symantec-enterprise-blogs.security.com Open in urlscan Pro
2606:4700:10::6816:31d7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Effective URL:
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Submission: On September 30 via api (September 30th 2022, 8:01:46 pm UTC) from US — Scanned from DE

Summary HTTP 47 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 10 domains to perform 47 HTTP transactions. The main IP is 2606:4700:10::6816:31d7, located in United States and belongs to CLOUDFLARENET, US. The main domain is symantec-enterprise-blogs.security.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 9th 2022. Valid for: a year.

This is the only time symantec-enterprise-blogs.security.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700::68... 2606:4700::6812:59e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
28	2606:4700:10:... 2606:4700:10::6816:31d7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.129.181 151.101.129.181	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:440e::6812:2fe6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
1	13.224.189.114 13.224.189.114	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:2962	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
47	9

1 2606:4700::6812:59e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.symantec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2606:4700:10::6816:31d7 (United States)

ASN13335 (CLOUDFLARENET, US)

symantec-enterprise-blogs.security.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.181 (United States)

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-114.fra2.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2962 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	security.com symantec-enterprise-blogs.security.com	506 KB
7	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 419	123 KB
2	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 1735	3 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	144 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 681	393 B
1	driftt.com js.driftt.com — Cisco Umbrella Rank: 5169	61 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1029	5 KB
1	vidyard.com play.vidyard.com — Cisco Umbrella Rank: 9597	49 KB
1	symantec.com 1 redirects www.symantec.com — Cisco Umbrella Rank: 71070	645 B
0	Failed function sub() { [native code] }. Failed
47	10

	Domain	Requested by
28	symantec-enterprise-blogs.security.com	symantec-enterprise-blogs.security.com static.cloudflareinsights.com
7	cdn.cookielaw.org	symantec-enterprise-blogs.security.com cdn.cookielaw.org
2	script.crazyegg.com	symantec-enterprise-blogs.security.com script.crazyegg.com
2	www.googletagmanager.com	symantec-enterprise-blogs.security.com www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	js.driftt.com	symantec-enterprise-blogs.security.com
1	static.cloudflareinsights.com	symantec-enterprise-blogs.security.com
1	play.vidyard.com	symantec-enterprise-blogs.security.com
1	www.symantec.com	1 redirects
0	truncated Failed	symantec-enterprise-blogs.security.com
47	10

This site contains links to these domains. Also see Links.

Domain
www.broadcom.com
twitter.com
www.linkedin.com
www.us-cert.gov
www.symantec.com
www.fbi.gov
software.broadcom.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-09` - `2023-06-09`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
*.vidyard.com GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-09-27` - `2023-10-29`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
drift.com Amazon	`2022-08-24` - `2023-09-21`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Frame ID: D2CC0615019DABEDD8278E4028151988
Requests: 44 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FASTCash: How the Lazarus Group is Emptying Millions from ATMs | Broadcom Software Blogs

Page URL History Show full URLs

https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware HTTP 301
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware Page URL

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

47
Requests

91 %
HTTPS

78 %
IPv6

10
Domains

10
Subdomains

9
IPs

2
Countries

890 kB
Transfer

2563 kB
Size

4
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.broadcom.com/
Title: Broadcom Home

Search URL Search Domain Scan URL

URL: https://twitter.com/threatintel
Title: twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/broadcomsoftware
Title: linkedin

Search URL Search Domain Scan URL

URL: https://www.us-cert.gov/ncas/alerts/TA18-275A
Title: an alert was issued by US-CERT, the Department of Homeland Security, the Department of the Treasury, and the FBI

Search URL Search Domain Scan URL

URL: https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks
Title: US$81 million theft from the Bangladesh Central Bank

Search URL Search Domain Scan URL

URL: https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group
Title: WannaCry ransomware

Search URL Search Domain Scan URL

URL: https://www.symantec.com/security-center/writeup/2018-110615-2942-99
Title: Trojan.Fastcash

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation
Title: the 2014 attack on Sony Pictures

Search URL Search Domain Scan URL

URL: https://www.symantec.com/security_response/vulnerability.jsp?bid=96704
Title: CVE-2017-0144

Search URL Search Domain Scan URL

URL: https://www.symantec.com/security_response/vulnerability.jsp?bid=96705
Title: CVE-2017-0145

Search URL Search Domain Scan URL

URL: https://software.broadcom.com/

Search URL Search Domain Scan URL

URL: https://twitter.com/BroadcomSW
Title: twitter

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/company/legal/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/company/legal/cookie-policy
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/company/legal/ca/data-transfers
Title: Data Processing and Data Transfers

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/company/citizenship/supplier-responsibility
Title: Supplier Responsibility

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/company/legal/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.broadcom.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware HTTP 301
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

