF.DvIP1aI3PDVTFhKhZ0.vb8YJQKY33
etag: W/"0087bb36911641a5bc81d372c524b428"
age: 7081
via: 1.1 e016ea20838aeed1d878a5244c9e2552.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: uguYftRpbz5Q501pEb7IHYr6FE4U2fSl2xUvQSVvF_ywZoVRC86uCQ==
date: Sun, 15 Mar 2026 14:59:41 GMT
content-type: text/javascript
vary: accept-encoding, Origin
server: AmazonS3
last-modified: Mon, 09 Mar 2026 09:29:42 GMT

GET
H2 200 share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 648 B
580 B 274ms
272ms Image
image/svg+xml 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=22092
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Sun, 15 Mar 2026 23:05:28 GMT
content-length: 320
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 409 B
512 B 275ms
272ms Image
image/svg+xml 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=18915
content-encoding: br
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 22:12:31 GMT
x-prod-n-02: Yes
content-length: 251
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 clickfix-abuse_infection-chain.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 601 KB
602 KB 422ms
420ms Image
image/jpeg 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/clickfix-abuse_infection-chain.jpg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d3e6686ab60595ac578adfcc04997be05b32eac05fe84014e481c277ce45a03b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "965e2-64ca335aa5700"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 615906
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/jpeg
last-modified: Tue, 10 Mar 2026 03:35:24 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig2.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 105 KB
106 KB 485ms
482ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig2.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

965853675c963a1f34736e7e21618b5061048b3847285860d617192f4c9503b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "1a519-64c93e3bd4740"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 107801
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:45 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig3a.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 141 KB
141 KB 507ms
505ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig3a.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9113cb28745593b1c3da7fec66d0d2bc32ae6d66fc18506dfa0c016820da1236

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "23346-64c93e3cc8980"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 144198
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:46 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig3b.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 370 KB
370 KB 519ms
517ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig3b.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4298828b97519fd3104c2dabf36f59b1c0504271c0a65236e3e0dcbc199d2e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "5c713-64c93e3dbcbc0"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 378643
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:47 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig4a.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 442 KB
442 KB 539ms
537ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig4a.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f46c590a26ea618d9f25778788270eeab0abed9a4d70d6eda4a2535ec5bce4d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "6e770-64c93e3fa5040"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Sun, 15 Mar 2026 16:57:18 GMT
accept-ranges: bytes
content-length: 452464
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:49 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig4b.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 361 KB
362 KB 598ms
596ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig4b.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5c013490dff7318684acced8fff972b6e78aa43f65cfc3477f6365de220caaec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "5a4a3-64c93e4099280"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 369827
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:50 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig5.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 13 KB
13 KB 584ms
582ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig5.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b47372de689d5963e6ed2f26fa295627d0b1edcc53cfee1a18cce97d763c3a66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "3318-64c93e4099280"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 13080
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:50 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig6.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 92 KB
92 KB 608ms
606ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig6.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1fa63b400e5f9248aba4bad81d9b545d5dcfaf7ea984020b3220cd7e53db3433

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "16f6c-64c93e418d4c0"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 94060
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:51 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig7.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 370 KB
371 KB 616ms
614ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig7.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ea48a7b249c0cd142685adab2847aee7ce58c1974f2b94566015ed0d3dfa5529

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "5c9a8-64c93e361b9c0"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 379304
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:39 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig8.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 18 KB
19 KB 585ms
583ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig8.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

336a2dcb2ad0b0191bdc6877281bc3e93bce86391d4608e988ebb3feea358b5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "490b-64c93e370fc00"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 18699
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig9.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 133 KB
133 KB 586ms
584ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig9.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

759f3e412507cbbd0bcc2f880eebffa3ed2ed966ef729d75afd6a69f17d23809

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "21360-64c93e370fc00"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 136032
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig10.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 34 KB
34 KB 592ms
590ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig10.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

55b10f37fc79af40c1d4e753868ffd8a3bdeec732a9e8ba4a78d982e39b14b88

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "8612-64c93e370fc00"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 34322
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig11.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 537 KB
538 KB 594ms
593ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig11.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7ccf8af33b6da01a82a6e95fe781ae615fc59cb8dedf7ea29256cb5c6bdefd6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "863da-64c93e38f8080"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 549850
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:42 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig12.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 161 KB
162 KB 577ms
575ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig12.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

51d16bae003e26c3b7c27cf551cf2689d64ea525155882d8922460b16062a307

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2845d-64c93e39ec2c0"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 164957
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:43 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig13.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 133 KB
133 KB 632ms
630ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig13.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1f20db7a790a5be3a7a65910e6bfe0afcdbb73a9b55d1a0f16c20f310c2ac5da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "21282-64c93e39ec2c0"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 135810
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:43 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig14.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 88 KB
89 KB 572ms
571ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig14.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f894ac9782073ab2d88baf10eaad124918f8737d0922a68fd8b87d38d696172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "161f4-64c93e3ae0500"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 90612
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:44 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Fig15.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/ 147 KB
148 KB 647ms
646ms Image
image/png 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/c/clickfix/Fig15.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

354016c0025a878d5a0b913bf57e62746e201579d2e471249f99f307afa6e013

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "24df8-64c93e3ae0500"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 151032
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/png
last-modified: Mon, 09 Mar 2026 09:18:44 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 sly.min.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 18 KB
7 KB 148ms
148ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=50839
content-encoding: br
etag: "48de-56a21837c9c00-gzip"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 16 Mar 2026 07:04:35 GMT
content-length: 6989
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript
last-modified: Wed, 18 Apr 2018 15:57:36 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 jwplayer.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 81 KB
25 KB 242ms
238ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=309889
content-encoding: br
etag: "1457a-56a21837c9c00-gzip"
x-content-type-options: nosniff
expires: Thu, 19 Mar 2026 07:02:05 GMT
x-prod-n-02: Yes
content-length: 25334
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript
last-modified: Wed, 18 Apr 2018 15:57:36 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
4 KB 510ms
180ms Script
text/javascript 142.251.127.190
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.127.190 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f190.1e100.net

Software

ESF /

Resource Hash

65c78c20026b7514d7299bcb229bf9d20047ebf76f87806ab58078972e6c3794

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://.youtube.com https://.google.com https://.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist, require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
origin-trial: ApTXX1w2dkJZuuxlV9csQYg+9ZVXekg+mOu8mS9vb7/V2oeMLKqGC8blgR6ech+eqbhGAgLKPthyai7z89MdTAgAAACLeyJvcmlnaW4iOiJodHRwczovL3d3dy55b3V0dWJlLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQb2xpY3lJbmNsdWRlSlNDYWxsU3RhY2tzSW5DcmFzaFJlcG9ydHMiLCJleHBpcnkiOjE3NDk1MTM2MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==, AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9, AiDEBptUfVeO93q48VdVMe/ubupazdAl8AaHP+NBzdnW8quUcHdzJUyGSfrmtpKJu7EOvwRp9ug2rEo3XU+WMAMAAAB2eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJEZXZpY2VCb3VuZFNlc3Npb25DcmVkZW50aWFsczIiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==
x-content-type-options: nosniff
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires: Sun, 15 Mar 2026 16:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=iw for more info."
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.youtube.com https://*.google.com https://*.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://*.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist, require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: report-uri https://csp.withgoogle.com/csp/youtube_main/strict;base-uri 'self';object-src 'none';script-src 'report-sample' 'nonce-AJkG7J0oPlbEhbnjCTeoew' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 header-footer.min.3a8bb3715b6ad0027e9f614f738e2a38.js Show response
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 53 KB
10 KB 157ms
153ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.3a8bb3715b6ad0027e9f614f738e2a38.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-58-108-159.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c7aece63b23620e8c0217a0a20eb35c70985d86f937f7ab75698292be4f9d577

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

cache-control: public, max-age=595667
content-encoding: br
expires: Sun, 22 Mar 2026 14:25:03 GMT
content-length: 9736
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 13 Nov 2025 17:54:45 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 clientlib-trendresearch.min.e86e6ef1cd6d0156930c56b6a30ba17f.js Show response
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 712 KB
164 KB 162ms
159ms Script
application/javascript 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.e86e6ef1cd6d0156930c56b6a30ba17f.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3d64634279c4fe237d6503f690bb6e0575e5d6c57aa5ecf4d24076fa043b4b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
content-length: 168097
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 15 Jan 2026 18:03:58 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 821060e3-3f9c-4a2f-8613-8e0db4841f79.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 6 KB
3 KB 290ms
114ms XHR
application/json 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/821060e3-3f9c-4a2f-8613-8e0db4841f79.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e52bf91e8e4c6d9c615e981d603e8286578849392e36763e1e9757a140d18950

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: wDpT/FNypN7+IRYyds897g==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding, X-OneTrust-IsBot
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DE26F1C39F4D64
age: 33525
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Mon, 16 Mar 2026 16:57:16 GMT
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/json
last-modified: Tue, 18 Nov 2025 22:28:14 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-onetrust-isbot: false
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 18ab8f32-601e-009f-254f-92eb30000000
cf-ray: 9dcd0e666f267da0-TLV
accept-ranges: bytes
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 autopilot_sdk.js Show response
cdn.bc0a.com/autopilot/f00000000017219/ 72 KB
25 KB 280ms
92ms Script
application/javascript 35.201.125.192
Google LLC

General

Check archive.org

Download Go to

Full URL

https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.125.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),

Reverse DNS

192.125.201.35.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

c87080ff86ce00a5f93164a37b45eaaf5f6cff5744704053d092217b9bb914a8

Security Headers

Name	Value
Content-Security-Policy	default-src self; script-src self; style-src self; frame-ancestors 'self' https://*.brightedge.com/;
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://www.trendmicro.com/

Response headers

access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=b6+Miw==, md5=TDkToSvqVBP//5MDi2LfWA==
etag: "4c3913a12bea5413ffff93038b62df58"
age: 26
x-goog-meta-sdk_canonical_host
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-meta-content_only: false
last-modified: Fri, 09 May 2025 00:29:29 GMT
content-type: application/javascript
x-guploader-uploadid: AGQBYWw2F8UOgT_7iX9kVBfyi9BZ0pSSSf5qZQW3gvMV2JtH8slHrC2e6V2gUotM98S5C2WoelhfDuI
x-goog-meta-app2_delay: 0
x-goog-meta-custom: true
x-goog-meta-marvel_config_consistency_custom: {"data-url":"dataservice.tmok.tm/tc.png,trendmicro.scene7.com,0,.66,1&qlt=80,1.0&amp","data-dropsrcset":"true","data-customerid":"f00000000017219","data-ignorepath":"uat-author.we.trendmicro.com,uat.we.trendmicro.com,prod-author.we.trendmicro.com,qa-author.we.trendmicro.com,qa.we.trendmicro.com"}
x-goog-meta-spa: false
cache-control: public, max-age=360
x-goog-meta-disable_debug_elements: false
x-goog-meta-app2_test_mode: false
x-goog-meta-app2_enabled: false
accept-ranges: bytes
x-goog-generation: 1746750569142613
content-length: 23526
x-goog-meta-sdk_api_endpoint
x-goog-meta-publishingdate: 2025-05-09 00:29:29
content-language: en
server: UploadServer
x-goog-meta-marvel_enabled: false
x-goog-metageneration: 3
x-goog-stored-content-encoding: gzip
x-goog-meta-sdk_request_parameters_case_sensitive: false
x-goog-meta-marvel_test_mode: false
x-goog-meta-app2_customer_id
expires: Sun, 15 Mar 2026 17:02:50 GMT
x-goog-stored-content-length: 23526
x-goog-meta-app2_whitelist_params
date: Sun, 15 Mar 2026 16:56:50 GMT
x-goog-meta-sdk_canonical_protocol
vary: Accept-Encoding
x-goog-meta-sdk_account_id: f00000000017219
strict-transport-security: max-age=63072000; includeSubDomains
x-goog-meta-app2_env: prod
x-goog-meta-sdk_log_level: 2
content-security-policy: default-src self; script-src self; style-src self; frame-ancestors 'self' https://*.brightedge.com/;
x-goog-meta-marvel_customer_id
x-goog-storage-class: MULTI_REGIONAL
x-goog-meta-sdk_version: 1.5.14
x-goog-meta-sdk_whitelist: ixf
x-goog-meta-app2_ignore_query_params: false
access-control-allow-origin: *
x-goog-meta-app2_debug_always: false

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 69 B
321 B 297ms
118ms XHR
application/json 104.18.32.137
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.32.137 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff10c1fe39489bf9f57c9dc9e8ccc064dfdfd4dec949636d5deeba2a8f2da2f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 9dcd0e684bc3c231-TLV
access-control-allow-origin: *
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 0504666130 Show response
ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/ 6 KB
1 KB 360ms
145ms XHR
application/json 34.111.194.12
Google LLC

General

Check archive.org

Download Go to

Full URL: https://ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/0504666130?client=js_sdk&client_version=1.5.14
Requested by: Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.194.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS: 12.194.111.34.bc.googleusercontent.com
Software: bws/1.0 /
Resource Hash: a877eb3c864362bfdc62e2f325b02bfbf263bfa2fe48cd3e4b5b02f0dedfa5ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: public, max-age=3600
content-encoding: br
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-be-pop: BRU-1-301
date: Sun, 15 Mar 2026 16:57:11 GMT
content-type: application/json
server: bws/1.0

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 165 KB
34 KB 175ms
174ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82dab6b89d8fa4547adf9da91df8cccfff6fc0e847df5d3e9a41276fa4a0d6b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"445a27287bd4d9860e3fd7ca647f88b8"
x-amz-version-id: vxqce.wB20ud.qCHAqj7oBVpwil7ykH2
age: 251
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: q3vD8l0kQ6RNIHNHfzTvCst5dF6jQj7as9NevMKXnddRP3kJ89gMHQ==
date: Sun, 15 Mar 2026 16:53:06 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:47 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 OpenSans.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/ 58 KB
58 KB 255ms
254ms Font
application/octet-stream 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/OpenSans.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

mpulse_cdn_cache: REVALIDATE
strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=83801
x-content-type-options: nosniff
mpulse_origin_time: 161
x-prod-n-02: Yes
content-length: 59444
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 material-symbols-outlined.woff2
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/ 225 KB
226 KB 295ms
294ms Font
application/octet-stream 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/material-symbols-outlined.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=78319
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 230732
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/octet-stream
last-modified: Thu, 07 Sep 2023 17:07:37 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/ 72 KB
72 KB 357ms
356ms Font
application/x-font-woff 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=10833
x-content-type-options: nosniff
x-prod-n-02: Yes
content-length: 73259
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v44/ 47 KB
47 KB 295ms
143ms Font
font/woff2 142.251.141.131
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.141.131 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aj-in-f3.1e100.net

