URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flaw...
Submission: On August 06 via api from CH

Summary

This website contacted 54 IPs in 7 countries across 42 domains to perform 140 HTTP transactions. The main IP is 2.19.45.78, located in European Union and belongs to AKAMAI-ASN1, US. The main domain is blog.trendmicro.com.
TLS certificate: Issued by AffirmTrust Extended Validation CA - EV1 on January 22nd 2018. Valid for: 2 years.
This is the only time blog.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 35 2.19.45.78 20940 (AKAMAI-ASN1)
5 2600:9000:204... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
11 68.232.35.180 15133 (EDGECAST)
9 150.70.178.131 16880 (AS2-TREND...)
2 23.38.61.179 20940 (AKAMAI-ASN1)
5 159.122.87.153 36351 (SOFTLAYER)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.222.150.112 16509 (AMAZON-02)
1 2a04:4e42:400... 54113 (FASTLY)
1 3 199.255.34.6 36351 (SOFTLAYER)
2 151.101.12.134 54113 (FASTLY)
1 199.255.34.44 36351 (SOFTLAYER)
6 2a00:1450:400... 15169 (GOOGLE)
2 2.18.233.40 16625 (AKAMAI-AS)
2 104.111.242.254 16625 (AKAMAI-AS)
2 172.217.16.162 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 104.244.43.48 13414 (TWITTER)
1 199.15.212.64 53580 (MARKETO)
11 13 79.125.123.187 16509 (AMAZON-02)
1 159.122.87.148 36351 (SOFTLAYER)
1 104.244.42.197 13414 (TWITTER)
1 192.28.144.124 53580 (MARKETO)
2 2 172.217.22.98 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 216.58.214.38 15169 (GOOGLE)
6 2400:cb00:204... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
2 151.101.0.134 54113 (FASTLY)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2 52.29.18.226 16509 (AMAZON-02)
3 3 79.125.11.91 16509 (AMAZON-02)
1 2 2.18.234.21 16625 (AKAMAI-AS)
1 69.173.144.136 26667 (RUBICONPR...)
2 151.101.14.2 54113 (FASTLY)
1 185.64.189.110 62713 (AS-PUBMATIC)
1 2 52.28.98.115 16509 (AMAZON-02)
1 2a00:1288:110... 34010 (YAHOO-IRD)
1 2 18.153.11.3 16509 (AMAZON-02)
1 37.252.172.40 29990 (ASN-APPNEXUS)
2 2 54.88.87.248 14618 (AMAZON-AES)
1 107.178.254.65 15169 (GOOGLE)
1 2 173.241.240.143 36089 (OPENX-AS1)
1 34.199.1.144 14618 (AMAZON-AES)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
1 107.20.147.136 14618 (AMAZON-AES)
1 2a03:2880:f11... 32934 (FACEBOOK)
1 2600:9000:204... 16509 (AMAZON-02)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
2 52.18.183.216 16509 (AMAZON-02)
2 3 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2a05:f500:10:... 14413 (LINKEDIN)
1 104.244.42.131 13414 (TWITTER)
140 54
Apex Domain
Subdomains
Transfer
48 trendmicro.com
blog.trendmicro.com
www.trendmicro.com
documents.trendmicro.com
analytics.trendmicro.com
resources.trendmicro.com
990 KB
18 adroll.com
s.adroll.com
d.adroll.com
20 KB
11 tiqcdn.com
tags.tiqcdn.com
35 KB
9 shareaholic.com
apps.shareaholic.com
grace.shareaholic.com
analytics.shareaholic.com
partner.shareaholic.com
158 KB
8 google-analytics.com
ssl.google-analytics.com
www.google-analytics.com
34 KB
6 cloudflare.com
cdnjs.cloudflare.com
50 KB
6 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com
111 KB
5 viglink.com
cdn.viglink.com
api.viglink.com
29 KB
4 linkedin.com
px.ads.linkedin.com
www.linkedin.com
3 KB
4 doubleclick.net
googleads.g.doubleclick.net
5427711.fls.doubleclick.net
cm.g.doubleclick.net
2 KB
4 disqus.com
trendlabs.disqus.com
disqus.com
25 KB
3 disquscdn.com
c.disquscdn.com
191 KB
3 googleapis.com
fonts.googleapis.com
ajax.googleapis.com
75 KB
2 facebook.com
www.facebook.com
graph.facebook.com
1 KB
2 openx.net
us-u.openx.net
597 B
2 rlcdn.com
idsync.rlcdn.com
586 B
2 bidswitch.net
x.bidswitch.net
1 KB
2 3lift.com
eb2.3lift.com
973 B
2 casalemedia.com
dsum-sec.casalemedia.com
2 KB
2 advertising.com
pixel.advertising.com
646 B
2 facebook.net
connect.facebook.net
30 KB
2 googleadservices.com
www.googleadservices.com
8 KB
2 marketo.net
munchkin.marketo.net
6 KB
2 googletagmanager.com
www.googletagmanager.com
49 KB
2 coremetrics.com
libs.coremetrics.com