47 HTTP transactions
-3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request fastcash-lazarus-atm-malware Show response
symantec-enterprise-blogs.security.com/blogs/threat-intelligence/
Redirect Chain

https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

50 KB
12 KB

748ms
597ms

Document
text/html

2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74df1bd8fe9406caef5e6cf8fd664fa5c5492f0bea74d9ee01df5f810d2421b4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=60, s-maxage=600
cf-cache-status: MISS
cf-ray: 752f8d411b34917d-FRA
content-encoding: gzip
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
content-type: text/html; charset=utf-8
date: Fri, 30 Sep 2022 20:01:40 GMT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
via: 1.1 vegur
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

Redirect headers

cache-control: no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: MISS
cf-ray: 752f8d3b99b39013-FRA
content-security-policy: frame-ancestors 'self' esbroadcom.lookbookhq.com mfbroadcom.lookbookhq.com; script-src 'self' data: blob: https://script.crazyegg.com https://www.google-analytics.com https://www.googletagmanager.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://ajax.googleapis.com 'unsafe-eval' 'unsafe-inline'; object-src 'self';
content-type: text/html; charset=iso-8859-1
date: Fri, 30 Sep 2022 20:01:39 GMT
location: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: master-only
x-xss-protection: 1; mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/ 8 KB
3 KB 96ms
51ms Script
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/OtAutoBlock.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac23fb0eedc89c104a84c865f3ffbd038d200882939c8c1f84c56a8f378a2ee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: hNaCyNNlNv0G/Mz0IYSvJQ==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2562
x-ms-lease-status: unlocked
last-modified: Mon, 26 Sep 2022 17:52:49 GMT
server: cloudflare
etag: 0x8DA9FE7ED1C5E21
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: d9d5bab5-301e-0178-01f0-d1f604000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d452ac0bbaf-FRA
expires: Sat, 01 Oct 2022 00:01:40 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 70ms
25ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: zvDmpz9S9y5z1XhncmOZ/w==
age: 856
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Fri, 30 Sep 2022 15:54:02 GMT
server: cloudflare
etag: 0x8DAA2FBFF307DCE
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0f456457-501e-0163-1a00-d5d896000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d452ac4bbaf-FRA

GET
H2 200 v4.umd.js Show response
play.vidyard.com/embed/ 189 KB
49 KB 74ms
9ms Script
application/javascript 151.101.129.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/embed/v4.umd.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.181 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f92e7d66fc50d8bb33b74be2923dead81d990cb7b8c0c8b280bc2cb50f58bc60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-cache-hits: 2
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 1520900
x-cache: HIT
content-length: 49342
x-served-by: cache-hhn4070-HHN
x-china: 0
last-modified: Tue, 02 Aug 2022 19:57:00 GMT
etag: "f2216378d245bf02c53e1eba09654bf8"
vary: X-China, accept-language, Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 styles.c670739dc9fc3158.css
symantec-enterprise-blogs.security.com/blogs/ 206 KB
26 KB 33ms
33ms Stylesheet
text/css 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/styles.c670739dc9fc3158.css

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

908d688dd8c8ecb731c783c0ef1430b2e4c2e103d0231bcd9cfe87d5350f16bb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 80740
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"3386f-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 752f8d457cf5917d-FRA

GET
H2 200 logo.svg
symantec-enterprise-blogs.security.com/blogs/assets/ 6 KB
2 KB 42ms
36ms Image
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/logo.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bdd9ade4ab2de5d78f5502a865b4c00f5734fadc300c173c95a8eecafc09c34

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 29137
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"169f-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d458d2a917d-FRA

GET
H2 200 GettyImages-490662149.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_wide/public/2018-11/ 41 KB
41 KB 728ms
722ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_wide/public/2018-11/GettyImages-490662149.jpg.webp?h=f2fcf546&itok=MFVfWzuD

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b689289973cf517f6dce5f17fc6456fde31b85ecccd1321b66f272bfeb1976e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-b-5df5988684-ffpcw
date: Fri, 30 Sep 2022 20:01:41 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: MISS
x-content-type-options: nosniff
x-cache-hits: 0, 0
x-cache: MISS, MISS
content-length: 42180
x-served-by: cache-chi-kigq8000169-CHI, cache-fra19148-FRA
x-ua-compatible: IE=edge
last-modified: Fri, 30 Sep 2022 20:01:41 GMT
server: cloudflare
x-timer: S1664568101.801477,VS0,VE627
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: b31297fe-40fa-11ed-a02d-ea0fcf552db2
accept-ranges: bytes
cf-ray: 752f8d458d2e917d-FRA
expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H2 200 author-profile-default.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_avatar_small/public/2017-10/ 2 KB
3 KB 85ms
80ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_avatar_small/public/2017-10/author-profile-default.jpg.webp?h=6386ac74&itok=yMcB1DYB