Software

sffe /

Resource Hash

d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 370224
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 11 Mar 2027 10:06:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Mar 2026 10:06:52 GMT
last-modified: Mon, 15 Sep 2025 16:30:41 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48320
x-xss-protection: 0
server: sffe

GET
H2 200 dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/ 37 KB
38 KB 278ms
278ms Font
application/x-font-woff 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

mpulse_cdn_cache: HIT
strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=12662
x-content-type-options: nosniff
mpulse_origin_time: 0
x-prod-n-02: Yes
content-length: 38313
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Interstate-Bold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/ 50 KB
51 KB 288ms
287ms Font
application/octet-stream 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/Interstate-Bold.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

mpulse_cdn_cache: REVALIDATE
strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=8897
x-content-type-options: nosniff
mpulse_origin_time: 462
x-prod-n-02: Yes
content-length: 51664
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/ 24 KB
14 KB 299ms
299ms Font
application/x-font-ttf 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: public, max-age=12662
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 14490
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/x-font-ttf
last-modified: Thu, 09 Dec 2021 18:07:24 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v44/ 49 KB
49 KB 203ms
151ms Font
font/woff2 142.251.141.131
Google LLC

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v44/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.141.131 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aj-in-f3.1e100.net

Software

sffe /

Resource Hash

186836b74ceac07b2764c07c0379420e3014efb30fe918461c235e0ef6cbc4a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 248401
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 12 Mar 2027 19:57:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Mar 2026 19:57:15 GMT
last-modified: Mon, 15 Sep 2025 16:31:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50216
x-xss-protection: 0
server: sffe

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/ 426 KB
103 KB 123ms
122ms Script
application/javascript 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: futiIRaAGsEL76yunD0yWQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10E7176E8
x-ms-lease-status: unlocked
age: 32220
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sun, 15 Mar 2026 16:57:16 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 19:54:08 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 9b66de1d-401e-006d-2ff0-f239a4000000
cf-ray: 9dcd0e6908d17da1-TLV
accept-ranges: bytes
access-control-allow-origin: *
content-length: 105018
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 utag.189.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 12 KB
5 KB 141ms
140ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.189.js?utv=ut4.49.202509151951
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e924b29a40f25426e83d462612a6a5fa14ddee06f39d9e3d558a6592b618183e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"3ed220006f9586b923bc674c1057ebbe"
x-amz-version-id: tpUJLqDG0KtVK40HnpI.d59mXDN5kwpL
age: 251
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 0ovlUE59yvMitm-2nRssqjoEtXyiTxv1ZUgu9DNidpahHSkPbC3C4A==
date: Sun, 15 Mar 2026 16:53:07 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.69.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 140ms
140ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.49.202410041627
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0302d9000c5640cfd4f06353524bfcdcdfcb11cc0440ec34f16e4bb55b679f42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"a17d62de9b307ec380dd89df3801383a"
x-amz-version-id: ksl79qFAmPYrB3BlWrEU4bgXs4NZJ9AO
age: 251
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D762WHn17oYFgQaYyKCENUNLn8vZUNQDJofbjhSlT9KU8vv2JFXEug==
date: Sun, 15 Mar 2026 16:53:07 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.242.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 12 KB
5 KB 144ms
144ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.242.js?utv=ut4.49.202510211717
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c399395a6574ff803d6fe0052148f77e22c71bf998f49fc363bbc03167be08d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"4194056810595fc5423cb5ce21dade88"
x-amz-version-id: 5.jQeaCH3pwvgYmkrMscgrjK2wvbycsm
age: 251
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: TZZDKQyHQW9OKOqhoMV_oei4ROFs_Q9lFWxd6Jut-8_ExaSh3rsmpw==
date: Sun, 15 Mar 2026 16:53:07 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 dict.en.json Show response
www.trendmicro.com/libs/cq/i18n/ 14 KB
4 KB 311ms
311ms XHR
application/json 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/libs/cq/i18n/dict.en.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.899004cc02c33efc1f6694b1aee587fd.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: public, max-age=404
content-encoding: br
etag: "b91bea50244aae0b72b630e6c7e2791f"
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 3906
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/json;charset=utf-8
content-language: en
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 kongtuke-clickfix-abuse-of-compromised-wordpress-sites.disruptorV2.json Show response
www.trendmicro.com/en/research/26/c/ 78 B
548 B 382ms
382ms XHR
application/json 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.disruptorV2.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.e86e6ef1cd6d0156930c56b6a30ba17f.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2e4db45aa37bde0ca92814a85fb311ddf2f3e2ae69f58cf44d8733368e35680c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com https://resources.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com https://resources.trendmicro.com
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
content-length: 61
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 OpenSans-Light.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-Light/ 58 KB
58 KB 186ms
186ms Font
application/octet-stream 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-Light/OpenSans-Light.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

0e7f25b4a085d3c4ad8edac6fd7bcb8eb2ebabc9887c569fe61df284ade34549

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.47ce60d92d94610907e7a2cbd6fbca69.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=83193
x-content-type-options: nosniff
x-prod-n-02: Yes
content-length: 59272
x-xss-protection: 1;mode=block
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 utag.81.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 24 KB
6 KB 154ms
152ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.49.202305162129
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4603a811d2ab155474648f45b9a4dce4b28d07a6aacbf441f0c7e9e685fd6354

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"dec983d3aea5b24f0aeb38d4e6c79651"
x-amz-version-id: BUhbLan65AQiH5KlEyvP35WsWYmtcFl7
age: 127
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: aoogVuyIdqQQPSqaKt1zwMMdM6I2OTfnkDHMrr3ln855WcozU-Nigg==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:46 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.255.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 43 KB
12 KB 153ms
151ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.255.js?utv=ut4.49.202509151951
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bc7040cb84227015953614f1c7f1aed09be43c48baaad4774d4fe847c555a35e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"de8610d9d3bec36b10588c92eee57bcb"
x-amz-version-id: cmmpoEqdC_jSq1h_eRNch.dr2NMOM6Fq
age: 127
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Ahze5_XLOJ1UMqHSjOMD0Ai3oWzi-jywks0_RyS0OM9tH7DVlUwHBA==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.222.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 151ms
150ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.222.js?utv=ut4.49.202412202029
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8893b43dffc9cb03edb52a0d9cc95d8d3662b6aeb1251a80fea5dbfa03b5f105

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"f57b304c6c874a0a270ed47462f6c9ee"
x-amz-version-id: _tC2dndCAVeojjpcamVk.Kct3WtMU5Sz
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: J9T-3ZMec6qxwrXc1zCsRkNhVT74fehZDUEf49CFnMT3DETgGutbRg==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 153ms
151ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.49.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a8019e4c4a7aa0277a0d7c2593d09d9e551dd855e80f799fdaf327be2ceff0fa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"837627692a5538d1befaa620afdb7f8b"
x-amz-version-id: zkK6Iklqm1teNenKHqMGjFGvIWWfJieh
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: APxSuRfZfL6AHB6fBNBGSXaiRJ9SfQroWTtA2rrKIDtxVM9i0Shacg==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.115.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 153ms
152ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.49.202509151951
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f714584bd8688f16d4136775411a8f00a96c7d56e94b3fc822907aca37d89325

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"3b87f014caf06991e2971af30e2b3b93"
x-amz-version-id: h8AZavI_SmrPeLiEeyJddLR6jKn8fEoB
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: jicXfXgLMzpnXmGamYsVDxg7RETxYwXkKYrz6e7AkkNtgzfngwEKDA==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:47 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.145.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 153ms
151ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.49.202305162129
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2eafc550dc382ef09cfb691ee16d0ebd556edd0eef6221617b5a7d334cf98c9b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"c4fd9539feaa1d9e8e7c38a4e9e5fd39"
x-amz-version-id: jR0cqxWskEEiBABPAYoLRljyHCGTfSyw
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: R9FT8YjOQQDnLHGrpfmnLIddeHGQe_TKabk7CEMGuIoaLEEiZHGnLw==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.171.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 16 KB
5 KB 153ms
152ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.171.js?utv=ut4.49.202509251759
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3d9f62512a23fa62f2334143fb734c479877e684a28e11b91a2d510e5e52f237

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"38dcbaa73363cbd605fa623222f03f9d"
x-amz-version-id: Aa5WgmAXlUfgl3BqIHWPtWLBBRDThng9
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: iUXvqC8i0aFALvQvwfaAYFWy2SML_FjRGRyW6itEW2PadRtIDd3IUA==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.187.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 153ms
152ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202402161940
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 41b771e2c9c362246cf5b2f63b54570c64c9f5101d4a6ddf63831522a77cec78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"9cd31b157b2be6e9f0ba08381b357296"
x-amz-version-id: fu9bN_sGNodGaMPeLtZolvJW0QY8Z.WO
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 7ojrz33izxz14WUd2DroPUaW4stSwgGsxc7OBeI5fINPXjMmh2YQuw==
date: Sun, 15 Mar 2026 16:57:14 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:38 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.205.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 153ms
152ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.205.js?utv=ut4.49.202402222121
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bb0ecc92191a1cd66a8761e02ae078b8e93f844d5f94c2624abb4a64de00726c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"f86990877fe9317daa43a76395d38560"
x-amz-version-id: h7QFGD0zkhQvcAmaNnC3g2q7H7kZb.oi
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: dyqeNgNfVIcfL962bdsENj4HiS6TKavv5pt8EtfXPRXNG6Ag6it84Q==
date: Sun, 15 Mar 2026 16:55:17 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:45 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.210.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 7 KB
2 KB 178ms
177ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.210.js?utv=ut4.49.202509181438
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ecb8d27ebd507ad0935f0a7a6d262e19957450645749ae45ce3b5a28fad70a6b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"d5e3a922e589747eb92a0b86ea1add25"
x-amz-version-id: N90gRH9sX.ZauJL.VWSe8Yi6cfMY8N9A
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: SYnfAsQLtJCx-tuXHmppTfqOOfMYXooDZ6D1vQCYrc4PE1hwKMK6YA==
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.240.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 15 KB
4 KB 228ms
227ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.240.js?utv=ut4.49.202502112205
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cd6cb2b822ea51faddddb35fb09fef290eb8fc5e1f56d2c2fd7ffb9c67a73439

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"2a1d0558bbb083c2c2cf447810113b5e"
x-amz-version-id: IKl9a032spIR5CMqV42.KTJEvuhJ8mF_
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: qAFAon7NO7_7ldZR_CjjzL9-vIaXLcLhj9oTHSA95aR925EN5oLQYA==
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.249.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 20 KB
6 KB 228ms
227ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.249.js?utv=ut4.49.202509151951
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3a549c1e7b0d5821295b11a33782b4b1aa1cee32294439fc0050e6eb6ff081fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"31e9d00895f74726c8919609d1378247"
x-amz-version-id: OHjlfoPqq4cEUhIIYbh_MwJtElZfzGFE
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: KZyG8t0h0CKX2u2XmNWiqazsQbkebDNlP3Rlc2oWJkEEqk479QEhtA==
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.264.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 227ms
227ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.264.js?utv=ut4.49.202509181930
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05a180b4106c9099df86119d4b6ba5e49c9acf82a9c96884c3e1247ec22a9c72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"7f176bc5d39deac54ce0b290ea242288"
x-amz-version-id: h.Bkm.2aV41RwrwszVEi9Lvmv.HpW0t3
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 4ROzTcSLuAm02xadAVDEZNE1iIsUG64gclUbB0ub1RSSToX5XbcZvw==
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.265.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 229ms
228ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.265.js?utv=ut4.49.202509181952
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a90da37d4f07908cb6aff0b368c04a71289dd97e9cc799fe877db6d6676c477

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: accept-encoding
cache-control: max-age=300
content-encoding: br
etag: W/"ef441f251a3e8f7ec8ed4668e585f991"
x-amz-version-id: jiNubXfMsFtGBNfmrxZ3yU09zfvfLFJv
age: 126
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: UBQ_xN4iCVY558Istc8f-vhAXqYgj511z5Ho52J9a74es5SRjiobaQ==
date: Sun, 15 Mar 2026 16:57:15 GMT
content-type: application/javascript
last-modified: Tue, 24 Feb 2026 21:30:38 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 678 KB
170 KB 703ms
411ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d809a1549b8a4faf9bfaaeafc702d61a6b8688d03e9db18ba889508c0289c679

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
expires: Sun, 15 Mar 2026 16:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 15 Mar 2026 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 173851
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 46 KB
13 KB 423ms
137ms Script
application/javascript 146.75.120.157
Fastly

General

Check archive.org

Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software: /
Resource Hash: c1b1adaaeaeaa087e997506ec9284580ec1e0e6ff49214fb642e6ba8b4622a7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "54ba1879b96bae1c0dfd2f874561fa94+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 13221
date: Sun, 15 Mar 2026 16:57:17 GMT
x-tw-cdn: FT
last-modified: Sat, 14 Mar 2026 00:12:18 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kjyo7100141-IAD, cache-fra-etou8220084-FRA
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 52 KB
19 KB 477ms
156ms Script
application/javascript 2.18.64.212
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.64.212 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a2-18-64-212.deploy.static.akamaitechnologies.com

Software

Resource Hash

7e09fc2637f99d9770b0ee76309ac4c3c08e5583adf6cb5d0bbcc827bba2adc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=86400
content-encoding: gzip
x-cdn-proto: HTTP2
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
access-control-allow-origin: *
content-length: 18883
date: Sun, 15 Mar 2026 16:57:17 GMT
last-modified: Wed, 03 Dec 2025 08:26:36 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-92bf-78d6-aa25-38376022f5dd/ 280 KB
45 KB 115ms
114ms Fetch
application/json 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-92bf-78d6-aa25-38376022f5dd/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4b6d53ce6491adcb4aa06b7d8209b5f651b517ac151576584e65a71557d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: pjJJd20CL07+1krf+/chOA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding, X-OneTrust-IsBot
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DE26F1C6DDB929
age: 27987
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Mon, 16 Mar 2026 16:57:17 GMT
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/json
last-modified: Tue, 18 Nov 2025 22:28:19 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-onetrust-isbot: false
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 7ee53ae0-e01e-00ac-7fdb-58b21d000000
cf-ray: 9dcd0e6caf3c7da0-TLV
accept-ranges: bytes
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/74edf1a3/www-widgetapi.vflset/ 31 KB
11 KB 144ms
144ms Script
text/javascript 142.251.127.190
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.youtube.com/s/player/74edf1a3/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.127.190 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f190.1e100.net