42 KB
1 twitter.com
analytics.twitter.com
253 B
1 gstatic.com
fonts.gstatic.com
9 KB
1 pippio.com
pippio.com
392 B
1 adnxs.com
ib.adnxs.com
592 B
1 yahoo.com
ads.yahoo.com
1 KB
1 taboola.com
trc.taboola.com
257 B
1 pubmatic.com
simage2.pubmatic.com
817 B
1 outbrain.com
sync.outbrain.com
18 B
1 rubiconproject.com
pixel.rubiconproject.com
371 B
1 google.de
www.google.de
107 B
1 google.com
www.google.com
667 B
1 mktoresp.com
945-cxd-062.mktoresp.com
272 B
1 t.co
t.co
170 B
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 bizographics.com
sjs.bizographics.com
4 KB
1 cmcore.com
data.cmcore.com
325 B
1 ravenjs.com
cdn.ravenjs.com
10 KB
140 42
Domain Requested by
34 blog.trendmicro.com 1 redirects blog.trendmicro.com
16 d.adroll.com 14 redirects s.adroll.com
blog.trendmicro.com
11 tags.tiqcdn.com blog.trendmicro.com
tags.tiqcdn.com
9 documents.trendmicro.com blog.trendmicro.com
6 cdnjs.cloudflare.com apps.shareaholic.com
6 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
blog.trendmicro.com
6 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
blog.trendmicro.com
dev.visualwebsiteoptimizer.com
6 apps.shareaholic.com blog.trendmicro.com
apps.shareaholic.com
3 px.ads.linkedin.com 2 redirects
3 cdn.viglink.com apps.shareaholic.com
blog.trendmicro.com
3 c.disquscdn.com trendlabs.disqus.com
3 analytics.trendmicro.com 1 redirects libs.coremetrics.com
blog.trendmicro.com
2 api.viglink.com cdn.viglink.com
2 us-u.openx.net 1 redirects blog.trendmicro.com
2 idsync.rlcdn.com 2 redirects
2 x.bidswitch.net 1 redirects blog.trendmicro.com
2 eb2.3lift.com 1 redirects blog.trendmicro.com
2 dsum-sec.casalemedia.com 1 redirects blog.trendmicro.com
2 pixel.advertising.com 1 redirects blog.trendmicro.com
2 connect.facebook.net s.adroll.com
connect.facebook.net
2 disqus.com trendlabs.disqus.com
2 ajax.googleapis.com apps.shareaholic.com
2 5427711.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.googleadservices.com tags.tiqcdn.com
www.googleadservices.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 s.adroll.com tags.tiqcdn.com
blog.trendmicro.com
2 trendlabs.disqus.com blog.trendmicro.com
2 ssl.google-analytics.com blog.trendmicro.com
2 www.googletagmanager.com blog.trendmicro.com
tags.tiqcdn.com
2 libs.coremetrics.com blog.trendmicro.com
libs.coremetrics.com
1 analytics.twitter.com static.ads-twitter.com
1 www.linkedin.com 1 redirects
1 fonts.gstatic.com blog.trendmicro.com
1 graph.facebook.com ajax.googleapis.com
1 www.facebook.com blog.trendmicro.com
1 partner.shareaholic.com apps.shareaholic.com
1 analytics.shareaholic.com cdn.ravenjs.com
1 cm.g.doubleclick.net 1 redirects
1 pippio.com blog.trendmicro.com
1 ib.adnxs.com blog.trendmicro.com
1 ads.yahoo.com blog.trendmicro.com
1 trc.taboola.com blog.trendmicro.com
1 simage2.pubmatic.com blog.trendmicro.com
1 sync.outbrain.com blog.trendmicro.com
1 pixel.rubiconproject.com blog.trendmicro.com
1 www.google.de blog.trendmicro.com
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 945-cxd-062.mktoresp.com munchkin.marketo.net
1 t.co blog.trendmicro.com
1 resources.trendmicro.com tags.tiqcdn.com
1 static.ads-twitter.com tags.tiqcdn.com
1 sjs.bizographics.com tags.tiqcdn.com
1 data.cmcore.com libs.coremetrics.com
1 cdn.ravenjs.com apps.shareaholic.com
1 grace.shareaholic.com apps.shareaholic.com
1 www.trendmicro.com blog.trendmicro.com
1 fonts.googleapis.com blog.trendmicro.com
140 58
Subject Issuer Validity Valid
www.trendmicro.com
AffirmTrust Extended Validation CA - EV1
2018-01-22 -
2020-01-23
2 years crt.sh
*.trendmicro.com
Trend Micro S2 CA
2016-10-05 -
2018-10-06
2 years crt.sh
analytics.trendmicro.com
AffirmTrust Certificate Authority - OV1
2017-05-05 -
2019-05-06
2 years crt.sh
resources.trendmicro.com
AffirmTrust Certificate Authority - OV1
2017-08-28 -
2019-08-29
2 years crt.sh
*.doubleclick.net
Google Internet Authority G3
2018-07-24 -
2018-10-02
2 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh