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bea188790d2737ccb95bb0dd69e95196662ba7a2a4fcf799e590a7e0a5376223

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-b-549d4c4bf6-qprjb
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 80739
x-cache: HIT, HIT
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 2372
x-served-by: cache-chi-klot8100166-CHI, cache-fra19122-FRA
x-ua-compatible: IE=edge
last-modified: Wed, 28 Sep 2022 21:59:13 GMT
server: cloudflare
traceparent: 00-713b1a940eea4ae28df3f7e3af0d0c8f-c76ab5e126ca7e69-00
x-timer: S1664487361.970437,VS0,VE22
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
x-cloud-trace-context: 713b1a940eea4ae28df3f7e3af0d0c8f/14369497539702062697;o=0
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: c9a21c4f-3f78-11ed-836b-8e25dcc11f8e
accept-ranges: bytes
cf-ray: 752f8d458d34917d-FRA
x-cache-hits: 22, 1

GET
H2 200 FASTCash%20Infographic.png.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_medium/public/2018-11/ 43 KB
44 KB 206ms
201ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_inline_medium/public/2018-11/FASTCash%20Infographic.png.webp?itok=Q-7gXlqQ

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60b87927395b0bb1170c46bf4b3fd0c3a04f8db0a0b4e3a948ecdcb22c69939a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-a-f8f4f9674-8txtm
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: MISS
x-content-type-options: nosniff
x-cache-hits: 1, 0
x-cache: HIT, MISS
content-length: 44526
x-served-by: cache-chi-kigq8000130-CHI, cache-hhn4071-HHN
x-ua-compatible: IE=edge
last-modified: Fri, 30 Sep 2022 00:05:21 GMT
server: cloudflare
x-timer: S1664568101.795689,VS0,VE115
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 92b2ff71-4053-11ed-bd07-dadc5db6606d
accept-ranges: bytes
cf-ray: 752f8d458d37917d-FRA
expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H2 200 author-profile-default.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_bio_large/public/2017-10/ 12 KB
12 KB 96ms
91ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_author_bio_large/public/2017-10/author-profile-default.jpg.webp?h=6386ac74&itok=0czhl3gL

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6bc1f4dcf3134d9d3ff86b2a316339726a712d0c578cb51c212bd3c19e5717ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-b-5df5988684-28jw2
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 17557
x-cache: HIT, HIT
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 12160
x-served-by: cache-chi-klot8100042-CHI, cache-hhn4059-HHN
x-ua-compatible: IE=edge
last-modified: Thu, 29 Sep 2022 23:29:19 GMT
server: cloudflare
x-timer: S1664550544.547662,VS0,VE4
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 8a32f4d6-404e-11ed-8663-3a1bd1951768
accept-ranges: bytes
cf-ray: 752f8d458d3b917d-FRA
x-cache-hits: 17, 1

GET
H2 200 Hero-970293696.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/ 16 KB
16 KB 90ms
85ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/Hero-970293696.jpg.webp?h=efefeb1d&itok=KDtGW6PC

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fa21b31d8678f0a2e206b480f1ea7ddb9c785e81dc36ce33745f25a07e64acd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-b-5df5988684-tsrms
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 29137
x-cache: HIT, MISS
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 16508
x-served-by: cache-chi-klot8100133-CHI, cache-hhn4021-HHN
x-ua-compatible: IE=edge
last-modified: Thu, 29 Sep 2022 23:29:15 GMT
server: cloudflare
x-timer: S1664538963.285169,VS0,VE109
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 87fb7f5c-404e-11ed-805d-9a10c8582ea8
accept-ranges: bytes
cf-ray: 752f8d458d3f917d-FRA
x-cache-hits: 27, 0

GET
H2 200 Hero%20Image.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/ 7 KB
7 KB 81ms
76ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/Hero%20Image.jpg.webp?h=d87bb744&itok=IIoGnGvf

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19081598b0ed60c32f9e32d48df01abf64f554e50569e22361bb462b16b2ee70

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-a-f8f4f9674-rh99b
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 36324
x-cache: HIT, MISS
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 6712
x-served-by: cache-chi-klot8100099-CHI, cache-hhn4055-HHN
x-ua-compatible: IE=edge
last-modified: Thu, 29 Sep 2022 23:29:19 GMT
server: cloudflare
x-timer: S1664531776.186707,VS0,VE106
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 8a32c18b-404e-11ed-aa3d-d68897258385
accept-ranges: bytes
cf-ray: 752f8d458d41917d-FRA
x-cache-hits: 15, 0

GET
H2 200 Hero-1302370712.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/ 6 KB
7 KB 92ms
87ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/Hero-1302370712.jpg.webp?h=d0633ac3&itok=-f1_uXeX

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83f4e318c9ac2f121439a499a1177c9a7ee571e5a0e4ff08d4f6f08a6da08dca