Software

sffe /

Resource Hash

e9abd0d74c5ecca848c706e3f94780a00efc33f66f1a7971ded040458851fd69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 136387
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Sun, 14 Mar 2027 03:04:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 14 Mar 2026 03:04:10 GMT
last-modified: Wed, 11 Mar 2026 04:44:12 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10535
x-xss-protection: 0
server: sffe

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 442ms
144ms Script
text/javascript 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
age: 924
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 18:41:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:41:53 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20802
server: Golfe2

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 356 KB
94 KB 283ms
143ms Script
application/x-javascript 157.240.0.6
Facebook

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

9042f1e34a93c7f8b4f6c71701eb19b553ebf0590081e805fe5a926483de7d1d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-YRxOiS3b' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: ;img-src 'self' data: blob: ;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-YRxOiS3b' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=137, rtx=0, c=24, mss=1232, tbw=8718, tp=13, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: vij5LhMv9P6ONSzEFz2VxDem0SUIoPqGGqYX3ZqFnGLY3I6tfYzSJyNDibcBJqUtLTb8TRq7+J21VrDlX+gWZA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 96497
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 534 KB
169 KB 320ms
153ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

8bd783dc020b4d9c175989a5f2d94bd3d53297b0b9f7b0b232cd749af48f4626

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:17 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 172351
date: Sun, 15 Mar 2026 16:57:17 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 445ms
156ms Script
application/x-javascript 23.67.142.205
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.67.142.205 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-67-142-205.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0db210edd69ae50d9bdf5982ba9e3490972296be80a76a5dbec6159080da2b5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Content-Encoding: gzip
ETag: "515ac790b706e56bc59f71a6205549c9:1772595965.945738"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 746
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Sun, 15 Mar 2026 16:57:17 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 04 Mar 2026 03:46:05 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 461ms
168ms Script
application/javascript 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

08a45557e96f2f1d5584a6287baaad19ddb6ccd9c807f6e88ba8a3bc55b8bbbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, max-age=10800
content-encoding: gzip
etag: "67b73244-111a4"
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 19:57:17 GMT
accept-ranges: bytes
content-length: 18949
date: Sun, 15 Mar 2026 16:57:17 GMT
last-modified: Thu, 20 Feb 2025 13:46:44 GMT
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 equally-widget.min.js Show response
widget.equally.ai/ 267 KB
83 KB 467ms
174ms Script
text/javascript 52.222.136.121
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://widget.equally.ai/equally-widget.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202402161940

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.136.121 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-52-222-136-121.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

cf68ec04f2a46589c6838215369b03ed4bdf3f6d2d5dd2eed4c95d95bf9edf27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
etag: W/"5c12a3b2b7e9e1f474debffefdadd926"
age: 56812
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: QxDpsb58VNgLMvnZYtJL70ckzAeb0U-CCnE65maUpJhpj7qC5fEz_A==
date: Sun, 15 Mar 2026 12:02:08 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Wed, 21 Jan 2026 16:29:29 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 b24ae08ef06aba9fb6d6ddc32eb80c64.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 63 KB
22 KB 311ms
154ms Script
text/javascript 142.251.127.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.49.201510262117

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f154.1e100.net

Software

cafe /

Resource Hash

d775ca73edac0c71c45a32dd6d3072b213baf8483393dfede7c508b61ff347fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
etag: 11292853981166581203
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 22837
x-xss-protection: 0
server: cafe

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 198ms
95ms Script
application/javascript 104.20.20.192
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.20.20.192 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdc19178ffaef3c25f667e332a6b3a832a2d433196e269e62705b32635cc4535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"ba58662c7d87649cc6c58ffa655758af"
age: 25555
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=19koH43BDz%2FXbMGEanQ1qoHR7Iett301Dt0Yd6kW4fGLPyPtXVoOW0bPeZhwS3h8jN7Pot6Rd8SwKvKQB1Mxk5egGDgSqgTTuQsiivVdOqh9"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/javascript
vary: accept-encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: strict-origin-when-cross-origin
cf-ray: 9dcd0e700c91fc6b-TLV
access-control-allow-origin: *
server: cloudflare

GET
H/1.1 200
OK sjbgghj1f5 Show response
www.clarity.ms/tag/ 707 B
1 KB 415ms
137ms Script
application/x-javascript 20.250.198.32
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://www.clarity.ms/tag/sjbgghj1f5
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.250.198.32 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: c707fcc7f565bf0ca31cc4f8864901ad1293b26d5cca165e5b399ae49c4b15f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: no-cache, no-store
Connection: keep-alive
Request-Context: appId=cid-v1:a894a21c-0197-44e5-b203-3cbc01252c82
Expires: -1
Content-Length: 707
Date: Sun, 15 Mar 2026 16:57:18 GMT
Content-Type: application/x-javascript
Server: nginx

GET
H/1.1

200
OK

ppt=25985;g=web_visits;gid=66464
trkn.us/pixel/conv/
Redirect Chain

https://trkn.us/pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072
https://trkn.us/pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072;ip=31.187.78.112;cuidchk=1

42 B
721 B

140ms
139ms

Image
image/gif

95.101.111.156
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://trkn.us/pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072;ip=31.187.78.112;cuidchk=1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

HTTP/1.1

Server

95.101.111.156 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a95-101-111-156.deploy.static.akamaitechnologies.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Pragma: no-cache
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Sun, 9 Nov 1980 12:58:00 GMT
Content-Length: 42
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Date: Sun, 15 Mar 2026 16:57:18 GMT
Content-Type: image/gif

Redirect headers

Location: /pixel/conv/ppt=25985;g=web_visits;gid=66464?ord=0.3942182495208072;ip=31.187.78.112;cuidchk=1
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 0
Date: Sun, 15 Mar 2026 16:57:18 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Content-Type-Options: nosniff

POST
H2 200 i.gif Show response
collect.tealiumiq.com/trendmicro/global/2/ 43 B
786 B 539ms
231ms XHR
image/gif 3.120.53.250
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://collect.tealiumiq.com/trendmicro/global/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.249.js?utv=ut4.49.202509151951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.120.53.250 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-53-250.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryjyGbyYGejxpeeJZm
Referer: https://www.trendmicro.com/

Response headers

access-control-expose-headers: X-Region
expires: Sun, 15 Mar 2026 16:57:18 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-serverid: uconnect_uconnect-d5707ce3-af03-4970-88df-8d323d3777de
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif
vary: Origin
x-uuid: 1d7f99aa-f276-4dd5-860e-3b3e6715ffe3
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
pragma: no-cache
access-control-allow-credentials: true
x-tid: 019cf26e3dae000378c99273468805065006705d00b08
access-control-allow-origin: https://www.trendmicro.com
content-length: 43
x-acc: trendmicro:global:2:datacloud
x-ulver: 88f05e437a7ab3d859285f24e38f164128034fa4-SNAPSHOT
x-did: 019cf26e3dae000378c99273468805065006705d00b08
x-region: eu-central-1

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
432 B 139ms
139ms Script
application/javascript 13.33.187.58
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202602242130&cb=1773593837682
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.187.58 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-33-187-58.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-amz-version-id: 2XUX04X5QEw0.xFya64khU._sHTRl_Pz
etag: "7bc0ee636b3b83484fc3b9348863bd22"
age: 98
x-cache: Hit from cloudfront
x-amz-cf-id: VPtk7awkWmgQGWrMShfCxmDNauvn0-BCG5xi5AqYFJVZJE0LM4MUug==
date: Sun, 15 Mar 2026 16:55:40 GMT
content-type: application/javascript
vary: accept-encoding
last-modified: Sat, 11 Mar 2023 06:57:46 GMT
cache-control: max-age=300
via: 1.1 9bd2938ceb90e1a35f549d1165e84676.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 2
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 13 KB
3 KB 101ms
101ms Fetch
application/json 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: /1UdBS+YEc76mTiBEFqAyQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10971D872
x-ms-lease-status: unlocked
age: 47144
cf-cache-status: HIT
x-content-type-options: nosniff
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 19:54:00 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 42357384-801e-0034-1d68-393c22000000
cf-ray: 9dcd0e6e49547da0-TLV
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3017
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 21 KB
4 KB 105ms
105ms Fetch
text/css 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: c7xAZ9MSGAobGaTYg/Qtag==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
cf-cache-status: HIT
x-ms-lease-status: unlocked
age: 34115
x-content-type-options: nosniff
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 19:54:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 3caff250-b01e-0015-1617-3e5113000000
cf-ray: 9dcd0e6e49567da0-TLV
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 iframe_api Show response
www.youtube.com/ 993 B
524 B 202ms
201ms Script
text/javascript 142.251.127.190
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.190 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f190.1e100.net

Software

ESF /

Resource Hash

65c78c20026b7514d7299bcb229bf9d20047ebf76f87806ab58078972e6c3794

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://.youtube.com https://.google.com https://.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist, require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options: nosniff
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9, AiDEBptUfVeO93q48VdVMe/ubupazdAl8AaHP+NBzdnW8quUcHdzJUyGSfrmtpKJu7EOvwRp9ug2rEo3XU+WMAMAAAB2eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJEZXZpY2VCb3VuZFNlc3Npb25DcmVkZW50aWFsczIiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==, ApTXX1w2dkJZuuxlV9csQYg+9ZVXekg+mOu8mS9vb7/V2oeMLKqGC8blgR6ech+eqbhGAgLKPthyai7z89MdTAgAAACLeyJvcmlnaW4iOiJodHRwczovL3d3dy55b3V0dWJlLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQb2xpY3lJbmNsdWRlSlNDYWxsU3RhY2tzSW5DcmFzaFJlcG9ydHMiLCJleHBpcnkiOjE3NDk1MTM2MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==
expires: Sun, 15 Mar 2026 16:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=iw for more info."
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.youtube.com https://*.google.com https://*.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://*.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist, require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: report-uri https://csp.withgoogle.com/csp/youtube_main/strict;base-uri 'self';object-src 'none';script-src 'report-sample' 'nonce-nCH7JaXMSmZY9ekiYHoPnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
643 B 103ms
103ms Image
image/svg+xml 104.18.86.42
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,ETag,Last-Modified,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
cf-cache-status: HIT
x-ms-lease-status: unlocked
age: 47572
x-content-type-options: nosniff
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: image/svg+xml
last-modified: Sun, 01 Mar 2026 11:27:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 8640f5d7-b01e-003c-7cf6-a92751000000
cf-ray: 9dcd0e6f08c27da1-TLV
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 adsct
t.co/1/i/ 43 B
658 B 447ms
263ms Image
image/gif 162.159.140.229
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&dv=Asia%2FJerusalem%26he-IL%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=4&event=%7B%22contents%22%3A%5B%5D%2C%22conversion_id%22%3A%221780044841304304%22%2C%22twitter_tw-nuwoi-PageView_189%22%3A%2239b19832abf08c4baa584a0054b5e35e%22%7D&event_id=0a6d8ca9-1dfe-4a1b-9299-358bfa4af08b&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0792bda5-6ba6-4d2d-a8da-76f584c896e4&pt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1773593837943.672212549473016431&txn_id=tw-nuwoi-PageView&type=javascript&version=2.3.49

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 3048f1e223d7956c
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: 9dcd0e709ca37da0-TLV
cf-cache-status: DYNAMIC
cf-ray: 9dcd0e709ca37da0-TLV
x-response-time: 7
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
810 B 496ms
311ms Image
image/gif 162.159.140.229
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&dv=Asia%2FJerusalem%26he-IL%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=4&event=%7B%22contents%22%3A%5B%5D%2C%22conversion_id%22%3A%221780044841304304%22%2C%22twitter_tw-nuwoi-PageView_189%22%3A%2239b19832abf08c4baa584a0054b5e35e%22%7D&event_id=0a6d8ca9-1dfe-4a1b-9299-358bfa4af08b&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0792bda5-6ba6-4d2d-a8da-76f584c896e4&pt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1773593837943.672212549473016431&txn_id=tw-nuwoi-PageView&type=javascript&version=2.3.49

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 12cba3129921b4c2
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: 9dcd0e709ab1c22c-ATL
cf-cache-status: DYNAMIC
cf-ray: 9dcd0e709ab1c22c-TLV
x-response-time: 69
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H2 200 adsct
t.co/1/i/ 43 B
470 B 507ms
324ms Image
image/gif 162.159.140.229
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&dv=Asia%2FJerusalem%26he-IL%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=f49f5e31-1586-4ec9-b80d-7b562276986f&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0792bda5-6ba6-4d2d-a8da-76f584c896e4&pt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1773593837943.672212549473016431&txn_id=nuwoi&type=javascript&version=2.3.49

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 7d4d9b815b7d69de
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: 9dcd0e709ca47da0-TLV
cf-cache-status: DYNAMIC
cf-ray: 9dcd0e709ca47da0-TLV
x-response-time: 69
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
1002 B 431ms
247ms Image
image/gif 162.159.140.229
Cloudflare

General

Check archive.org

Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&dv=Asia%2FJerusalem%26he-IL%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=f49f5e31-1586-4ec9-b80d-7b562276986f&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0792bda5-6ba6-4d2d-a8da-76f584c896e4&pt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tw_iframe_status=0&tw_pid_src=1&twpid=tw.1773593837943.672212549473016431&txn_id=nuwoi&type=javascript&version=2.3.49

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare envoy /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519; includeSubdomains
x-transaction-id: 024f42af565f8a5b
cache-control: no-cache, no-store, max-age=0
origin-cf-ray: 9dcd0e709ab6c22c-ATL
cf-cache-status: DYNAMIC
cf-ray: 9dcd0e709ab6c22c-TLV
x-response-time: 7
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare envoy
x-served-by: t4_a

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/1015287688/ 6 KB
2 KB 414ms
414ms Script
text/javascript 142.251.127.154
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1015287688/?random=1773593837990&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.154 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f154.1e100.net

Software

cafe /

Resource Hash

055e49aa3598496dd1045788ef19572805bf7237692ec76efe771df20892a211

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2299
date: Sun, 15 Mar 2026 16:57:18 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
788 B 522ms
235ms XHR
application/json 150.171.22.12
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=8866&time=1773593838059&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: *
Referer: https://www.trendmicro.com/

Response headers

x-li-pop: afd-prod-lva1-x
content-encoding: gzip
x-fs-uuid: 00064d12feb7852d1fffc1b3403d28e7
x-msedge-ref: Ref A: 68C58232CA3C444B9897F0545E4F8E53 Ref B: TLV30EDGE0407 Ref C: 2026-03-15T16:57:18Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAZNEv63hS0f/8GzQD0o5w==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/json
access-control-allow-headers: *

GET
H3

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-cli...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-cli...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1773593838059%26li_adsId%3D71496df1-4ed2-4a19-8219-929873a728a9%26u...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-cli...