This page contains 4 frames:

Primary Page: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Frame ID: BEC7EB821511DE17411AD496B432ED75
Requests: 125 HTTP requests in this frame

Frame: https://cdn.ravenjs.com/3.15.0/raven.min.js
Frame ID: 779EB5B0C55A2D9FD96E75781645FF08
Requests: 14 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CIrJzOCJ2NwCFQWo7QodOvsDpw;src=5427711;type=remar0;cat=allsi0;ord=1;num=3709383216676;gtm=G7n;u1=%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F
Frame ID: 459ACBA73CB1BF7EEA94F03C2D837D08
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=trendlabs&t_i=82616%20https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2F%3Fp%3D82616&t_u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&t_e=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs&t_d=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs&t_t=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs&s_o=default
Frame ID: C3942BA3D361DCE8717D0755C6498BD3
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-foun... HTTP 301
    https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-foun... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast/i

Overall confidence: 100%
Detected patterns
  • env /^adroll_/i

Overall confidence: 100%
Detected patterns
  • env /^DISQUS/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i

Overall confidence: 100%
Detected patterns
  • script /munchkin\.marketo\.net\/munchkin\.js/i
  • env /^Munchkin$/i

Overall confidence: 100%
Detected patterns
  • env /^Modernizr$/i

Overall confidence: 100%
Detected patterns
  • script /^\/\/tags\.tiqcdn\.com\//i

Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i


Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

140
Requests

34 %
HTTPS

36 %
IPv6

42
Domains

58
Subdomains

54
IPs

7
Countries

1878 kB
Transfer

4430 kB
Size

22
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs HTTP 301
    https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://analytics.trendmicro.com/cm?ci=90369712&st=1533546460929&vn1=4.22.112&ec=utf-8&vn2=e4.0&pi=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&tid=6&cg=MalwareBlog-Post&rnd=1533547419443&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=July&pv_a7=2018 HTTP 302
  • https://analytics.trendmicro.com/cm?ci=90369712&st=1533546460929&vn1=4.22.112&ec=utf-8&vn2=e4.0&pi=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&tid=6&cg=MalwareBlog-Post&rnd=1533547419443&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=July&pv_a7=2018&cvdone=p
Request Chain 92
  • https://d.adroll.com/pixel/BWZHCVGVU5GGVN5IX5I7Y3/3CYSTYITOVHO5JLQ3WNZZE?pv=40553660768.398125&cookie=&adroll_s_ref=&keyw=&adroll_external_data=&arrfrr=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F HTTP 302
  • https://s.adroll.com/pixel/BWZHCVGVU5GGVN5IX5I7Y3/3CYSTYITOVHO5JLQ3WNZZE/UIGGQATVINGULPRORTYNDM.js
Request Chain 93
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1706283836&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/&tiba=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=3Q9oW5_YDO_TxgKmqbegAw&sscte=1&crd=CKrPGw&gtd= HTTP 302
  • https://www.google.com/ads/conversion/1015287688/?random=1706283836&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/&tiba=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CKrPGw&gtd=&cdct=2&is_vtc=1&ocp_id=3Q9oW5_YDO_TxgKmqbegAw&random=3911008289&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/ads/conversion/1015287688/?random=1706283836&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/&tiba=Spam%20Campaign%20Abusing%20SettingContent-ms%20Found%20Dropping%20Same%20FlawedAmmyy%20RAT%20Distributed%20by%20Necurs%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CKrPGw&gtd=&cdct=2&is_vtc=1&ocp_id=3Q9oW5_YDO_TxgKmqbegAw&random=3911008289&resp=GooglemKTybQhCsO&ipr=y&ulfeg=n
Request Chain 94
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=3709383216676;gtm=G7n;u1=%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F HTTP 302
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CIrJzOCJ2NwCFQWo7QodOvsDpw;src=5427711;type=remar0;cat=allsi0;ord=1;num=3709383216676;gtm=G7n;u1=%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F
Request Chain 105
  • https://d.adroll.com/cm/aol/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
Request Chain 106
  • https://d.adroll.com/cm/index/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&expiration=1565082461 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&expiration=1565082461&C=1
Request Chain 107
  • https://d.adroll.com/cm/n/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&expires=365
Request Chain 108
  • https://d.adroll.com/cm/outbrain/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://sync.outbrain.com/adroll/pixel?user_id=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM
Request Chain 109
  • https://d.adroll.com/cm/pubmatic/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 110
  • https://d.adroll.com/cm/taboola/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM
Request Chain 111
  • https://d.adroll.com/cm/triplelift/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&dongle=c85e HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM&dongle=c85e&gdpr=1&cmp_cs=
Request Chain 112
  • https://d.adroll.com/cm/r/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=https%3A%2F%2Fads.yahoo.com%2Fcms%2Fv1%3Fesig%3D1~bf4e7dc4546a90c08591652d78a230d3f2ef5733%26nwid%3D10001032567%26sigv%3D1%26gdpr%3D1%26gdpr_consent%3DBOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 113
  • https://d.adroll.com/cm/b/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM
Request Chain 114
  • https://d.adroll.com/cm/x/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid(%27NTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDM%27)
Request Chain 115
  • https://d.adroll.com/cm/l/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://idsync.rlcdn.com/377928.gif?partner_uid=569a61073bb4f5b4c53b6053dac2fad3 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CMiIFxIrCicIARDqIhogNTY5YTYxMDczYmI0ZjViNGM1M2I2MDUzZGFjMmZhZDMQABoNCN2foNsFEgUI6AcQAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&_=2
Request Chain 116
  • https://d.adroll.com/cm/o/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=569a61073bb4f5b4c53b6053dac2fad3 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=569a61073bb4f5b4c53b6053dac2fad3
Request Chain 117
  • https://d.adroll.com/cm/g/out?advertisable=BWZHCVGVU5GGVN5IX5I7Y3&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=VpphBzu09bTFO2BT2sL60w&google_ula=1535926 HTTP 302
  • https://d.adroll.com/cm/g/in?google_ula=1535926,0
Request Chain 137
  • https://px.ads.linkedin.com/collect/?time=1533546462545&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&pageUrl=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&ref=&fmt=js&s=1 HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1533546462545&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&pageUrl=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&ref=&fmt=js&s=1&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1533546462545%26pid%3D8866%26url%3Dhttps%253A%252F%252Fblog.trendmicro.com%252Ftrendlabs-security-intelligence%252Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%252F%26pageUrl%3Dhttps%253A%252F%252Fblog.trendmicro.com%252Ftrendlabs-security-intelligence%252Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%252F%26ref%3D%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1533546462545&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&pageUrl=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&ref=&fmt=js&s=1&cookiesTest=true&liSync=true