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-a-f8f4f9674-bgh9x
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 78547
x-cache: HIT, MISS
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 6560
x-served-by: cache-chi-kigq8000072-CHI, cache-hhn4032-HHN
x-ua-compatible: IE=edge
last-modified: Thu, 29 Sep 2022 22:02:43 GMT
server: cloudflare
x-timer: S1664489554.680584,VS0,VE114
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 717155c7-4042-11ed-9d8d-46c7b24508b3
accept-ranges: bytes
cf-ray: 752f8d458d43917d-FRA
x-cache-hits: 1, 0

GET
H2 200 Hero-1340004005.jpg.webp
symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/ 15 KB
15 KB 85ms
81ms Image
image/webp 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/sites/default/files/styles/blogs_hero_related_large/public/2022-09/Hero-1340004005.jpg.webp?h=8e5eb850&itok=umoxcnSX

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e99c245d48645ebb9b5ebd5bb11c4374632136513c852be7653fc8e591b242b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-pantheon-styx-hostname: styx-fe4-a-f8f4f9674-bgh9x
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
x-content-type-options: nosniff
age: 36484
x-cache: HIT, MISS
expires: Sun, 19 Nov 1978 05:00:00 GMT
content-length: 15374
x-served-by: cache-chi-kigq8000096-CHI, cache-hhn4051-HHN
x-ua-compatible: IE=edge
last-modified: Thu, 29 Sep 2022 23:29:19 GMT
server: cloudflare
x-timer: S1664531616.896237,VS0,VE104
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-language: en
content-type: image/webp
x-generator: Drupal 9 (https://www.drupal.org)
cache-control: max-age=300, public, s-maxage=86400
permissions-policy: interest-cohort=()
x-styx-req-id: 8a325b2a-404e-11ed-9d8d-46c7b24508b3
accept-ranges: bytes
cf-ray: 752f8d45ad64917d-FRA
x-cache-hits: 17, 0

GET
H2 200 logo--white.svg
symantec-enterprise-blogs.security.com/blogs/assets/ 6 KB
2 KB 51ms
47ms Image
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/logo--white.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc3d601a30591a4b197d3a0cd419f76aea58728bdc00b27044e6510f3a76a126

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 30141
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"172e-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad66917d-FRA

GET
H2 200 runtime.f10c96d81f192a0d.js Show response
symantec-enterprise-blogs.security.com/blogs/ 3 KB
2 KB 82ms
77ms Script
application/javascript 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/runtime.f10c96d81f192a0d.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb530d7e15e8e07dad69e82e3a6e59c962448ac5f729b83e565ccfdf79135a52

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 80740
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"ae9-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 752f8d458d1f917d-FRA

GET
H2 200 polyfills.c12a23cb6bcac72a.js Show response
symantec-enterprise-blogs.security.com/blogs/ 33 KB
12 KB 48ms
42ms Script
application/javascript 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/polyfills.c12a23cb6bcac72a.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e7db1dad71488c49f9b8f5df2f6e27faeda7ed342098363dfe5f53e3c535360

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 27013
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"8524-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 752f8d458d25917d-FRA

GET
H2 200 main.cca082ca6e995b45.js Show response
symantec-enterprise-blogs.security.com/blogs/ 625 KB
177 KB 64ms
59ms Script
application/javascript 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/main.cca082ca6e995b45.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a5dadc72032046d7efc10e84eb4e06ba01241481a8c7ebfd3a3e7d5b5ce095

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 27013
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"9c245-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 752f8d458d27917d-FRA

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 111ms
73ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://symantec-enterprise-blogs.security.com/
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 752f8d45cf5d9a3b-FRA

GET
H2 200 301196e0-93ad-473e-a572-975514574496.json Show response
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/ 4 KB
2 KB 72ms
56ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/301196e0-93ad-473e-a572-975514574496.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d05fdec5a52ccdbb466e96e56aa14bb4ad592703be5ba50535d51d436c6b8fe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: sRwQ6CoccsGWNqeSed5w2w==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1631
x-ms-lease-status: unlocked
last-modified: Mon, 26 Sep 2022 17:52:48 GMT
server: cloudflare
etag: 0x8DA9FE7EC9EDB06
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: b2f2d629-c01e-0026-02e9-d14352000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d459df05c26-FRA
expires: Sat, 01 Oct 2022 00:01:40 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 260 KB
77 KB 156ms
70ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KF7XWD

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1f791c280f1075b8387cac0dc2ed314de8ab9eeb8ed31e22843915ed065bec9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78317
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 30 Sep 2022 20:01:40 GMT

GET
H2 200 search.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 407 B
348 B 46ms
43ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/search.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c7578ec4bd6ddc97e636b02d397febd16d62c90f78b4a079e3130bdfaf1b56b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 30141
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"197-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad68917d-FRA