0
41 B

232ms
231ms

Image
application/javascript

150.171.22.12
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&cookiesTest=true&liSync=true
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H3
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: E6ED718EAF384E7BA3BD9CC700B149E0 Ref B: TLV30EDGE0306 Ref C: 2026-03-15T16:57:24Z
x-li-fabric: prod-lva1
x-li-uuid: AAZNEv8R5+ozUVAc2FjCUA==
x-li-proto: http/1.1
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sun, 15 Mar 2026 16:57:24 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
cf-cache-status: DYNAMIC
x-li-fabric: prod-lva1
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:24 GMT
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
x-li-pop: cf-prod-lva1-x
content-security-policy: frame-ancestors 'self'
cache-control: no-cache, no-store, no-transform
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1773593838059&li_adsId=71496df1-4ed2-4a19-8219-929873a728a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&cookiesTest=true&liSync=true
pragma: no-cache
cf-ray: 9dcd0e955f967d9b-TLV
x-li-uuid: AAZNEv8OOXLh5vTGs1TZtg==
content-length: 0
server: cloudflare

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/164/ 11 KB
5 KB 147ms
147ms Script
application/x-javascript 23.67.142.205
Akamai Technologies

General

Check archive.org

Download Go to

Full URL: https://munchkin.marketo.net/164/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.67.142.205 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-67-142-205.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "756f9116836f579d12be8fe786b69d98:1726632111.60799"
Connection: keep-alive
Expires: Tue, 23 Jun 2026 16:57:18 GMT
Accept-Ranges: bytes
Content-Length: 4843
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Sun, 15 Mar 2026 16:57:18 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 18 Sep 2024 04:01:51 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 143ms
142ms Script
text/javascript 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f113.1e100.net

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 344
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 17:51:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:51:34 GMT
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1129
x-xss-protection: 0
server: sffe

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
811 B 146ms
145ms Script
text/javascript 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f113.1e100.net

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 345
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 17:51:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:51:33 GMT
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 697
x-xss-protection: 0
server: sffe

GET
H3 200 sm.25.html Show response
static.addtoany.com/menu/ Frame 91C9 716 B
1008 B 184ms
94ms Document
text/html 172.66.171.172
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.171.172 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 11503
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 9dcd0e714f1c7da4-TLV
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 15 Mar 2026 16:57:18 GMT
etag: W/"551efc5187c9f500b4e394155ba03720"
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NyD2VdzAZq6XuthHFRK2%2F7KiUOn%2FkJVreoBSOYg75dpw9e4I%2FnTgwMfJV7J1zQrdDTlOns%2FCTCgLbKma1%2F86HAI2%2Bm%2Bxk46sfCIhfdoSLUuOsLc%2FFESb2w0a4Pvd"}]}
server: cloudflare
server-timing: cfExtPri
speculation-rules: "/cdn-cgi/speculation"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
x-content-type-options: nosniff

GET
H3 200 core.ydpp7jcu.js Show response
static.addtoany.com/menu/modules/ 71 KB
26 KB 186ms
96ms Script
application/javascript 104.20.20.192
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.ydpp7jcu.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.20.20.192 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

afb9825a91c5980ddb68ebfa3c7323533f4355f14a0a7db233b5de527f4c32d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"44ad5ade899a741fb11da1dc866d3785"
age: 11379
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6IgoHnv6bJvgalVtJVvdZH%2F9PUI0de%2FRLzjamdULcXu0aLfTaXCiXkHRmlvc8pnofiJFgOTjHjXtx2%2F0XWBgST2Cru6uiG6gjKr4K0CnAC9LBOhIjBx1mVKT%2B1lw"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/javascript
vary: accept-encoding
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=315360000, immutable
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: strict-origin-when-cross-origin
cf-ray: 9dcd0e714ee87d9b-TLV
access-control-allow-origin: *
server: cloudflare

GET
H3 200 243552383039605 Show response
connect.facebook.net/signals/config/ 160 KB
38 KB 368ms
368ms Script
application/x-javascript 157.240.0.6
Facebook

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/243552383039605?v=2.9.277&r=stable&domain=www.trendmicro.com&hme=b0ad3da822578fe2b808f13c29c26424c1eec6df21f897230a1f8d7975c03c8e&ex_m=101%2C194%2C143%2C22%2C69%2C70%2C136%2C65%2C64%2C11%2C151%2C87%2C16%2C130%2C123%2C72%2C75%2C129%2C148%2C153%2C8%2C4%2C5%2C7%2C6%2C3%2C88%2C98%2C154%2C159%2C208%2C59%2C175%2C176%2C52%2C262%2C30%2C71%2C220%2C219%2C218%2C23%2C32%2C100%2C58%2C10%2C60%2C94%2C95%2C96%2C102%2C126%2C31%2C29%2C128%2C125%2C124%2C144%2C73%2C147%2C145%2C146%2C47%2C57%2C119%2C15%2C150%2C42%2C249%2C250%2C248%2C26%2C27%2C28%2C45%2C137%2C74%2C109%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C89%2C93%2C107%2C135%2C138%2C43%2C108%2C24%2C21%2C115%2C66%2C35%2C140%2C139%2C141%2C132%2C131%2C25%2C34%2C56%2C106%2C149%2C67%2C17%2C142%2C111%2C78%2C63%2C19%2C82%2C83%2C112%2C81%2C33%2C277%2C201%2C190%2C191%2C189%2C280%2C272%2C49%2C202%2C104%2C127%2C77%2C117%2C51%2C44%2C46%2C110%2C116%2C122%2C55%2C61%2C50%2C53%2C97%2C152%2C1%2C120%2C14%2C118%2C12%2C2%2C54%2C90%2C62%2C114%2C86%2C85%2C155%2C156%2C91%2C92%2C9%2C121%2C99%2C48%2C133%2C84%2C76%2C68%2C113%2C103%2C40%2C134%2C0%2C79%2C36%2C105%2C13%2C157

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

f26edc423fe6bdd0c8eadc5fb845af21e5067ce83f75f96854bf626c6a70f365

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-G6eZp8X6' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com;font-src 'self' data: blob: ;img-src 'self' data: blob: ;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-G6eZp8X6' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=137, rtx=0, c=107, mss=1232, tbw=110114, tp=101, tpl=0, uplat=229, ullat=0
pragma: public
x-fb-debug: m8jINKu6EkKfOPLNbNu8417rzyiLZS7KPfRd7y3INXChXoBMqLW2O9chYPJCFPQ9TvYLmMCgPfFr3t7C6cvd/A==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
577 B 444ms
148ms XHR
application/json 185.89.210.212
Xandr Inc.

General

Check archive.org

Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 31.187.78.112; 31.187.78.112; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
an-x-request-uuid: ab07d6dc-9334-4224-831b-3702a3c610a8
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 15 Mar 2026 16:57:18 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.25.5

GET
H2

200

/ Show response
c.6sc.co/
Redirect Chain

https://c.6sc.co/
https://c.6sc.co/refresh
https://c.6sc.co/?m=1

47 B
329 B

145ms
144ms

XHR
text/plain

23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://c.6sc.co/?m=1
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Server: 23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-50-131-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d277bb3edc81d43ecfbbb30709e14806af9182107c9d482697f3f95059af0238

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: https://www.trendmicro.com
content-length: 47
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
vary: Origin

Redirect headers

cache-control: max-age=0, no-cache, no-store
location: https://c.6sc.co/?m=1
pragma: no-cache
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: https://www.trendmicro.com
content-length: 0
date: Sun, 15 Mar 2026 16:57:18 GMT
vary: Origin
server: AkamaiGHost

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
284 B 430ms
140ms XHR
text/html 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-50-131-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: null
expires: Sun, 15 Mar 2026 16:57:18 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1773593838405_389224210_262112638_12_546_54_142_219";dur=1
access-control-allow-origin: https://www.trendmicro.com
content-length: 4
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/html
vary: Origin

GET
H2

200

/ Show response
c.6sc.co/
Redirect Chain

https://c.6sc.co/
https://c.6sc.co/refresh
https://c.6sc.co/?m=1

47 B
329 B

155ms
151ms

XHR
text/plain

23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://c.6sc.co/?m=1
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Protocol: H2
Server: 23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-50-131-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8de8cfa0d7ac251115a3eaec2515928d25dfc7e0d42aea81fb1a9275da0c2739

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: https://www.trendmicro.com
content-length: 47
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
vary: Origin

Redirect headers

cache-control: max-age=0, no-cache, no-store
location: https://c.6sc.co/?m=1
pragma: no-cache
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: https://www.trendmicro.com
content-length: 0
date: Sun, 15 Mar 2026 16:57:18 GMT
vary: Origin
server: AkamaiGHost

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
282 B 569ms
141ms XHR
text/html 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-50-131-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: null
expires: Sun, 15 Mar 2026 16:57:18 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1773593838688_389224210_262113017_13_559_54_0_219";dur=1
access-control-allow-origin: https://www.trendmicro.com
content-length: 4
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/html
vary: Origin

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 152ms
151ms Fetch
text/plain 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-4502MK3B94&gtm=45je63b1h1v884954515za200zd884954515&_p=1773593837488&gcd=13l3l3l3l1l1&npa=0&dma=0&gdid=dYmQxMT&cid=1134617522.1773593838&ul=he-il&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~115616986~115938465~115938468~116024733~117484252&sid=1773593838&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&en=page_view&_fv=1&_ss=1&_ee=1&ep.consumer=not_consumer&tfd=3343
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: lcfrai-in-f113.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:113:0
report-to: {"group":"ascnsrsggc:113:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:113:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:113:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 451 KB
152 KB 155ms
155ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-J4XSRG212B&cx=c&gtm=4e63b1h1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

10ce735a8300c0f1d1a52cd2b5ec08248ed72d09154b0818262a1d6912518e25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 155516
date: Sun, 15 Mar 2026 16:57:18 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H/1.1 200
OK visitWebPage
605-sfw-393.mktoresp.com/webevents/ 2 B
318 B 1208ms
226ms Ping
text/plain 192.28.153.119
Adobe Inc.

General

Check archive.org

Download Go to

Full URL: https://605-sfw-393.mktoresp.com/webevents/visitWebPage?_mchNc=1773593838328&_mchCn=&_mchId=605-SFW-393&_mchTk=_mch-trendmicro.com-bb89aa57e0b0b5ef8bb8b12974720bef&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&_mchPc=https%3A&_mchVr=164&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/164/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.153.119 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: 6e05cece-502a-4faa-9dc0-50fb849ee82d
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Sun, 15 Mar 2026 16:57:19 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
38 B 150ms
149ms XHR
text/plain 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j102&a=9901734&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&ul=he-il&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&sr=1600x1200&vp=1600x1200&_u=aGBACAIrBAAAACAMIg~&cid=1134617522.1773593838&tid=UA-44592531-1&_gid=1774239655.1773593838&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&cd2=Aira%20Marcelo%7CIncident%20Response%20Analyst%2CJovit%20Samaniego%7CIncident%20Response%20Analyst%2CRyan%20Maglaque%7CIncident%20Response%20Analyst%2CFe%20Cureg%7CThreats%20Analyst%2CLisa%20Wu%7CSenior%20Security%20Analyst&cd3=2026-03-10&z=1447508596

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfrai-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"ascnsrsgac:207:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:207:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:18 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:207:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:207:0
content-length: 15
server: Golfe2

GET
H2 200 bat.js Show response
bat.bing.com/ 54 KB
15 KB 445ms
169ms Script
application/javascript 150.171.27.10
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

454e2c8f849e7a376985006d897556933fc924756c867076ec9c70156536b09e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "0d8632659cdc1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 03A3A32E6D3F48DB81BB02E71473558C Ref B: TLV30EDGE0111 Ref C: 2026-03-15T16:57:18Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 15310
date: Sun, 15 Mar 2026 16:57:17 GMT
content-type: application/javascript
last-modified: Thu, 12 Feb 2026 21:17:36 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 34 KB
11 KB 488ms
171ms Script
application/javascript 18.172.114.101
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.114.101 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-172-114-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62f5a9e298862e32f868dc614fa303d9b732f0dc9bd75ce48f65293c850aec2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
Vary: accept-encoding
Content-Encoding: gzip
ETag: W/"4f0ee2dd2ded846639b9a28a5cb2bd70"
Age: 17421
Connection: keep-alive
Via: 1.1 81a2ccccd3da8ffc5c6580a9c9d4bace.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: enQDjfbzd8JUS5gMJ42BdC1KLWmr7dPrym5Q3PF6Hl2w-rsagsazjg==
Date: Sun, 15 Mar 2026 12:06:58 GMT
Content-Type: application/javascript
Last-Modified: Sun, 15 Mar 2026 12:05:43 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P8
x-amz-server-side-encryption: AES256

POST
H3 200 collect
www.google.com/ccm/ 0
0 306ms
152ms Fetch
text/plain 142.251.141.100
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?frm=0&ae=g&en=page_view&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&scrsrc=www.googletagmanager.com&rnd=1906883973.1773593838&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&auid=959035382.1773593838&navt=n&npa=0&ep.ads_data_redaction=0&gtm=45He63b1v72003116za200zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&apve=1&apvf=f&apvc=1&tft=1773593838377&tfd=3419
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.141.100 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: tzfraa-ai-in-f4.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

GET getuid
s.ml-attr.com/ 0
0

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 746 B
652 B 465ms
171ms XHR
application/json 75.2.108.141
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: b902b200a31ff61fa23072b04ff9cb7637b536b1a55fcd8d063c99217a56c61c

Request headers

Authorization: Token f0978075a275d14104571cd0b3e9919c9748869b
X-6s-CustomID: WebTag1.0 810eb8f4ed8abcee5cd1e233263d8d3f
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
content-length: 391
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 460ms
151ms Preflight 75.2.108.141
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.trendmicro.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Sun, 15 Mar 2026 16:57:18 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 242ms
233ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 241ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22f0978075a275d14104571cd0b3e9919c9748869b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22810eb8f4ed8abcee5cd1e233263d8d3f%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/gif

GET
H3 200 he.js Show response
static.addtoany.com/menu/locale/ 2 KB
1 KB 94ms
94ms Script
application/javascript 104.20.20.192
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://static.addtoany.com/menu/locale/he.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.ydpp7jcu.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.20.20.192 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

32683732ba9599aabc63ee28e7cb4a88dd159ca64eca23b541f3f2498efbb3ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"ca52df4b22318d8e06488b69b7f9004b"
age: 13960
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=68hOJfAoJn1EjUJuOYDA1t7niXou8%2BGPI6gMMwfXlIrntHvzcWV0bRUar%2FrI%2FfEo2x%2Fr0fa2k9lrq5vZ6geENlDXwh2HYH0Iu3jn8uoeE6Zx"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/javascript
vary: accept-encoding
priority: u=3,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
referrer-policy: strict-origin-when-cross-origin
cf-ray: 9dcd0e725d11fc6b-TLV
access-control-allow-origin: *
server: cloudflare

GET
H2 200 clarity.js Show response
scripts.clarity.ms/0.8.57/ 80 KB
26 KB 412ms
125ms Script
application/javascript 13.107.246.44
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://scripts.clarity.ms/0.8.57/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/sjbgghj1f5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: d8eaf5ff69cb44f6ddaeb29f180ff78b8b56747e6733cfe6795ff53d51fe0f6c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-azure-ref: 20260315T165718Z-15f96686db87bm8shC1TLV32h80000001uu0000000003k29
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
content-encoding: br
etag: W/"0x8DE82577848425E"
x-fd-int-roxy-purgeid: 1
x-ms-request-id: c53ba520-101e-0017-5068-b487d0000000
access-control-allow-origin: *
x-cache: TCP_HIT
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
last-modified: Sun, 15 Mar 2026 05:55:32 GMT

GET
H2

200

/
www.google.co.il/pagead/1p-conversion/1015287688/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTy...
https://www.google.com/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&...
https://www.google.co.il/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=46646592...