140 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Redirect Chain
  • https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs
  • https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
68 KB
17 KB
Document
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a88c272d2f2787d62e73622676ccc2b8c1ce1a93883da2582aa898c5dd243858
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Host
blog.trendmicro.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
BEC7EB821511DE17411AD496B432ED75

Response headers

Server
nginx
Content-Type
text/html; charset=UTF-8
Content-Length
16472
X-Pingback
https://blog.trendmicro.com/trendlabs-security-intelligence/xmlrpc.php
Link
<https://blog.trendmicro.com/trendlabs-security-intelligence/?p=82616>; rel=shortlink
Last-Modified
Mon, 06 Aug 2018 08:50:42 GMT
ETag
"37eb4920c59502cd01fa8fd292cebefb"
Content-Encoding
gzip
Vary
Accept-Encoding
Referrer-Policy
X-Cacheable
YES
X-Varnish
1702705067
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
X-XSS-Protection
1;mode=block
X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Connection
keep-alive

Redirect headers

Server
nginx
Content-Type
text/html; charset=UTF-8
Content-Length
20
Location
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Pragma
no-cache
X-UA-Compatible
IE=edge
X-Pingback
https://blog.trendmicro.com/trendlabs-security-intelligence/xmlrpc.php
Vary
Accept-Encoding
Content-Encoding
gzip
Referrer-Policy
X-Cacheable
YES
X-Varnish
1702710156
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
X-XSS-Protection
1;mode=block
X-Dispatcher
Yes
Cache-Control
max-age=1800
Date
Mon, 06 Aug 2018 09:07:40 GMT
Connection
keep-alive
Set-Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; path=/
shareaholic.js
apps.shareaholic.com/assets/pub/
5 KB
3 KB
Script
General
Full URL
https://apps.shareaholic.com/assets/pub/shareaholic.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
2600:9000:2047:e400:1f:3b15:e9c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
abf3b76c5e3abd5b20ed3b58701e381108ef22aed1affa0800f011eea4e34aae