GET
H2 200 home.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 688 B
458 B 51ms
48ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/home.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

989218038524b89a671418ec80d04d05a32cb1509b3f5f8319ff64edbc65aee3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 80739
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"2b0-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad6a917d-FRA

GET
H2 200 globe-americas.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 6 KB
2 KB 51ms
49ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/globe-americas.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09601846cbe98c0ac5eb5719ce6963659658be3bf77c137e1199b3a5b470fb63

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
content-encoding: gzip
age: 80738
via: 1.1 vegur
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"17f4-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad6b917d-FRA

GET
H2 200 envelope.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 673 B
470 B 75ms
73ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/envelope.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2af15a1d0d3b6b8d94d326ddbe90011782bd026fdb74a2b07084a2026d7fce55

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 29131
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"2a1-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad6c917d-FRA

GET
H2 200 twitter.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 801 B
514 B 46ms
44ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/twitter.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85f46b44e60238f84fcd1ed30fd4f148e7e14273218cc21d5622091bda78c57f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 80738
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"321-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad6f917d-FRA

GET
H2 200 linkedin.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 667 B
452 B 55ms
54ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/linkedin.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c0a420088eb412c91dedd16fb5ab91b814a8b944353712f945f8da3582501b0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 29131
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"29b-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad71917d-FRA

GET
H2 200 share-alt.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 550 B
376 B 45ms
45ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/share-alt.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d1a6cc41df47dd272cea8aa44fe0fd323f8b4b89481dedcc7cb7138b0c44c50

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 29131
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"226-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad72917d-FRA

GET
H2 200 compass.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 313 B
295 B 51ms
51ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/compass.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7698cd31eb0aee5d34361982a830b4851bb6e1487c1c25f67fd1ccc7449b5ad8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 29131
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"139-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad74917d-FRA

GET
H2 200 check.svg
symantec-enterprise-blogs.security.com/blogs/assets/icomoon/ 502 B
331 B 45ms
45ms Other
image/svg+xml 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/assets/icomoon/check.svg

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d64ec28ae2de31c9dfcc6d14b48a6070bdcf1eafcb05c151491bfc862264f610

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 29131
content-encoding: gzip
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:55 GMT
server: cloudflare
etag: W/"1f6-18380576638"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 752f8d45ad76917d-FRA

GET
H2 200 kznvvwk7m85s.js Show response
js.driftt.com/include/1664568300000/ 214 KB
61 KB 261ms
164ms Script
application/javascript 13.224.189.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1664568300000/kznvvwk7m85s.js

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-114.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

661a6f6c26cc9562b861410138395c6b98be3acea4a2074c8490a08e3181ac43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
x-amz-version-id: eY2gudRsNrtvMLrHx4.ph0iuVaGwESfJ
via: 1.1 b8682e9104d4ce1d04554da301dc9d64.cloudfront.net (CloudFront), 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-cf-pop: IAD55-P4, FRA2-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Thu, 29 Sep 2022 20:45:32 GMT
server: nginx
etag: W/"f93594f5e655033f5e01186385a1ab13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10
access-control-allow-credentials: true, true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type, DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Yy9Ksjz0Tee80KEd9ELYX5phjw48SsVDWK-T0QH_Ufxf8Iqo2fsfUg==

GET
H2 200 Gotham-Book_Web.c0be4f688bed0ce5.woff2
symantec-enterprise-blogs.security.com/blogs/ 41 KB
42 KB 60ms
58ms Font
font/woff2 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/Gotham-Book_Web.c0be4f688bed0ce5.woff2

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f51250e2d3ef478f59bc89cb67681b5ed423f8f8dc22062fb49e101e5032a2e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 44855
content-length: 41728
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"a300-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 752f8d45cdbc917d-FRA

GET
H2 200 Gotham-Medium_Web.b1fabe02e79b995a.woff2
symantec-enterprise-blogs.security.com/blogs/ 41 KB
41 KB 63ms
62ms Font
font/woff2 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/Gotham-Medium_Web.b1fabe02e79b995a.woff2

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba17f8257b1f710aa0e7136f4bd4b91a9a7db4f9cac2c409caf8708a64787303

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 27011
content-length: 41488
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"a210-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 752f8d45cdc2917d-FRA

GET
H2 200 Gotham-Bold_Web.4ba9de78728ce5f9.woff2
symantec-enterprise-blogs.security.com/blogs/ 38 KB
38 KB 42ms
41ms Font
font/woff2 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/blogs/Gotham-Bold_Web.4ba9de78728ce5f9.woff2

Requested by

Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

319881caca6f5f0d1e8e24040579d93386008e39dee1045965124b86303143e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Origin: https://symantec-enterprise-blogs.security.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cf-cache-status: HIT
via: 1.1 vegur
age: 47708
content-length: 39264
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 19:05:53 GMT
server: cloudflare
etag: W/"9960-18380575e68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 752f8d45cdc5917d-FRA