42 B
455 B

457ms
161ms

Image
image/gif

142.250.201.67
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&cerd=CgSH3b0t&fsk=ChAI8LHZzQYQgp7vmeO2zdUoEiwAphwSfGnQpzltUkwHGAn2aYAZz6y1VxUaa7QNU6mM7h0Xm5e6uTtixgrDPxoCrqg&is_vtc=1&cid=CAQSsQEA56J1eZ0DDA-mWSkzJ70cgPoBahTOzgGd0pRnK5pF0UlHywgkYBnr50-FHuXcIOzMYopQle6XxbY0sPukvwaRXViMKEq_QcTaAPKzrNnwXRuCfkqfmZUmnrvf_N3Vo7eVF8NFIQVAIN8Z_ym4AxA9dAOD2we7ayAgXiJPUM5Hp56Ni5Ukj1smGzQxfJtPLVcdshE6uNFSETWMZzKB25FBoT51d-69Y_RK4tMAgnTD7rk&random=219767792&resp=GooglemKTybQhCsO&ipr=y&pscrd=IhMI8LrG9a-ikwMVE0IdCR2FOwvAMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS96DAgJYggIABAAGAAgAIIBAnAB

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Server

142.250.201.67 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aq-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.co.il/pagead/1p-conversion/1015287688/?random=1912517070&cv=9&fst=1773593837990&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&async=1&fmt=3&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoVZXZlbnQtc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&cerd=CgSH3b0t&fsk=ChAI8LHZzQYQgp7vmeO2zdUoEiwAphwSfGnQpzltUkwHGAn2aYAZz6y1VxUaa7QNU6mM7h0Xm5e6uTtixgrDPxoCrqg&is_vtc=1&cid=CAQSsQEA56J1eZ0DDA-mWSkzJ70cgPoBahTOzgGd0pRnK5pF0UlHywgkYBnr50-FHuXcIOzMYopQle6XxbY0sPukvwaRXViMKEq_QcTaAPKzrNnwXRuCfkqfmZUmnrvf_N3Vo7eVF8NFIQVAIN8Z_ym4AxA9dAOD2we7ayAgXiJPUM5Hp56Ni5Ukj1smGzQxfJtPLVcdshE6uNFSETWMZzKB25FBoT51d-69Y_RK4tMAgnTD7rk&random=219767792&resp=GooglemKTybQhCsO&ipr=y&pscrd=IhMI8LrG9a-ikwMVE0IdCR2FOwvAMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS96DAgJYggIABAAGAAgAIIBAnAB
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:18 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 514 KB
163 KB 162ms
162ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

28817c13e9cf29899b0e9a231faa5e0391e1f3a40d174505994d204ebde41c07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 15 Mar 2026 16:57:18 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 166796
date: Sun, 15 Mar 2026 16:57:18 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 150ms
150ms Fetch
text/plain 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-J4XSRG212B&gtm=45je63b1h1v9202583567za200zb884954515zd884954515&_p=1773593837488&gcd=13l3l3l3l1l1&npa=0&dma=0&gdid=dYmQxMT&cid=1134617522.1773593838&ul=he-il&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&sid=1773593838&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&_tu=KA&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3567
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-J4XSRG212B&cx=c&gtm=4e63b1h1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: lcfrai-in-f113.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:113:0
report-to: {"group":"ascnsrsggc:113:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:113:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:113:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 343ms
171ms Image
text/plain 157.240.234.35
Facebook

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&rl=&if=false&ts=1773593838579&sw=1600&sh=1200&v=2.9.277&r=stable&a=tmtealium&ec=0&o=4126&fbp=fb.1.1773593837608.922544310940012383.Bg&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&pmd[locale]=en&pmd[description]=Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.&pmd[keywords]=research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime&plt=2491.4000000953674&it=1773593838177&coo=false&eid=0c96c4513377383bcc8c2fe907755e93&tm=1&expv2[0]=pl1&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=im1&expv2[6]=hf0&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.234.35 Sofia, Bulgaria, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-sof1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: MODERATE; q=0.3, rtt=169, rtx=0, c=24, mss=1232, tbw=8595, tp=15, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=1,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
196 B 454ms
329ms Image
image/png 157.240.234.35
Facebook

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&rl=&if=false&ts=1773593838579&sw=1600&sh=1200&v=2.9.277&r=stable&a=tmtealium&ec=0&o=4126&fbp=fb.1.1773593837608.922544310940012383.Bg&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&pmd[locale]=en&pmd[description]=Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.&pmd[keywords]=research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime&plt=2491.4000000953674&it=1773593838177&coo=false&eid=0c96c4513377383bcc8c2fe907755e93&tm=1&expv2[0]=pl1&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=im1&expv2[6]=hf0&rqm=FGET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.234.35 Sofia, Bulgaria, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-sof1.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-iz033in8' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com .instagram.com https://accounts.google.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7617527532722168783&cpp=C3&cv=1035208330&st=1773593838911"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: d1EPERBe2LTJDptrfVt2In1/IMd90eSvZryp4qHOx6ujHTlAcLEE1mNRyIzw8G4XgKS/ioxA4rEtW/ORJGtZ6g==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7617527532722168783&cpp=C3&cv=1035208330&st=1773593838911", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-iz033in8' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: MODERATE; q=0.3, rtt=169, rtx=0, c=26, mss=1232, tbw=9511, tp=23, tpl=0, uplat=158, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 345ms
172ms Image
text/plain 157.240.234.35
Facebook

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&rl=&if=false&ts=1773593838586&sw=1600&sh=1200&v=2.9.277&r=stable&a=tmtealium&ec=1&o=4126&fbp=fb.1.1773593837608.922544310940012383.Bg&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&pmd[locale]=en&pmd[description]=Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.&pmd[keywords]=research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime&plt=2491.4000000953674&it=1773593838177&coo=false&expv2[0]=pl1&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=im1&expv2[6]=hf0&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.234.35 Sofia, Bulgaria, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-sof1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: MODERATE; q=0.3, rtt=169, rtx=0, c=24, mss=1232, tbw=9139, tp=17, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=1,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
195 B 441ms
331ms Image
image/png 157.240.234.35
Facebook

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&rl=&if=false&ts=1773593838586&sw=1600&sh=1200&v=2.9.277&r=stable&a=tmtealium&ec=1&o=4126&fbp=fb.1.1773593837608.922544310940012383.Bg&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&pmd[locale]=en&pmd[description]=Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.&pmd[keywords]=research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime&plt=2491.4000000953674&it=1773593838177&coo=false&expv2[0]=pl1&expv2[1]=el3&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=im1&expv2[6]=hf0&rqm=FGET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.234.35 Sofia, Bulgaria, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

edge-star-mini-shv-02-sof1.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-zoEmXOE9' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com .instagram.com https://accounts.google.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7617527530969183358&cpp=C3&cv=1035208330&st=1773593838911"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: t4Kk6J9SkOunEglp4eybeY2jgDWSOyhOoEmMUFh2m0tl5bUy849M9Ntjpkm3EaejslcEKJIPw7EcV/MeI3hnCw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7617527530969183358&cpp=C3&cv=1035208330&st=1773593838911", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-zoEmXOE9' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: MODERATE; q=0.3, rtt=169, rtx=0, c=26, mss=1232, tbw=13111, tp=26, tpl=0, uplat=161, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 26044208.js Show response
bat.bing.com/p/action/ 400 B
422 B 161ms
161ms Script
application/javascript 150.171.27.10
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/p/action/26044208.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

bdf7e8df0518722ea200689642b5630aaf6b912cc5e336628cf7696ebcf983e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CA9248B171F44402A7C59ADFC369135B Ref B: TLV30EDGE0111 Ref C: 2026-03-15T16:57:18Z
x-cache: CONFIG_NOCACHE
date: Sun, 15 Mar 2026 16:57:18 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
282 B 977ms
383ms XHR
text/plain 20.231.53.73
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: scripts.clarity.ms
URL: https://scripts.clarity.ms/0.8.57/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.trendmicro.com/

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://www.trendmicro.com
Date: Sun, 15 Mar 2026 16:57:19 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 204 0
bat.bing.com/action/ 0
288 B 167ms
167ms Image
text/plain 150.171.27.10
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=26044208&tm=gtm002&Ver=2&mid=21e0f8fb-d967-4ecd-be27-c5816a1cb1c0&bo=1&sid=0700bbe0209011f19ca16924bc3501dd&vid=0700e5e0209011f1ad6aab9bb626ae89&vids=1&msclkid=N&pi=918639831&lg=he-IL&sw=1600&sh=1200&sc=24&tl=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&kw=research,phishing,articles,%20news,%20reports,cyber%20threats,cyber%20crime&p=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&r=&lt=2491&evt=pageLoad&sv=2&cdb=AQER&rn=468135

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DC6DCC643B854544959A20D010C9A38E Ref B: TLV30EDGE0111 Ref C: 2026-03-15T16:57:19Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Sun, 15 Mar 2026 16:57:18 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 464 KB
156 KB 155ms
154ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-5427711&cx=c&gtm=4e63b1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d8769112550136f307911a4c7f0628a2e424d9c6964ba299393635746433fb5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgsrsghrgc:72:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgsrsghrgc:72:0"}],}
expires: Sun, 15 Mar 2026 16:57:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgsrsghrgc:72:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgsrsghrgc:72:0
content-length: 159909
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 402 KB
139 KB 168ms
168ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-929919117&cx=c&gtm=4e63b1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ac5c8d6e1fb317020007cc2f75825e0308840be529381354ac49aa4c4664f493

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgsrsghrgc:72:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgsrsghrgc:72:0"}],}
expires: Sun, 15 Mar 2026 16:57:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 15 Mar 2026 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgsrsghrgc:72:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgsrsghrgc:72:0
content-length: 142448
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 347 KB
124 KB 178ms
177ms Script
application/javascript 216.58.206.72
Google LLC

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-9572106&cx=c&gtm=4e63b1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aa-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e29e82781153b7c9923878d1ee4f12d5527b1fde661f6bf54d4048b785d675b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgsrsghrgc:72:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgsrsghrgc:72:0"}],}
expires: Sun, 15 Mar 2026 16:57:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 15 Mar 2026 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgsrsghrgc:72:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgsrsghrgc:72:0
content-length: 126964
x-xss-protection: 0
server: Google Tag Manager

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 150ms
150ms Fetch
text/plain 142.251.127.113
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JSMMKXDWBS&gtm=45je63b1v9164383042za20g&_p=1773593837488&gcd=13l3l3l3l2l1&npa=0&dma=0&gdid=dYmQxMT&ul=he-il&sr=1600x1200&cid=1134617522.1773593838&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&sid=1773593839&sct=1&seg=0&_tu=6AQ&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&ep.ua_dimension_2=Aira%20Marcelo%7CIncident%20Response%20Analyst%2CJovit%20Samaniego%7CIncident%20Response%20Analyst%2CRyan%20Maglaque%7CIncident%20Response%20Analyst%2CFe%20Cureg%7CThreats%20Analyst%2CLisa%20Wu%7CSenior%20Security%20Analyst&ep.ua_dimension_3=2026-03-10&tfd=4101
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.127.113 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: lcfrai-in-f113.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:113:0
report-to: {"group":"ascnsrsggc:113:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:113:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:113:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 231ms
231ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A18%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:19 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:19 GMT
content-type: image/gif

GET
H3

200

activity;dc_pre=CO7MrvavopMDFQkiogMdXDI7Dg;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-com... Show response
ad.doubleclick.net/
Redirect Chain

https://ad.doubleclick.net/activity;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromise...
https://ad.doubleclick.net/activity;dc_pre=CO7MrvavopMDFQkiogMdXDI7Dg;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkon...

42 B
63 B

183ms
183ms

Fetch
image/gif

172.217.16.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/activity;dc_pre=CO7MrvavopMDFQkiogMdXDI7Dg;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Server

172.217.16.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ad.doubleclick.net/activity;dc_pre=CO7MrvavopMDFQkiogMdXDI7Dg;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-co... Show response
5427711.fls.doubleclick.net/ Frame F053
Redirect Chain

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-...
https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26...

879 B
597 B

200ms
199ms

Document
text/html

142.251.141.102
Google LLC

General

Check archive.org

Download Go to

Full URL

https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-5427711&cx=c&gtm=4e63b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.141.102 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-ai-in-f6.1e100.net

Software

cafe /

Resource Hash

d60b10df7914bbca1054833e5df52884f775c44851c3c9fecded5d46c9309d29

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 487
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Mar 2026 16:57:20 GMT
expires: Sun, 15 Mar 2026 16:57:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Mar 2026 16:57:19 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/ 5 KB
2 KB 168ms
167ms Script
text/javascript 142.251.140.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1773593839563&cv=11&fst=1773593839563&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-929919117&cx=c&gtm=4e63b1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.140.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraa-bt-in-f2.1e100.net

Software

cafe /

Resource Hash

a7b98d0781e028852eb17ceb589c018efd4c663903d804f192ac3a33c4a5255f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2238
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/ 5 KB
2 KB 171ms
171ms Script
text/javascript 142.251.140.162
Google LLC

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1773593839588&cv=11&fst=1773593839588&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-929919117&cx=c&gtm=4e63b1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.140.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

lcfraa-bt-in-f2.1e100.net

Software

cafe /

Resource Hash

744e5dfe5278f52d0a78ce3f91981d8294fd4932a0bd7c967e3fa82cbbc9ce04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2234
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 200 collect
www.google.com/ccm/ 0
0 152ms
152ms Fetch
text/plain 142.251.141.100
Google LLC

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?frm=0&ae=g&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&scrsrc=www.googletagmanager.com&rnd=1906883973.1773593838&dt=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&auid=959035382.1773593838&navt=n&npa=0&_tu=KA&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&apve=1&apvf=f&apvc=0&tids=AW-929919117&tid=AW-929919117&tft=1773593839592&tfd=4634
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-929919117&cx=c&gtm=4e63b1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.141.100 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: tzfraa-ai-in-f4.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

GET
H3

200

activity;dc_pre=CLTSrvavopMDFXQZogMdee8cYg;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-comprom... Show response
ad.doubleclick.net/
Redirect Chain

https://ad.doubleclick.net/activity;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wo...
https://ad.doubleclick.net/activity;dc_pre=CLTSrvavopMDFXQZogMdee8cYg;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuk...