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 05 Aug 2018 21:53:56 GMT
content-encoding
gzip
age
823
x-cache
Hit from cloudfront
status
200
x-hello-human
Join the fun! Apply at www.shareaholic.com/jobs
content-length
2301
access-control-allow-origin
*
last-modified
Thu, 02 Aug 2018 16:08:12 GMT
server
nginx
etag
"ab75d4e5ed06c1de61922e583f47ff4f"
content-type
application/javascript
via
1.1 ae3e6ab763f755c867a3b493d306312c.cloudfront.net (CloudFront)
cache-control
max-age=900, public
accept-ranges
bytes
x-amz-cf-id
p0YaxTmzTd62unYkWbGTmBxJ0EgZtpb2C7qAC9atysLR8NFOLy5YSA==
736df.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
72 KB
14 KB
Stylesheet
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/736df.css
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c47806865a12f433bb060346931b2d99e0714c71df8c82fc6492c641e71c4ff5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
13832
X-XSS-Protection
1;mode=block
Pragma
private
Referrer-Policy
Last-Modified
Thu, 28 Jun 2018 06:53:45 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
"pri1530168825;gz"
Vary
Accept-Encoding
X-Varnish
1534095503
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
text/css; charset=utf-8
dynamicCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/
16 KB
4 KB
Stylesheet
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ed8103aa39e3d6156b0fca9caf6fc88473686048f495b08df443a5995e4c33fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
3184
X-XSS-Protection
1;mode=block
Pragma
no-cache
Referrer-Policy
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
X-Varnish
1702705068 1702689686
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
text/css
X-Cache-Hits
6
responsiveCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/
21 KB
3 KB
Stylesheet
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/responsiveCss.php?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c005667a560305e72f76e6464a0cd95c7dbe9a35da6cffebe3617fbd1496faf7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
2860
X-XSS-Protection
1;mode=block
Pragma
no-cache
Referrer-Policy
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
X-Varnish
1702703341
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
text/css
customCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/
20 KB
5 KB
Stylesheet
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f42f57b06f18578b96493f434589a8e5f671d993b05f2b832d79775e41de77f1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
4498
X-XSS-Protection
1;mode=block
Pragma
no-cache
Referrer-Policy
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
X-Varnish
1702704882
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
text/css
css
fonts.googleapis.com/
10 KB
946 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C700italic%2C400%2C700&ver=2.3.1
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
2a00:1450:4001:81c::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3e80336866d121116d015d8762f3ffd3bb19244ea1485c8f832a2e41081b3458
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=3600
content-encoding
gzip
last-modified
Mon, 06 Aug 2018 09:07:40 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 06 Aug 2018 09:07:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Mon, 06 Aug 2018 09:07:40 GMT
9afdd.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
153 KB
51 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/9afdd.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7d99a3560e8efac252642b1b020762fa02d1f88c1585e3610c69247ab64dbce4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
52042
X-XSS-Protection
1;mode=block
Pragma
private
Last-Modified
Mon, 27 Jun 2016 11:01:49 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
"pri1467025309;gz"
Vary
Accept-Encoding
X-Varnish
741394026 741391302
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
application/x-javascript; charset=utf-8
X-Cache-Hits
5
customJs.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/
399 B
716 B
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/customJs.php?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
aa16d08aa19b9af5effe3381d0ba38f1a675c362bd62b2db8d012d35e3db3510
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
252
X-XSS-Protection
1;mode=block
Pragma
no-cache
Referrer-Policy
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
X-Varnish
1702703306
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
text/javascript
8034a.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
57 KB
17 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/8034a.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f31223c8c38dbb3cd9b89eb86448f41eb7c85c7d6fd9cb05f75a55546a4847f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
16428
X-XSS-Protection
1;mode=block
Pragma
private
Referrer-Policy
Last-Modified
Mon, 09 Jul 2018 10:22:35 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
"pri1531131755;gz"
Vary
Accept-Encoding
X-Varnish
1537469626 1537457521
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
application/x-javascript; charset=utf-8
X-Cache-Hits
8
7f1ef.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
29 KB
11 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/7f1ef.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ff56698b538a4346f6ceb7d6cdf235af44660f43e8226390fda97ebf9e50a38a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blog.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher
Yes
Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Cacheable
YES
Connection
keep-alive
Content-Length
10751
X-XSS-Protection
1;mode=block
Pragma
private
Referrer-Policy
Last-Modified
Thu, 28 Jun 2018 06:53:45 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN
ETag
"pri1530168825;gz"
Vary
Accept-Encoding
X-Varnish
1417394547 1417391993
Cache-Control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Content-Type
application/x-javascript; charset=utf-8
X-Cache-Hits
4
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabu/prod/
1 KB
789 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.sync.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/418A) /
Resource Hash
01049f44dfad6131e5c937e4e1dfc999d3a4fdc363d85cec9813151c414e97af

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
last-modified
Thu, 12 Jul 2018 15:56:23 GMT
server
ECS (fcn/418A)
etag
"2505529342+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
668
expires
Mon, 06 Aug 2018 09:12:40 GMT
ransomware-solutions-blog-template-style.css
www.trendmicro.com/vinfo/cloudlink/styles/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/vinfo/cloudlink/styles/ransomware-solutions-blog-template-style.css
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b6a8ba260c8eb344ad40fadccadc8dd6752ed67318153676309febd6d83eb34
Security Headers
Name Value
Strict-Transport-Security max-age=86400; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/vinfo/cloudlink/styles/ransomware-solutions-blog-template-style.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=86400; preload
content-encoding
gzip
x-content-type-options
nosniff
status
200
x-prod-n-01
Yes
content-length
1061
x-xss-protection
1;mode=block
last-modified
Wed, 27 Jul 2016 05:50:13 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 06 Aug 2018 09:07:40 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=631
etag
W/"4cb788becae7d11:0"
expires
Mon, 06 Aug 2018 09:18:11 GMT
twitter.jpg
documents.trendmicro.com/images/TEx/blogicons/
2 KB
2 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/twitter.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
d1695d8985b2411104b59085fcf35de39255e29ea68064e26bd3fb67116bbe42