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 182 B
393 B 59ms
38ms XHR
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://symantec-enterprise-blogs.security.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 752f8d462ef55c26-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.39.0/ 372 KB
89 KB 21ms
21ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Zp/CcrZmK7hQ2S6c/t9Tpw==
age: 4076
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 90454
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:04 GMT
server: cloudflare
etag: 0x8DA87805EB35DE2
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a98cb099-e01e-0171-4a83-b9ec8a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d466d84bbaf-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/a8f0ba8f-9627-4385-b7af-d3d443ea5fb9/ 56 KB
14 KB 40ms
39ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/301196e0-93ad-473e-a572-975514574496/a8f0ba8f-9627-4385-b7af-d3d443ea5fb9/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4a3eaebb833b14c278bb2dbe0204adb4dd9596378e3408e6362b2d9bea57745

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: LLY+Wa64dIG/8tBCveoRcw==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13808
x-ms-lease-status: unlocked
last-modified: Mon, 26 Sep 2022 17:52:54 GMT
server: cloudflare
etag: 0x8DA9FE7F058EE33
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f31abc23-b01e-0162-7dee-d1d96b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d46bfe05c26-FRA
expires: Sat, 01 Oct 2022 00:01:40 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 13 KB
3 KB 43ms
42ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Xx897lTVYGjMQiwuGCrzDA==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:55 GMT
server: cloudflare
etag: 0x8DA87805972EF22
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: a5aee0b2-b01e-0169-1fe9-d1c11f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752f8d4708605c26-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 22 KB
5 KB 23ms
23ms Fetch
text/css 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 30 Sep 2022 20:01:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: B55i3ZY9miZIaUrwjufy0w==
age: 10181
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:09 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 9767d767-001e-0152-7ae9-d18341000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 752f8d4708635c26-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
67 KB 57ms
56ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7F7J5PJRQ5&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KF7XWD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b4f651a7d7379bc68141037ae47545792cce1e70989500813b6fc4a46c174425

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 68259
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 30 Sep 2022 20:01:41 GMT

GET
H2 200 2903.js Show response
script.crazyegg.com/pages/scripts/0020/ 6 KB
2 KB 93ms
26ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0020/2903.js?462380
Requested by: Host: symantec-enterprise-blogs.security.com
URL: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45b0ae173225fe05d8d3914b75f3570c2b833b66afdd3df1828d90eb6937283f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:41 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 23541
cf-polished: origSize=5675
ce-version: 11.4.10
cf-bgj: minify
last-modified: Fri, 30 Sep 2022 13:29:20 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 752f8d47aa1d9b63-FRA

GET truncated
/ 0
0

GET
H2 200 symantec-enterprise-blogs.security.com.json Show response
script.crazyegg.com/pages/data-scripts/0020/2903/site/ 232 B
478 B 69ms
42ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0020/2903/site/symantec-enterprise-blogs.security.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0020/2903.js?462380
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dd0a45d3fa54e59965df6f9c840725463aecac258c437741f9d6f4c762d8840

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://symantec-enterprise-blogs.security.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 30 Sep 2022 20:01:41 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 22892
ce-version: 11.4.10
content-length: 208
last-modified: Fri, 30 Sep 2022 13:40:09 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 752f8d480d556931-FRA

POST
H2 200 rum Show response
symantec-enterprise-blogs.security.com/cdn-cgi/ 0
215 B 29ms
29ms XHR
text/plain 2606:4700:10::6816:31d7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://symantec-enterprise-blogs.security.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:31d7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
content-type: application/json

Response headers

date: Fri, 30 Sep 2022 20:01:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://symantec-enterprise-blogs.security.com
content-type: text/plain
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 752f8d4a8858917d-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: truncated
URL: data:truncated

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.security.com/	1970-01-20 15:08:24	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Sep+30+2022+20%3A01%3A41+GMT%2B0000+(GMT)&version=6.39.0&isIABGlobal=false&hosts=&consentId=a01e643d-0ac6-49ed-9d80-36f9c6936a03&interactionCount=0&landingPath=https%3A%2F%2Fsymantec-enterprise-blogs.security.com%2Fblogs%2Fthreat-intelligence%2Ffastcash-lazarus-atm-malware&groups=1%3A1%2C3%3A1%2C2%3A0%2C4%3A0
.security.com/	1970-01-20 15:58:48	Name: _ga_7F7J5PJRQ5 Value: GS1.1.1664568101.1.0.1664568101.0.0.0
.security.com/	1970-01-20 15:58:48	Name: _ga Value: GA1.1.511946781.1664568101
symantec-enterprise-blogs.security.com/	1970-01-20 06:22:49	Name: drift_campaign_refresh Value: 55d943f4-ca28-4bd5-b62b-734f3e04ee81