42 B
63 B

183ms
183ms

Fetch
image/gif

172.217.16.166
Google LLC

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/activity;dc_pre=CLTSrvavopMDFXQZogMdee8cYg;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Server

172.217.16.166 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ad.doubleclick.net/activity;dc_pre=CLTSrvavopMDFXQZogMdee8cYg;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compro... Show response
9572106.fls.doubleclick.net/ Frame 84E0
Redirect Chain

https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-comp...
https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc...

875 B
593 B

158ms
158ms

Document
text/html

142.251.141.102
Google LLC

General

Check archive.org

Download Go to

Full URL

https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-9572106&cx=c&gtm=4e63b1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.141.102 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-ai-in-f6.1e100.net

Software

cafe /

Resource Hash

c3a8282f83d5594cba2ca7282addea369dc4bff2876209086a0816996e3657a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 483
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Mar 2026 16:57:20 GMT
expires: Sun, 15 Mar 2026 16:57:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Mar 2026 16:57:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 config Show response
lb.prod.equally.ai/api/v1/widget/ 87 KB
13 KB 255ms
255ms XHR
application/json 34.228.93.103
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://lb.prod.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=370bb87de19f61892a1f1fc1a57d8eed

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.228.93.103 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-228-93-103.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c180dce2f6f2fae1952368b7a48d78ae281b568098b3ff6b5cef68368d7d5d64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 1728000
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: PUT, GET, POST, OPTIONS, DELETE
access-control-allow-origin: https://www.trendmicro.com
date: Sun, 15 Mar 2026 16:57:20 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx
access-control-allow-headers: DNT,X-CustomHeader,X-LANG,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Api-Key,X-Device-Id,Access-Control-Allow-Origin,Authorization,equally-client-id,equally-auth-provider,X-Referer, Origin, Referer

OPTIONS
H2 204 config
lb.prod.equally.ai/api/v1/widget/ Frame 0
0 673ms
227ms Preflight 34.228.93.103
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://lb.prod.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=370bb87de19f61892a1f1fc1a57d8eed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.228.93.103 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-228-93-103.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,X-LANG,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Api-Key,X-Device-Id,Access-Control-Allow-Origin,Authorization,equally-client-id,equally-auth-provider,X-Referer, Origin, Referer
access-control-allow-methods: PUT, GET, POST, OPTIONS, DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 1728000
date: Sun, 15 Mar 2026 16:57:20 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/929919117/ 42 B
64 B 158ms
158ms Image
image/gif 142.251.141.100
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/929919117/?random=1773593839563&cv=11&fst=1773590400000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1ebhF3He64SHY_ASdRkxiRArwyRaghaMpSIIWv14XVAaG0BK9CBjYAiF5PLWp5_WQPiskXkQE0oKYsm6sBYUNnBVvCijzhd7MDnPvY30qGNTQb6y_HtyHOl02CdOfhvchGkLcKWGzx5PAKUGb9Qp3WIbrMcvA7pLph-Ci6ANNrS5xep-IRgjaWcGlNoWZxugF8v3fW2-xqu-Ls49SaH9AZvM062MWnNDEgito48yOMemin8YZYbgKCi9UUw&random=1730610798&rmt_tld=0&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.141.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-ai-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 /
www.google.co.il/pagead/1p-user-list/929919117/ 42 B
108 B 155ms
154ms Image
image/gif 142.250.201.67
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-user-list/929919117/?random=1773593839563&cv=11&fst=1773590400000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1ebhF3He64SHY_ASdRkxiRArwyRaghaMpSIIWv14XVAaG0BK9CBjYAiF5PLWp5_WQPiskXkQE0oKYsm6sBYUNnBVvCijzhd7MDnPvY30qGNTQb6y_HtyHOl02CdOfhvchGkLcKWGzx5PAKUGb9Qp3WIbrMcvA7pLph-Ci6ANNrS5xep-IRgjaWcGlNoWZxugF8v3fW2-xqu-Ls49SaH9AZvM062MWnNDEgito48yOMemin8YZYbgKCi9UUw&random=1730610798&rmt_tld=1&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.201.67 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aq-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/929919117/ 42 B
64 B 158ms
157ms Image
image/gif 142.251.141.100
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/929919117/?random=1773593839588&cv=11&fst=1773590400000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1eWMOakujD4GfkpEPrp9ezFwn5ZSN_PRk-2rOnJ8k3Epm65XzjCgchDVs2LZX-tfbmNavScrl0upF__lU2cnuphf8uuefW0Jn2K6ofqN2MZa4cS8ZTOVslsWUTsMQ8-l85MLwwTEh_kTHdBUXlPjCLaAZ-Hh69U7v0xKAyqNtuTRkxgiqD3gtYo7TvXgxEM0Ev4Udlx0JR9_UEWIO59ubaWvt7lGBfig2AIwbGexFpxjVNje50huCVXMXJA&random=638905532&rmt_tld=0&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.141.100 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-ai-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 /
www.google.co.il/pagead/1p-user-list/929919117/ 42 B
108 B 156ms
155ms Image
image/gif 142.250.201.67
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.co.il/pagead/1p-user-list/929919117/?random=1773593839588&cv=11&fst=1773590400000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v886840403z872003116za20gzb72003116zd72003116xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&frm=0&tiba=Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=959035382.1773593838&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=KA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1eWMOakujD4GfkpEPrp9ezFwn5ZSN_PRk-2rOnJ8k3Epm65XzjCgchDVs2LZX-tfbmNavScrl0upF__lU2cnuphf8uuefW0Jn2K6ofqN2MZa4cS8ZTOVslsWUTsMQ8-l85MLwwTEh_kTHdBUXlPjCLaAZ-Hh69U7v0xKAyqNtuTRkxgiqD3gtYo7TvXgxEM0Ev4Udlx0JR9_UEWIO59ubaWvt7lGBfig2AIwbGexFpxjVNje50huCVXMXJA&random=638905532&rmt_tld=1&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.201.67 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

tzfraa-aq-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:19 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
282 B 217ms
214ms XHR
text/plain 20.231.53.73
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: scripts.clarity.ms
URL: https://scripts.clarity.ms/0.8.57/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.trendmicro.com/

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://www.trendmicro.com
Date: Sun, 15 Mar 2026 16:57:20 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 236ms
236ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A19%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:20 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:20 GMT
content-type: image/gif

GET
H3 200 dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=*;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.htm...
adservice.google.com/ddm/fls/z/ Frame F053 42 B
63 B 339ms
179ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=*;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Requested by

Host: 5427711.fls.doubleclick.net
URL: https://5427711.fls.doubleclick.net/activityi;dc_pre=CNPBt_avopMDFWhb9ggd1Nwa_g;src=5427711;type=remar0;cat=allsi0;ord=1;num=4732260875612;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KJA;gtm=45fe63b1v9188098692z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_KzRgKG42KpzN-9TBgaZVGOJb2UKl_eGwzw;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://5427711.fls.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=*;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;ua...
adservice.google.com/ddm/fls/z/ Frame 84E0 42 B
63 B 278ms
179ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=*;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Requested by

Host: 9572106.fls.doubleclick.net
URL: https://9572106.fls.doubleclick.net/activityi;dc_pre=CPHovfavopMDFbNJ9ggd30c6yw;src=9572106;type=trend002;cat=globa0;ord=2719863055966;npa=0;auiddc=959035382.1773593838;u1=%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe63b1v9190653197z872003116za20gzb72003116zd72003116xea;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=103116026~103200004~115938465~115938468~116024733~117484252;epver=2;dc_random=1773593839_BIN44HrBbuqNR6tQOaoS82LXA-HSuduj2w;_dc_test=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://9572106.fls.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 15 Mar 2026 16:57:20 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

OPTIONS
H2 204 config
lb.prod.equally.ai/api/v1/widget/ Frame 0
0 224ms
224ms Preflight 34.228.93.103
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://lb.prod.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=undefined

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.228.93.103 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-228-93-103.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,X-LANG,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Api-Key,X-Device-Id,Access-Control-Allow-Origin,Authorization,equally-client-id,equally-auth-provider,X-Referer, Origin, Referer
access-control-allow-methods: PUT, GET, POST, OPTIONS, DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 1728000
date: Sun, 15 Mar 2026 16:57:20 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 config Show response
lb.prod.equally.ai/api/v1/widget/ 27 B
857 B 232ms
230ms XHR
application/json 34.228.93.103
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://lb.prod.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=undefined

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.228.93.103 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-228-93-103.compute-1.amazonaws.com

Software

nginx /

Resource Hash

16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 1728000
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: PUT, GET, POST, OPTIONS, DELETE
access-control-allow-origin: https://www.trendmicro.com
date: Sun, 15 Mar 2026 16:57:20 GMT
content-type: application/json
server: nginx
access-control-allow-headers: DNT,X-CustomHeader,X-LANG,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Api-Key,X-Device-Id,Access-Control-Allow-Origin,Authorization,equally-client-id,equally-auth-provider,X-Referer, Origin, Referer

GET
H2 200 en.json Show response
widget.equally.ai/locales/ 10 KB
4 KB 442ms
148ms Fetch
application/json 52.222.136.121
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://widget.equally.ai/locales/en.json

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.136.121 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-52-222-136-121.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8217d4cfca53c8bbe23edfb6df20e2b0fadfa55222fecadb246ddb7c281c2163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"8d57fd76fc218da7e4745626a703c1ad"
age: 18769
access-control-allow-methods: HEAD, GET
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: DcVX1jE4D7l1KP0gpxH7p-OJIseI0XPIRSqNdC2DCy1yV-qLMNVg_g==
date: Sun, 15 Mar 2026 11:44:33 GMT
content-type: application/json
vary: Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
last-modified: Wed, 21 Jan 2026 16:29:30 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 d7b95fc49388e3b88d8d8ce14a277aac.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 open-human.svg Show response
widget.equally.ai/assets/activation-icons/ 1 KB
1 KB 415ms
153ms Fetch
image/svg+xml 52.222.136.121
Amazon.com

General

Check archive.org

Download Go to

Full URL

https://widget.equally.ai/assets/activation-icons/open-human.svg

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.136.121 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-52-222-136-121.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

0dc03f6dc54654dcb69692e7640cfd2b714395aeb4ea50de434b913fb6d828c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"e4a452767bcd9ea9a02f66ee6b874b62"
age: 28563
access-control-allow-methods: HEAD, GET
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: xHu-U1DarjE-60aACIZfqtC44BCIHqpK7oI0irqn62qJyMadWqrIiA==
date: Sun, 15 Mar 2026 09:01:19 GMT
content-type: image/svg+xml
vary: Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
last-modified: Wed, 21 Jan 2026 16:29:29 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 d7b95fc49388e3b88d8d8ce14a277aac.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 232ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:21 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:21 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 232ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A21%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:22 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:22 GMT
content-type: image/gif

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
282 B 302ms
297ms XHR
text/plain 20.231.53.73
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: scripts.clarity.ms
URL: https://scripts.clarity.ms/0.8.57/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/x-clarity-gzip
Referer: https://www.trendmicro.com/

Response headers

Request-Context: appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin: https://www.trendmicro.com
Date: Sun, 15 Mar 2026 16:57:22 GMT
Vary: Origin
Server: nginx
Connection: keep-alive
Access-Control-Allow-Credentials: true

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 232ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A22%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:23 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:23 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 232ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:24 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:24 GMT
content-type: image/gif

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&RedC=c.clarity.ms&MXFR=1B58384DF8D7660736532F50FCD768B5
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&MUID=0B680FBF75AF6E030EC218A274D26F3B

42 B
719 B

166ms
165ms

Image
image/gif

13.107.246.44
Microsoft Corpora...

General

Check archive.org

Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&MUID=0B680FBF75AF6E030EC218A274D26F3B
Protocol: H2
Server: 13.107.246.44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "3a4c4b4d7b3dc1:0"
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sun, 15 Mar 2026 16:57:25 GMT
content-type: image/gif
last-modified: Fri, 13 Mar 2026 16:34:45 GMT
x-powered-by: ASP.NET
x-azure-ref: 20260315T165725Z-15f96686db8vx887hC1TLVtp800000001u90000000004qpm

Redirect headers

cache-control: private, no-cache, proxy-revalidate, no-store
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=0A05739DC4194CC8BF99EE2D38938224&MUID=0B680FBF75AF6E030EC218A274D26F3B
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3E568FEAB0314E77BBFE96EAFD4472F7 Ref B: TLV30EDGE0111 Ref C: 2026-03-15T16:57:25Z
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length: 0
date: Sun, 15 Mar 2026 16:57:24 GMT
x-powered-by: ASP.NET

POST
H3 204 /
px.ads.linkedin.com/wa/ 0
0 230ms
229ms Fetch 150.171.22.12
Microsoft Corpora...