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:26 GMT
Last-Modified
Wed, 26 Aug 2015 09:47:39 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"eea373fe4dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
2201
fb.jpg
documents.trendmicro.com/images/TEx/blogicons/
2 KB
2 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/fb.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
be23dbb4ef534fb2fbdf640c70e9ebce16ddd32eff4235784b99bbed85696cf6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Wed, 26 Aug 2015 09:47:44 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"fe5bc941e4dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
2257
in.jpg
documents.trendmicro.com/images/TEx/blogicons/
2 KB
3 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/in.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
5e62e5f7ea3ee74d6430ce302b0c61d95e93d43a80a449447c64ba791065202c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:26 GMT
Last-Modified
Wed, 26 Aug 2015 09:47:51 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"64623f46e4dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
2416
youtube.jpg
documents.trendmicro.com/images/TEx/blogicons/
2 KB
2 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/youtube.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
90b34033918608d698be777640ea1c2a7e33e64229e10ae75cde40b8f4ac1ded

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Wed, 26 Aug 2015 09:48:00 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"3ef9f4be4dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
2171
rss.jpg
documents.trendmicro.com/images/TEx/blogicons/
2 KB
2 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/rss.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
1bc4f47bd64d3c1a5f131b2241ac870c4a497a59237b3187d35eeff93ccba167

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Wed, 26 Aug 2015 09:49:07 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"849f1973e4dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
2258
2015blog-Logo-Final.jpg
documents.trendmicro.com/images/TEx/blogs/
37 KB
37 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogs/2015blog-Logo-Final.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
7ce4ffee757b6ef1868f0d3909cebb6b3366f6e1bcb2e55dd9c512a3290a309c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:26 GMT
Last-Modified
Wed, 26 Aug 2015 09:44:25 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"d011ffcae3dfd01:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
37980
cyberrime-200x200.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/06/
8 KB
8 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/06/cyberrime-200x200.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
581312ca6d9c082974a4c947818ce717894f2d77a91e1a0797d07df62962794a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/06/cyberrime-200x200.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Thu, 14 Jun 2018 05:03:53 GMT
server
nginx
x-cacheable
YES
etag
"14f99214c2d0df8ad129c944e3a1f80c"
x-frame-options
SAMEORIGIN
x-varnish
1702710160
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
7780
x-xss-protection
1;mode=block
Figure-1-Spam-SettingContentms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
46 KB
47 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-1-Spam-SettingContentms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8d3d263738afa56d94fc9089a1f5160aeb3ec5078c3367b09760635ddb0f5bcd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-1-Spam-SettingContentms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:25 GMT
server
nginx
x-cacheable
YES
etag
"bfded346ae3696bf4f16f77eac0fc31b"
x-frame-options
SAMEORIGIN
x-varnish
1702710159
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
47218
x-xss-protection
1;mode=block
Spam-Campaign-Abuses-Infection-Chain-01.2.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
176 KB
177 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Spam-Campaign-Abuses-Infection-Chain-01.2.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e9a94a22c17334d589513da30e63fcf59092e5ec0383cc9058aec4e65602462a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Spam-Campaign-Abuses-Infection-Chain-01.2.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 08:14:51 GMT
server
nginx
x-cacheable
YES
etag
"5bb276db8afd83aec3ad689f15aee777"
x-frame-options
SAMEORIGIN
x-varnish
1702710161
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
180263
x-xss-protection
1;mode=block
Figure-3.1-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
34 KB
35 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-3.1-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
167784888d8baaef6d71c3e30c347c217ebe2c2d41eb576bbe0425b8f928e278
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-3.1-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:42:52 GMT
server
nginx
x-cacheable
YES
etag
"32a193e68ab3aa5512c22beaf50fe312"
x-frame-options
SAMEORIGIN
x-varnish
1702710162
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
34966
x-xss-protection
1;mode=block
Figure-4-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
30 KB
30 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-4-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c4b728902d20a7fd512df6440e2358bc306be4c6844ae373cc8045d4b7bfa130
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-4-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:31 GMT
server
nginx
x-cacheable
YES
etag
"0438e86395aa7f43b0f3179cdfad0589"
x-frame-options
SAMEORIGIN
x-varnish
1702710164
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
30840
x-xss-protection
1;mode=block
Figure-5-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
82 KB
82 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-5-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
25629d41a6b6990bea2306f39b48c4091acff144051622ae6f8aec22ca483027
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-5-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:33 GMT
server
nginx
x-cacheable
YES
etag
"14775a93c025ebf86a5b8fa30e36ea95"
x-frame-options
SAMEORIGIN
x-varnish
1702710165
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
83788
x-xss-protection
1;mode=block
Figure-6-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
17 KB
18 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-6-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
961517e0c7dcad7b061005fb13f4b06f9565d55463efc5d9dee0f07246b76db9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-6-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:35 GMT
server
nginx
x-cacheable
YES
etag
"b741ceb486b7df6d138874ed6e9789db"
x-frame-options
SAMEORIGIN
x-varnish
1702710167
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
17840
x-xss-protection
1;mode=block
Figure-7-settingcontent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
74 KB
75 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-7-settingcontent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b28e06ad856a5dd6d33e2b8d663a9a96d6beaa200e308f72529f76a31389359f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-7-settingcontent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:37 GMT
server
nginx
x-cacheable
YES
etag
"90469aa78af86fd328b121b306216218"
x-frame-options
SAMEORIGIN
x-varnish
1702710168
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
75894
x-xss-protection
1;mode=block
Figure-8-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
56 KB
56 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-8-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c843b80b25df9069eed87a219d20803cc0c6da415ad6bebcd39332ef24e310bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-8-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:39 GMT
server
nginx
x-cacheable
YES
etag
"f5e7a6443509d7ad06b3aabcad67b9c6"
x-frame-options
SAMEORIGIN
x-varnish
1702710170
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
57359
x-xss-protection
1;mode=block
Figure-9-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
20 KB
20 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-9-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
16a82567230efbeb53a73a22dd2857865c8813accb43bb35bf9baa3996fdb0f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-9-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:41 GMT
server
nginx
x-cacheable
YES
etag
"e30c7e7eb12a6ef4cbf9eb38b0f26304"
x-frame-options
SAMEORIGIN
x-varnish
1702710171
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
20148
x-xss-protection
1;mode=block
Figure-10-SettingContent-ms.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/
13 KB
13 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/07/Figure-10-SettingContent-ms.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
041973ac2e7a5f605760097f73508ba3ac2fb1fcc2d4d66f171b0525c5ac7d08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2018/07/Figure-10-SettingContent-ms.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
referrer-policy
last-modified
Tue, 31 Jul 2018 06:20:43 GMT
server
nginx
x-cacheable
YES
etag
"4c92ee28991a1b304c104f7ddb0f9eae"
x-frame-options
SAMEORIGIN
x-varnish
1702710174
status
200
x-content-type-options
nosniff
content-type
image/jpeg
vary
Accept-Encoding
content-length
13257
x-xss-protection
1;mode=block
say-no-to-ransomware.jpg
documents.trendmicro.com/images/TEx/articles/
46 KB
46 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/articles/say-no-to-ransomware.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
e3ac5c56d0c3a6005ee7a9226a3470acd9acbfa64244cddabb899140c8a8f5d4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Cookie
utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Thu, 19 May 2016 08:03:54 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"43faf2fca4b1d11:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
47342
eluminate.js
libs.coremetrics.com/
152 KB
42 KB
Script
General
Full URL
https://libs.coremetrics.com/eluminate.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Server
23.38.61.179 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-61-179.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
61ccf8761247ce87c2f0f4559d67aa8153b9e7d4bffac9f9f69914b2fbb1aeb5