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js(Line 6) Message: Refused to load the image 'data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IiB3aWR0aD0iMzQ4LjMzM3B4IiBoZWlnaHQ9IjM0OC4zMzNweCIgdmlld0JveD0iMCAwIDM0OC4zMzMgMzQ4LjMzNCIgc3R5bGU9ImVuYWJsZS1iYWNrZ3JvdW5kOm5ldyAwIDAgMzQ4LjMzMyAzNDguMzM0OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+PGc+PHBhdGggZmlsbD0iIzU2NTY1NiIgZD0iTTMzNi41NTksNjguNjExTDIzMS4wMTYsMTc0LjE2NWwxMDUuNTQzLDEwNS41NDljMTUuNjk5LDE1LjcwNSwxNS42OTksNDEuMTQ1LDAsNTYuODVjL...43NjlMMTc0LjE2NywyMzEuMDAzTDY4LjYwOSwzMzYuNTYzYy03Ljg0Myw3Ljg0NC0xOC4xMjgsMTEuNzY5LTI4LjQxNiwxMS43NjljLTEwLjI4NSwwLTIwLjU2My0zLjkxOS0yOC40MTMtMTEuNzY5Yy0xNS42OTktMTUuNjk4LTE1LjY5OS00MS4xMzksMC01Ni44NWwxMDUuNTQtMTA1LjU0OUwxMS43NzQsNjguNjExYy0xNS42OTktMTUuNjk5LTE1LjY5OS00MS4xNDUsMC01Ni44NDRjMTUuNjk2LTE1LjY4Nyw0MS4xMjctMTUuNjg3LDU2LjgyOSwwbDEwNS41NjMsMTA1LjU1NEwyNzkuNzIxLDExLjc2N2MxNS43MDUtMTUuNjg3LDQxLjEzOS0xNS42ODcsNTYuODMyLDBDMzUyLjI1OCwyNy40NjYsMzUyLjI1OCw1Mi45MTIsMzM2LjU1OSw2OC42MTF6Ii8+PC9nPjwvc3ZnPg==' because it violates the following Content Security Policy directive: "img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-7F7J5PJRQ5&l=dataLayer&cx=c(Line 49) Message: Refused to connect to 'https://region1.google-analytics.com/g/collect?v=2&tid=G-7F7J5PJRQ5&gtm=2oe9s0&_p=418373004&cid=511946781.1664568101&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=Q&_z=ccd.v9B&_s=1&dt=FASTCash%3A%20How%20the%20Lazarus%20Group%20is%20Emptying%20Millions%20from%20ATMs%20%7C%20Broadcom%20Software%20Blogs&dl=https%3A%2F%2Fsymantec-enterprise-blogs.security.com%2Fblogs%2Fthreat-intelligence%2Ffastcash-lazarus-atm-malware&sid=1664568101&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.hostname=symantec-enterprise-blogs.security.com&ep.page_path=%2Fblogs%2Fthreat-intelligence%2Ffastcash-lazarus-atm-malware&ep.content_group=blogs&ep.content_group_l1=blogs' because it violates the following Content Security Policy directive: "default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://js.driftt.com/ Message: Refused to frame 'https://rc-animation-feature.js.driftt.com/' because it violates the following Content Security Policy directive: "default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://js.driftt.com/ Message: Refused to frame 'https://rc-animation-feature.js.driftt.com/' because it violates the following Content Security Policy directive: "default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com privacyportal.onetrust.com script.crazyegg.com sed-cms.broadcom.com staging-symantec-enterprise-blogs.security.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com;img-src 'self' cdn.vidyard.com play.vidyard.com symantec-enterprise-blogs.security.com www.google-analytics.com i.ytimg.com;script-src 'self' cdn.cookielaw.org geolocation.onetrust.com js.driftt.com play.vidyard.com script.crazyegg.com static.cloudflareinsights.com www.google.com www.gstatic.com www.googletagmanager.com www.google-analytics.com www.youtube.com 'unsafe-inline' 'unsafe-eval';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';upgrade-insecure-requests;base-uri 'self';block-all-mixed-content;form-action 'self';frame-ancestors 'self';script-src-attr 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.cookielaw.org
geolocation.onetrust.com
js.driftt.com
play.vidyard.com
script.crazyegg.com
static.cloudflareinsights.com
symantec-enterprise-blogs.security.com
truncated
www.googletagmanager.com
www.symantec.com
truncated