General

Check archive.org

Download Go to

Full URL: https://px.ads.linkedin.com/wa/?medium=fetch&fmt=g
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H3
Security: QUIC, , AES_256_GCM
Server: 150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 7F275F6F0334497AA28A70C6F768E195 Ref B: TLV30EDGE0306 Ref C: 2026-03-15T16:57:24Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAZNEv8Vj8xfwPLVrdk3TA==
x-li-proto: http/1.1
access-control-allow-origin: https://www.trendmicro.com
x-cache: CONFIG_NOCACHE
alt-svc: h3=":443"; ma=86400
date: Sun, 15 Mar 2026 16:57:24 GMT
vary: Origin

GET
H2

200

cei Show response
match.adsrvr.org/track/ Frame E282
Redirect Chain

https://insight.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-site...
https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1

1 KB
1 KB

154ms
154ms

Document
text/html

35.71.131.137
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: a1da858201b3e121861fffd8d316af039cccefdb675a5aeb939516f83994c649

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 15 Mar 2026 16:57:25 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 40
content-type: text/html
date: Sun, 15 Mar 2026 16:57:24 GMT
location: https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1
server: Kestrel

GET
H2 200 favicon.ico
www.trendmicro.com/content/dam/trendmicro/ 3 KB
4 KB 150ms
150ms Other
image/x-icon 23.58.108.159
Akamai Technologies

General

Check archive.org

Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.58.108.159 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-58-108-159.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3818e71293245021a4db81e76832f162d45ff7cb518be638f0cc96797f7c2361

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html

Response headers

content-encoding: br
etag: "d1a-609031a4befc0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 16 Mar 2026 07:02:06 GMT
date: Sun, 15 Mar 2026 16:57:24 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 31 Oct 2023 13:26:31 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=50682
accept-ranges: bytes
content-length: 3361
x-xss-protection: 1;mode=block
server: nginx

GET
H/1.1 200
OK universal_pixel.js Show response
js.adsrvr.org/ Frame E282 422 B
935 B 421ms
141ms Script
application/javascript 18.172.114.101
Amazon.com

General

Check archive.org

Download Go to

Full URL: https://js.adsrvr.org/universal_pixel.js
Requested by: Host: match.adsrvr.org
URL: https://match.adsrvr.org/track/cei?advertiser_id=g2lzvow&cookie_sync=1&upv=3.0.0&upid=803df29&ref=https%3a%2f%2fwww.trendmicro.com&redirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.114.101 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-18-172-114-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2538590b87a5eb44bb27a7a5039451a5606d80c587cb361de40ed4193c9a552f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://match.adsrvr.org/

Response headers

ETag: "4e7de5ca0248ffa6216174e643f3112d"
Age: 17428
Connection: keep-alive
Via: 1.1 0e49b385c2bbe9db0820bc1551bde98a.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 422
X-Amz-Cf-Id: t-El3ignGUom9GNvYTpoqK10T7dJEsZxuJT7dredtMLT4V-UDXHkAA==
Date: Sun, 15 Mar 2026 12:06:58 GMT
Content-Type: application/javascript
Last-Modified: Sun, 15 Mar 2026 12:05:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P8
x-amz-server-side-encryption: AES256

GET

google
match.adsrvr.org/track/cmf/ Frame F4A6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NTJhMDA2MDEtZTRjMi00Yzg4LWIzZmQtMGE1ZWJjNjJkODg4&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5eb...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&google_gid=CAESEAi-QQdKPenyBkOdlGXPjqc&google_cver=1

0
0

GET

rubicon
match.adsrvr.org/track/cmf/ Frame 76BF
Redirect Chain

https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

0
0

GET

bounce
ib.adnxs.com/ Frame B628
Redirect Chain

https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D52a00601-e4c2-4c88-b3fd-0a5ebc62d888

0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
199 B 232ms
232ms Image
image/gif 23.50.131.146
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=12173317f3332500eee4b66969020000fc7f0300&visitor=b665aae2-2384-4e8f-8ba7-41536e9f36b2&session=8df7cfe5-3f35-43bf-8a37-f67f325adaf8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2015%20Mar%202026%2016%3A57%3A24%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%227005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20analysis%20of%20an%20active%20KongTuke%20campaign%20deploying%20modeloRAT%20%E2%80%94%20malware%20capable%20of%20reconnaissance%2C%20command%20execution%2C%20and%20persistent%20access%20%E2%80%94%20through%20compromised%20WordPress%20sites%20and%20fake%20CAPTCHA%20lures%20shows%20that%20the%20group%20still%20operates%20this%20delivery%20chain%20in%20parallel%20with%20the%20newer%20CrashFix%20technique.%22%2C%22keywords%22%3A%22research%2Cphishing%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%2Ccyber%20crime%22%2C%22title%22%3A%22Through%20the%20Lens%20of%20MDR%3A%20Analysis%20of%20KongTuke%E2%80%99s%20ClickFix%20Abuse%20of%20Compromised%20WordPress%20Sites%20%7C%20Trend%20Micro%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&pageViewId=834d3aab-61ae-42e9-8398-4eec57d92895&an_uid=0&v=1.1.32

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.50.131.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-50-131-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-content-type-options: nosniff
expires: Sun, 15 Mar 2026 16:57:25 GMT
accept-ranges: bytes
content-length: 43
date: Sun, 15 Mar 2026 16:57:25 GMT
content-type: image/gif

OPTIONS realtimeconversion
insight.adsrvr.org/track/ Frame 0
0

POST realtimeconversion
insight.adsrvr.org/track/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.ml-attr.com
URL: https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID

Domain: match.adsrvr.org
URL: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=52a00601-e4c2-4c88-b3fd-0a5ebc62d888&google_gid=CAESEAi-QQdKPenyBkOdlGXPjqc&google_cver=1

Domain: match.adsrvr.org
URL: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D52a00601-e4c2-4c88-b3fd-0a5ebc62d888

Domain: insight.adsrvr.org
URL: https://insight.adsrvr.org/track/realtimeconversion

Domain: insight.adsrvr.org
URL: https://insight.adsrvr.org/track/realtimeconversion