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:40 GMT
Content-Encoding
gzip
Last-Modified
Thu, 26 Jul 2018 16:19:07 GMT
Server
Apache
ETag
"fcec987e3d7bf4a2ac9271ade56cc22d:1532621947"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42543
f8767.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
708 B
777 B
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/f8767.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/cache/minify/2/f8767.js
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cacheable
YES
status
200
content-length
401
x-xss-protection
1;mode=block
pragma
private
referrer-policy
last-modified
Tue, 29 May 2018 09:00:53 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"pri1527584453;gz"
vary
Accept-Encoding
x-varnish
2043638983 2043636246
cache-control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-type
application/x-javascript; charset=utf-8
x-cache-hits
1
d0bd8.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/
3 KB
1 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/d0bd8.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6f7728d559bb20cab4a7b74f30da3e046f2aacfa4074fa7b875d90bc92b4321c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/cache/minify/2/d0bd8.js
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cacheable
YES
status
200
content-length
1152
x-xss-protection
1;mode=block
pragma
private
referrer-policy
last-modified
Tue, 29 May 2018 09:00:53 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"pri1527584453;gz"
vary
Accept-Encoding
x-varnish
524122236
cache-control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-type
application/x-javascript; charset=utf-8
twemoji.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/
25 KB
8 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/twemoji.js?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
464db2eecec0133fa595131850ae7478d8bc7359a5299a59985f1a42e389f187
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-includes/js/twemoji.js?ver=4.9.7
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cacheable
YES
status
200
content-length
7476
x-xss-protection
1;mode=block
referrer-policy
last-modified
Thu, 08 Feb 2018 06:18:42 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"6394-564ad622dad6d"
vary
Accept-Encoding
x-varnish
1537234676
cache-control
max-age=20583
content-type
application/x-javascript
wp-emoji.js
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/
7 KB
3 KB
Script
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/wp-emoji.js?ver=4.9.7
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d80a9fbd9c4a76d5d7c6b14e635088b322863f7a78f61508df1e77342669e0ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-includes/js/wp-emoji.js?ver=4.9.7
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cacheable
YES
status
200
content-length
2634
x-xss-protection
1;mode=block
referrer-policy
last-modified
Mon, 29 Aug 2016 14:33:13 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"1a68-53b36be758372"
vary
Accept-Encoding
x-varnish
1537234671
cache-control
max-age=20574
content-type
application/x-javascript
/
blog.trendmicro.com/trendlabs-security-intelligence/wp-json/wordpress-popular-posts/v1/popular-posts/
118 B
660 B
XHR
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-json/wordpress-popular-posts/v1/popular-posts/
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/7f1ef.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ed6a7c7c15db91f2b6ffbaec4ccb7be48bd7853833e3e3e642ccf701fa90f3de
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/trendlabs-security-intelligence/wp-json/wordpress-popular-posts/v1/popular-posts/
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
origin
https://blog.trendmicro.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
content-length
103
:method
POST
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Origin
https://blog.trendmicro.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 06 Aug 2018 09:07:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cacheable
YES
status
401
content-length
124
pragma
no-cache
access-control-allow-headers
Authorization, Content-Type
referrer-policy
server
nginx
x-robots-tag
noindex
vary
Origin,Accept-Encoding
access-control-allow-methods
OPTIONS, GET, POST, PUT, PATCH, DELETE
x-varnish
1702710158
access-control-allow-origin
https://blog.trendmicro.com
access-control-expose-headers
X-WP-Total, X-WP-TotalPages
cache-control
no-cache, no-store, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
link
<https://blog.trendmicro.com/trendlabs-security-intelligence/wp-json/>; rel="https://api.w.org/"
j.php
dev.visualwebsiteoptimizer.com/
2 KB
1 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Fspam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs%2F&r=0.0026452665279681487
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.sync.js
Protocol
SPDY
Server
159.122.87.153 Frankfurt, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
99.57.7a9f.ip4.static.sl-reverse.com
Software
dacdn2 /
Resource Hash
c0ed6259414f8e50f4226e394bc1165b76433fad450370822174304123f5884c