13.224.189.114
151.101.129.181
2606:4700:10::6816:31d7
2606:4700:4400::6812:2962
2606:4700:440e::6812:2fe6
2606:4700::6810:9440
2606:4700::6812:59e
2606:4700::6813:9408
2a00:1450:4001:808::2008
09601846cbe98c0ac5eb5719ce6963659658be3bf77c137e1199b3a5b470fb63
0c0a420088eb412c91dedd16fb5ab91b814a8b944353712f945f8da3582501b0
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
19081598b0ed60c32f9e32d48df01abf64f554e50569e22361bb462b16b2ee70
2af15a1d0d3b6b8d94d326ddbe90011782bd026fdb74a2b07084a2026d7fce55
2bdd9ade4ab2de5d78f5502a865b4c00f5734fadc300c173c95a8eecafc09c34
2dd0a45d3fa54e59965df6f9c840725463aecac258c437741f9d6f4c762d8840
2fa21b31d8678f0a2e206b480f1ea7ddb9c785e81dc36ce33745f25a07e64acd
319881caca6f5f0d1e8e24040579d93386008e39dee1045965124b86303143e1
3c7578ec4bd6ddc97e636b02d397febd16d62c90f78b4a079e3130bdfaf1b56b
3f51250e2d3ef478f59bc89cb67681b5ed423f8f8dc22062fb49e101e5032a2e
45b0ae173225fe05d8d3914b75f3570c2b833b66afdd3df1828d90eb6937283f
5e7db1dad71488c49f9b8f5df2f6e27faeda7ed342098363dfe5f53e3c535360
60b87927395b0bb1170c46bf4b3fd0c3a04f8db0a0b4e3a948ecdcb22c69939a
661a6f6c26cc9562b861410138395c6b98be3acea4a2074c8490a08e3181ac43
6bc1f4dcf3134d9d3ff86b2a316339726a712d0c578cb51c212bd3c19e5717ed
74df1bd8fe9406caef5e6cf8fd664fa5c5492f0bea74d9ee01df5f810d2421b4
7698cd31eb0aee5d34361982a830b4851bb6e1487c1c25f67fd1ccc7449b5ad8
7b689289973cf517f6dce5f17fc6456fde31b85ecccd1321b66f272bfeb1976e
83f4e318c9ac2f121439a499a1177c9a7ee571e5a0e4ff08d4f6f08a6da08dca
85f46b44e60238f84fcd1ed30fd4f148e7e14273218cc21d5622091bda78c57f
8d1a6cc41df47dd272cea8aa44fe0fd323f8b4b89481dedcc7cb7138b0c44c50
908d688dd8c8ecb731c783c0ef1430b2e4c2e103d0231bcd9cfe87d5350f16bb
989218038524b89a671418ec80d04d05a32cb1509b3f5f8319ff64edbc65aee3
a0a5dadc72032046d7efc10e84eb4e06ba01241481a8c7ebfd3a3e7d5b5ce095
a1f791c280f1075b8387cac0dc2ed314de8ab9eeb8ed31e22843915ed065bec9
ac23fb0eedc89c104a84c865f3ffbd038d200882939c8c1f84c56a8f378a2ee0
b4f651a7d7379bc68141037ae47545792cce1e70989500813b6fc4a46c174425
ba17f8257b1f710aa0e7136f4bd4b91a9a7db4f9cac2c409caf8708a64787303
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bea188790d2737ccb95bb0dd69e95196662ba7a2a4fcf799e590a7e0a5376223
cb530d7e15e8e07dad69e82e3a6e59c962448ac5f729b83e565ccfdf79135a52
cc3d601a30591a4b197d3a0cd419f76aea58728bdc00b27044e6510f3a76a126
d05fdec5a52ccdbb466e96e56aa14bb4ad592703be5ba50535d51d436c6b8fe5
d64ec28ae2de31c9dfcc6d14b48a6070bdcf1eafcb05c151491bfc862264f610
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e99c245d48645ebb9b5ebd5bb11c4374632136513c852be7653fc8e591b242b9
f4a3eaebb833b14c278bb2dbe0204adb4dd9596378e3408e6362b2d9bea57745
f92e7d66fc50d8bb33b74be2923dead81d990cb7b8c0c8b280bc2cb50f58bc60
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

symantec-enterprise-blogs.security.com Open in urlscan Pro 2606:4700:10::6816:31d7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

47 Requests

91 %HTTPS

78 %IPv6

10 Domains

10 Subdomains

9 IPs

2 Countries

890 kBTransfer

2563 kBSize

4 Cookies

18 Outgoing links

Page URL History

Redirected requests

47 HTTP transactions Everything HTML Script AJAX CSS Image Expand all -3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

symantec-enterprise-blogs.security.com Open in urlscan Pro
2606:4700:10::6816:31d7 Public Scan

Screenshot
Live screenshot

Full Image

47
Requests

91 %
HTTPS

78 %
IPv6

10
Domains

10
Subdomains

9
IPs

2
Countries

890 kB
Transfer

2563 kB
Size

4
Cookies

47 HTTP transactions
-3 data transactions