Verdicts & Comments Add Verdict or Comment

155 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

59 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.trendmicro.com/	1970-01-21 12:39:53	Name: NSC_MC_dxu-bfn-xfc_XBG-IUUQ Value: ffffffff09224f4345525d5f4f58455e445a4a423660
.trendmicro.com/	1969-12-31 23:59:59	Name: _c1Ref Value: /en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
.trendmicro.com/	1969-12-31 23:59:59	Name: _formRef Value: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: dLxxxA_ZQzo
.youtube.com/	1970-01-21 16:59:05	Name: VISITOR_INFO1_LIVE Value: 2KhcbE3P1Qc
.youtube.com/	1970-01-21 16:59:05	Name: VISITOR_PRIVACY_METADATA Value: CgJJTBIEGgAgVQ%3D%3D
.trendmicro.com/	1970-01-21 14:49:29	Name: _fbp Value: fb.1.1773593837608.922544310940012383.Bg
.trendmicro.com/	1970-01-21 12:41:20	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sun+Mar+15+2026+18%3A57%3A17+GMT%2B0200+(%D7%A9%D7%A2%D7%95%D7%9F+%D7%99%D7%A9%D7%A8%D7%90%D7%9C+(%D7%97%D7%95%D7%A8%D7%A3))&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=e33d4367-8e1c-4ceb-b700-b2479165ea3d&interactionCount=0&landingPath=https%3A%2F%2Fwww.trendmicro.com%2Fen%2Fresearch%2F26%2Fc%2Fkongtuke-clickfix-abuse-of-compromised-wordpress-sites.html&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.trendmicro.com/	1970-01-21 22:01:29	Name: _twpid Value: tw.1773593837943.672212549473016431
.youtube.com/	1970-01-21 16:59:05	Name: __Secure-YNID Value: 16.YT=uP_GwlsoKHQxjpUpBAm2b-VZ6UGQaN4h5-ir9KdraWDmShu6OHNJHws6vz7X-DOgrQwjbnWucyH5c5lLCct0b7fc-GTG1XJwOL49UcwlPvr7mF2oKSMQ5GNOrzsdN0N8l3-3Ufa79x70ylun4d4sjC8eyjsSMLgaZLtqLHthPGeE9BaczFxw2FlfzURZ_V3E6f1mzRSpvy9o1h67XVUCv15f6jWOhFLS3NXwHyouPwEp378UcLO7hwcjZxUAdkRExrZU956za7g5YRN0Zo7l976qVdrkhDP1YvbAdADH8IfG80RTYc7GJTx0GTNKgKt2JGyVFUidLkY9fbO4tpdWvg
.youtube.com/	1970-01-21 16:59:05	Name: __Secure-ROLLOUT_TOKEN Value: CIzBrt70o6braRC0m471r6KTAxju8L_1r6KTAw%3D%3D
.trendmicro.com/	1970-01-21 12:41:20	Name: _gid Value: GA1.2.1774239655.1773593838
.tealiumiq.com/	1970-01-21 21:25:29	Name: TAPID Value: trendmicro/global>019cf26e3dae000378c99273468805065006705d00b08\|
.trendmicro.com/	1970-01-21 21:25:29	Name: utag_main Value: v_id:019cf26e3dae000378c99273468805065006705d00b08$_sn:1$_se:1$_ss:1$_st:1773595636975$ses_id:1773593836975%3Bexp-session$_pn:1%3Bexp-session$dc_visit:1$dc_event:1%3Bexp-session$dc_region:eu-central-1%3Bexp-session
.trendmicro.com/	1970-01-21 22:15:53	Name: _ga_4502MK3B94 Value: GS2.1.s1773593838$o1$g0$t1773593838$j60$l0$h0
.trendmicro.com/	1970-01-21 22:15:53	Name: _ga Value: GA1.1.1134617522.1773593838
.trendmicro.com/	1970-01-21 22:15:53	Name: _mkto_trk Value: id:605-SFW-393&token:_mch-trendmicro.com-bb89aa57e0b0b5ef8bb8b12974720bef
.trendmicro.com/	1970-01-21 14:49:29	Name: _gcl_au Value: 1.1.959035382.1773593838
www.clarity.ms/	1970-01-21 21:25:29	Name: CLID Value: 9fd35f7f9d4b452da4048276681736b4.20260315.20270315
www.trendmicro.com/	1970-01-21 22:15:53	Name: _gd_visitor Value: b665aae2-2384-4e8f-8ba7-41536e9f36b2
www.trendmicro.com/	1970-01-21 12:40:08	Name: _gd_session Value: 8df7cfe5-3f35-43bf-8a37-f67f325adaf8
.twitter.com/	1970-01-21 22:15:53	Name: guest_id_marketing Value: v1%3A177359383826244695
.twitter.com/	1970-01-21 22:15:53	Name: guest_id_ads Value: v1%3A177359383826244695
.twitter.com/	1970-01-21 22:15:53	Name: personalization_id Value: "v1_a0i145rfIw6ybc2L7FTTyw=="
.twitter.com/	1970-01-21 22:15:53	Name: guest_id Value: v1%3A177359383826244695
.t.co/	1970-01-21 22:15:53	Name: muc_ads Value: a6567d85-0462-4d28-a283-a0f43e74cba5
.trkn.us/	1970-01-21 21:25:29	Name: barometric[cuid] Value: cuid_69b6e4ee-9cd0-4170-925c-54f5209b6baf
.trendmicro.com/	1970-01-21 22:15:53	Name: _ga_J4XSRG212B Value: GS2.1.s1773593838$o1$g0$t1773593838$j60$l0$h0
www.trendmicro.com/	1970-01-21 12:49:58	Name: _an_uid Value: 0
.6sc.co/	1970-01-21 22:15:53	Name: 6suuid Value: 12173317f3332500eee4b66969020000fc7f0300
www.trendmicro.com/	1970-01-21 22:15:53	Name: _gd_svisitor Value: 12173317f3332500eee4b66969020000fc7f0300
.trendmicro.com/	1970-01-21 21:25:29	Name: _clck Value: 1cl07li%5E2%5Eg4d%5E0%5E2265
.trendmicro.com/	1970-01-21 12:41:20	Name: _uetsid Value: 0700bbe0209011f19ca16924bc3501dd
.trendmicro.com/	1970-01-21 22:01:29	Name: _uetvid Value: 0700e5e0209011f1ad6aab9bb626ae89
.trendmicro.com/	1970-01-21 22:15:53	Name: _ga_JSMMKXDWBS Value: GS2.2.s1773593839$o1$g0$t1773593839$j60$l0$h0
.bing.com/	1970-01-21 22:01:29	Name: MUID Value: 0B680FBF75AF6E030EC218A274D26F3B
.doubleclick.net/	1970-01-21 22:15:53	Name: IDE Value: AHWqTUn6m3Qfr3p84PT_AYPyWn-d9XihO9asl-CgMS15Jk81kNHCzqxVrSlru2gb
.trendmicro.com/	1970-01-21 12:41:20	Name: _clsk Value: 1x5uaqy%5E1773593839983%5E1%5E1%5Eq.clarity.ms%2Fcollect
.linkedin.com/	1970-01-21 14:49:29	Name: li_sugr Value: e313fbec-427e-4800-a2d2-5260b3e76cf6
.linkedin.com/	1970-01-21 21:25:29	Name: bcookie Value: "v=2&ffb35197-fbb1-41e4-8a81-8fe667455d0a"
.linkedin.com/	1970-01-21 12:41:20	Name: lidc Value: "b=VGST03:s=V:r=V:a=V:p=V:g=3676:u=1:x=1:i=1773593840:t=1773680240:v=2:sig=AQFpSjtgukrlVyE81qwiydXHZizy1yP7"
.linkedin.com/	1970-01-21 13:23:05	Name: UserMatchHistory Value: AQI4psUrs3f1-wAAAZzyblfdBvpSeYv2mf2ur9cXPKAIN1PQyZ_4oT5iIGn_-BESQ_mm-0nPCR2Czw
.linkedin.com/	1970-01-21 13:23:05	Name: AnalyticsSyncHistory Value: AQL8Qb5ccvTingAAAZzyblfdWz3s9vv6uLC7M54y-FbtpKFF1lterA1OOgxUe0Kon7CPkQDPllolPuLYW-WJcQ
.www.linkedin.com/	1970-01-21 21:25:29	Name: bscookie Value: "v=1&20260315165724617dfeba-7d4c-4f80-8b05-cd9f846c0095AQHtcFkKvQa2tf7LZpvdMjRU7zkz__UT"
.linkedin.com/	1970-01-21 12:39:55	Name: __cf_bm Value: 9C4Y_eJNKb7KrL.Q1G.39tXbub6u6zfxyZSygdNdL6w-1773593844-1.0.1.1-sOHWDvUQnZP9Omlmcj10auYBoBRNHbDcFRprl7WZQpXzhtwGN.HAQsrZZ3emlhgVOwgek6FM5.h9fGE1ukdZbOirhqitoAD_rx3SSeHDqkk
.adsrvr.org/	1970-01-21 21:25:29	Name: TDID Value: 52a00601-e4c2-4c88-b3fd-0a5ebc62d888
.adsrvr.org/	1970-01-21 21:25:29	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsI0qfP8b6vgT8QBRIWCgdydWJpY29uEgsI8M7P8b6vgT8QBRIXCghhcHBuZXh1cxILCIT3z_G-r4E_EAUYBSgGMgsInvvRntWvgT8QBUIPIg0IARIJCgV0aWVyMhABWgdnMmx6dm93YAE.
.c.bing.com/	1970-01-21 12:49:58	Name: MR Value: 0
.c.bing.com/	1970-01-21 22:01:29	Name: SRM_B Value: 0B680FBF75AF6E030EC218A274D26F3B
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 22:01:29	Name: MUID Value: 0B680FBF75AF6E030EC218A274D26F3B
.c.clarity.ms/	1970-01-21 12:49:58	Name: MR Value: 0
.c.clarity.ms/	1970-01-21 12:39:54	Name: ANONCHK Value: 0
.adnxs.com/	1970-01-21 14:49:29	Name: XANDR_PANID Value: MrqY3h-RpsrhxOUnaGq_Km6XycgPUHMVOAfJlI1skf6KtrA2DoE6HQI6UpZcj1kYw_7tLXJ-h3mYQHU-RG8gXl-AI7KbWwt2AUsRnNzC3hU.
.adnxs.com/	1970-01-21 14:49:29	Name: uuid2 Value: 7522601368693868695
.rubiconproject.com/	1970-01-21 21:25:29	Name: audit_p Value: 1\|G7dO6KnM0QHxeKOrK1P7gRuJhbOT1+0ZkIfZ7e/N51t+4SNCS7h+Yz8CsF5aRuuiU3CBI4N9oBCM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLsvTHs/cRU7wf09ez/CDwV4bDwmnpu5ylqkWEKJLF027LXSgotxJ/Fz5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.rubiconproject.com/	1970-01-21 21:25:29	Name: khaos Value: MMRZZDRS-1P-EU47
.rubiconproject.com/	1970-01-21 21:25:29	Name: khaos_p Value: MMRZZDRS-1P-EU47
.rubiconproject.com/	1970-01-21 21:25:29	Name: audit Value: 1\|G7dO6KnM0QHxeKOrK1P7gRuJhbOT1+0ZkIfZ7e/N51t+4SNCS7h+Yz8CsF5aRuuiU3CBI4N9oBCM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLsvTHs/cRU7wf09ez/CDwV4bDwmnpu5ylqkWEKJLF027LXSgotxJ/Fz5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 10) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 10) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
rendering	warning	URL: https://www.trendmicro.com/en/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0407A12A4320000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com https://resources.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
605-sfw-393.mktoresp.com
9572106.fls.doubleclick.net
ad.doubleclick.net
adservice.google.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
c.bing.com
c.clarity.ms
cdn.bc0a.com
cdn.cookielaw.org
collect.tealiumiq.com
connect.facebook.net
customer.cludo.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ib.adnxs.com
insight.adsrvr.org
ipv6.6sc.co
ixfd2-api.bc0a.com
j.6sc.co
js.adsrvr.org
lb.prod.equally.ai
match.adsrvr.org
munchkin.marketo.net
px.ads.linkedin.com
q.clarity.ms
s.ml-attr.com
scripts.clarity.ms
secure.adnxs.com
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
t.co
tags.tiqcdn.com
trendmicro.scene7.com
trkn.us
widget.equally.ai
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.co.il
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
ib.adnxs.com
insight.adsrvr.org
match.adsrvr.org
s.ml-attr.com
104.18.32.137
104.18.86.42
104.20.20.192
108.138.7.97
13.107.246.44
13.33.187.58
142.250.201.67
142.251.127.113
142.251.127.154
142.251.127.190
142.251.140.162
142.251.141.100
142.251.141.102
142.251.141.131
142.251.208.170
146.75.120.157
150.171.22.12
150.171.27.10
157.240.0.6
157.240.234.35
162.159.140.229
172.217.16.162
172.217.16.166
172.64.146.215
172.66.171.172
18.172.114.101
185.89.210.212
192.28.153.119
2.16.10.185
2.18.64.212
20.231.53.73
20.250.198.32
216.58.206.72
23.50.131.146
23.58.108.159
23.67.142.205
3.120.53.250
34.111.194.12
34.228.93.103
35.201.125.192
35.71.131.137
52.222.136.121
75.2.108.141
95.101.111.156
0302d9000c5640cfd4f06353524bfcdcdfcb11cc0440ec34f16e4bb55b679f42
045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a
055e49aa3598496dd1045788ef19572805bf7237692ec76efe771df20892a211
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
05a180b4106c9099df86119d4b6ba5e49c9acf82a9c96884c3e1247ec22a9c72
06fa22e6381b5f48caf52270f6e47d08a6a752c8c466504be817071fa8910f33
08a45557e96f2f1d5584a6287baaad19ddb6ccd9c807f6e88ba8a3bc55b8bbbc
0a90da37d4f07908cb6aff0b368c04a71289dd97e9cc799fe877db6d6676c477
0db210edd69ae50d9bdf5982ba9e3490972296be80a76a5dbec6159080da2b5d
0dc03f6dc54654dcb69692e7640cfd2b714395aeb4ea50de434b913fb6d828c4
0e7f25b4a085d3c4ad8edac6fd7bcb8eb2ebabc9887c569fe61df284ade34549
10ce735a8300c0f1d1a52cd2b5ec08248ed72d09154b0818262a1d6912518e25
1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e
15a5a919d4b2c63b74bac3c0752f7faa08675d5ecaab478032a0232013a2ba6a
16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
186836b74ceac07b2764c07c0379420e3014efb30fe918461c235e0ef6cbc4a2
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1c399395a6574ff803d6fe0052148f77e22c71bf998f49fc363bbc03167be08d
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
1f20db7a790a5be3a7a65910e6bfe0afcdbb73a9b55d1a0f16c20f310c2ac5da
1fa63b400e5f9248aba4bad81d9b545d5dcfaf7ea984020b3220cd7e53db3433
2538590b87a5eb44bb27a7a5039451a5606d80c587cb361de40ed4193c9a552f
274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad
28817c13e9cf29899b0e9a231faa5e0391e1f3a40d174505994d204ebde41c07
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
2e4db45aa37bde0ca92814a85fb311ddf2f3e2ae69f58cf44d8733368e35680c
2eafc550dc382ef09cfb691ee16d0ebd556edd0eef6221617b5a7d334cf98c9b
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
32683732ba9599aabc63ee28e7cb4a88dd159ca64eca23b541f3f2498efbb3ad
336a2dcb2ad0b0191bdc6877281bc3e93bce86391d4608e988ebb3feea358b5e
354016c0025a878d5a0b913bf57e62746e201579d2e471249f99f307afa6e013
377e9731df07066631dc615291a3dbdbc923893629702f2e3b9b7a5775cc027b
3818e71293245021a4db81e76832f162d45ff7cb518be638f0cc96797f7c2361
3a549c1e7b0d5821295b11a33782b4b1aa1cee32294439fc0050e6eb6ff081fe
3d64634279c4fe237d6503f690bb6e0575e5d6c57aa5ecf4d24076fa043b4b8b
3d9f62512a23fa62f2334143fb734c479877e684a28e11b91a2d510e5e52f237
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b
41b771e2c9c362246cf5b2f63b54570c64c9f5101d4a6ddf63831522a77cec78
4298828b97519fd3104c2dabf36f59b1c0504271c0a65236e3e0dcbc199d2e45
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
454e2c8f849e7a376985006d897556933fc924756c867076ec9c70156536b09e
4603a811d2ab155474648f45b9a4dce4b28d07a6aacbf441f0c7e9e685fd6354
49357cbf20c9a6d5f2698223de9baad85fff24c2dff4110920d3c8211d338209
4a00442af7139fa4ae1af61fc6233a678bb4a37e286114a0b6978cebcc618857
4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
4f92e8a70f4aec9b8bf224c48f0e105584fa1cba6e076ea5cae712f262a61aad
51d16bae003e26c3b7c27cf551cf2689d64ea525155882d8922460b16062a307
55b10f37fc79af40c1d4e753868ffd8a3bdeec732a9e8ba4a78d982e39b14b88
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c013490dff7318684acced8fff972b6e78aa43f65cfc3477f6365de220caaec
5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8
60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85
60b17a76e4ecaeae677bb2ea4f0bc9f0286563dd7f60a11c831fa6530b726e80
62f5a9e298862e32f868dc614fa303d9b732f0dc9bd75ce48f65293c850aec2f
65c78c20026b7514d7299bcb229bf9d20047ebf76f87806ab58078972e6c3794
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
73be518187f34046c101627800ac5a8f21820e7735f3fcfe60e4b0ce6e35d357
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
744e5dfe5278f52d0a78ce3f91981d8294fd4932a0bd7c967e3fa82cbbc9ce04
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
759f3e412507cbbd0bcc2f880eebffa3ed2ed966ef729d75afd6a69f17d23809
7ccf8af33b6da01a82a6e95fe781ae615fc59cb8dedf7ea29256cb5c6bdefd6a
7e09fc2637f99d9770b0ee76309ac4c3c08e5583adf6cb5d0bbcc827bba2adc6
80df2c3d694aba09adc50f732985286bd1c8f123b9d00784562634713bb6ad81
8217d4cfca53c8bbe23edfb6df20e2b0fadfa55222fecadb246ddb7c281c2163
82dab6b89d8fa4547adf9da91df8cccfff6fc0e847df5d3e9a41276fa4a0d6b5
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
8893b43dffc9cb03edb52a0d9cc95d8d3662b6aeb1251a80fea5dbfa03b5f105
8bd783dc020b4d9c175989a5f2d94bd3d53297b0b9f7b0b232cd749af48f4626
8de8cfa0d7ac251115a3eaec2515928d25dfc7e0d42aea81fb1a9275da0c2739
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
9042f1e34a93c7f8b4f6c71701eb19b553ebf0590081e805fe5a926483de7d1d
9113cb28745593b1c3da7fec66d0d2bc32ae6d66fc18506dfa0c016820da1236
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
965853675c963a1f34736e7e21618b5061048b3847285860d617192f4c9503b8
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1da858201b3e121861fffd8d316af039cccefdb675a5aeb939516f83994c649
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a7b98d0781e028852eb17ceb589c018efd4c663903d804f192ac3a33c4a5255f
a8019e4c4a7aa0277a0d7c2593d09d9e551dd855e80f799fdaf327be2ceff0fa
a877eb3c864362bfdc62e2f325b02bfbf263bfa2fe48cd3e4b5b02f0dedfa5ba
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac5c8d6e1fb317020007cc2f75825e0308840be529381354ac49aa4c4664f493
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae
afb9825a91c5980ddb68ebfa3c7323533f4355f14a0a7db233b5de527f4c32d5
b2112e201afda27eaa87eefa81cec837cbc2757b32ecae5e3b35efb6b8517981
b47372de689d5963e6ed2f26fa295627d0b1edcc53cfee1a18cce97d763c3a66
b902b200a31ff61fa23072b04ff9cb7637b536b1a55fcd8d063c99217a56c61c
bb0ecc92191a1cd66a8761e02ae078b8e93f844d5f94c2624abb4a64de00726c
bbc4b6d53ce6491adcb4aa06b7d8209b5f651b517ac151576584e65a71557d22
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
bc7040cb84227015953614f1c7f1aed09be43c48baaad4774d4fe847c555a35e
bdf7e8df0518722ea200689642b5630aaf6b912cc5e336628cf7696ebcf983e6
c180dce2f6f2fae1952368b7a48d78ae281b568098b3ff6b5cef68368d7d5d64
c1afa7aee2a145fe0d29f740e96eadd66eeddbcd1c52990e018f25aa5e4c027f
c1b1adaaeaeaa087e997506ec9284580ec1e0e6ff49214fb642e6ba8b4622a7d
c3a8282f83d5594cba2ca7282addea369dc4bff2876209086a0816996e3657a1
c707fcc7f565bf0ca31cc4f8864901ad1293b26d5cca165e5b399ae49c4b15f1
c736034b3d0913081caf7f378d4726f2277a6fe0c1e6400e8416a474570de369
c7aece63b23620e8c0217a0a20eb35c70985d86f937f7ab75698292be4f9d577
c87080ff86ce00a5f93164a37b45eaaf5f6cff5744704053d092217b9bb914a8
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
cd6cb2b822ea51faddddb35fb09fef290eb8fc5e1f56d2c2fd7ffb9c67a73439
cf68ec04f2a46589c6838215369b03ed4bdf3f6d2d5dd2eed4c95d95bf9edf27
d277bb3edc81d43ecfbbb30709e14806af9182107c9d482697f3f95059af0238
d3e6686ab60595ac578adfcc04997be05b32eac05fe84014e481c277ce45a03b
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
d60b10df7914bbca1054833e5df52884f775c44851c3c9fecded5d46c9309d29
d775ca73edac0c71c45a32dd6d3072b213baf8483393dfede7c508b61ff347fe
d809a1549b8a4faf9bfaaeafc702d61a6b8688d03e9db18ba889508c0289c679
d8769112550136f307911a4c7f0628a2e424d9c6964ba299393635746433fb5d
d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
d8eaf5ff69cb44f6ddaeb29f180ff78b8b56747e6733cfe6795ff53d51fe0f6c
d997398b880ed2083b4a572dad9c5d5065f365b11dfbc5ffe713a27848b5aeae
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6
e29e82781153b7c9923878d1ee4f12d5527b1fde661f6bf54d4048b785d675b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52bf91e8e4c6d9c615e981d603e8286578849392e36763e1e9757a140d18950
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e924b29a40f25426e83d462612a6a5fa14ddee06f39d9e3d558a6592b618183e
e9abd0d74c5ecca848c706e3f94780a00efc33f66f1a7971ded040458851fd69
ea48a7b249c0cd142685adab2847aee7ce58c1974f2b94566015ed0d3dfa5529
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ecb8d27ebd507ad0935f0a7a6d262e19957450645749ae45ce3b5a28fad70a6b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f26edc423fe6bdd0c8eadc5fb845af21e5067ce83f75f96854bf626c6a70f365
f46c590a26ea618d9f25778788270eeab0abed9a4d70d6eda4a2535ec5bce4d0
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f714584bd8688f16d4136775411a8f00a96c7d56e94b3fc822907aca37d89325
f894ac9782073ab2d88baf10eaad124918f8737d0922a68fd8b87d38d696172f
fdc19178ffaef3c25f667e332a6b3a832a2d433196e269e62705b32635cc4535
ff10c1fe39489bf9f57c9dc9e8ccc064dfdfd4dec949636d5deeba2a8f2da2f0

www.trendmicro.com 23.58.108.159 Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

186 Requests

92 %HTTPS

0 %IPv6

36 Domains

53 Subdomains

44 IPs

5 Countries

6953 kBTransfer

13272 kBSize

59 Cookies

27 Outgoing links

Redirected requests

186 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.trendmicro.com
23.58.108.159 Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

186
Requests

92 %
HTTPS

0 %
IPv6

36
Domains

53
Subdomains

44
IPs

5
Countries

6953 kB
Transfer

13272 kB
Size

59
Cookies

186 HTTP transactions
0 data transactions