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
server
dacdn2
content-type
application/javascript; charset=UTF-8
gtm.js
www.googletagmanager.com/
69 KB
24 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T8DW3SL
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
2a00:1450:4001:810::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
ed253abef96320988137a9b3b3c7ef952a7fa7f6ed2b3985a2c20949925c01fa
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
24090
x-xss-protection
1; mode=block
expires
Mon, 06 Aug 2018 09:07:40 GMT
mailIcon.png
documents.trendmicro.com/images/TEx/blogicons/
3 KB
3 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/blogicons/mailIcon.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
17dbeff08f1c2770ec37f9edf909627395215a93ac4d8c0307eaac9a4cab49b8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
Cookie
utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Wed, 26 Aug 2015 09:50:58 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"6829cdb5e4dfd01:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
2651
sidebar-business-process-co.jpg
documents.trendmicro.com/images/TEx/articles/
45 KB
46 KB
Image
General
Full URL
https://documents.trendmicro.com/images/TEx/articles/sidebar-business-process-co.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_CBC
Server
150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS
sjc1-te-ftp.trendmicro.com
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
f368605bd5e23568ed3e0568d70b9b1d039b82059e5e199335d059c4e400bee4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
documents.trendmicro.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 Aug 2018 09:07:41 GMT
Last-Modified
Wed, 03 May 2017 08:32:09 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"475b79c1e7c3d21:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
46571
bnr_sidebar.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2017/12/
67 KB
67 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/12/bnr_sidebar.jpg
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c116b499e17c809b5a028450ca3a7e9cdb20f18e6fcf7fa5fe83d758a4431530
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/files/2017/12/bnr_sidebar.jpg
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Dec 2017 02:04:56 GMT
server
nginx
x-cacheable
YES
etag
"14f75e1b9b7616e8ddcee6e7f7750c54"
x-frame-options
SAMEORIGIN
x-varnish
99116008
status
200
content-type
image/jpeg
content-length
68344
x-xss-protection
1;mode=block
postBubbles.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/
1 KB
2 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/postBubbles.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
005929580da46135c58cae0cbfcccd17e510aac10a27a3e674fb85ae4bee95c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/postBubbles.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5; __utma=247958868.925189980.1533546461.1533546461.1533546461.1; __utmc=247958868; __utmz=247958868.1533546461.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=247958868.1.10.1533546461; cmTPSet=Y; utag_main=v_id:01650e7df73f0000b609963cd0d000078009d07000b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1533548260991$ses_id:1533546460991%3Bexp-session; _vwo_uuid_v2=DB2D61BA6930921D19D01DB3800965743|51881354cf14dd98286a7d71f3c5c907; _vis_opt_s=1%7C; _vis_opt_test_cookie=1; _ga=GA1.2.925189980.1533546461; _gid=GA1.2.1427372149.1533546461; _gat_UA-137644-6=1; _vwo_uuid=DB2D61BA6930921D19D01DB3800965743; _vwo_ds=3%3Aa_0%2Ct_0%3A0%241533546460%3A81.76694908%3A%3A%3A69_0; _mkto_trk=id:945-CXD-062&token:_mch-trendmicro.com-1533546461239-65832; __ar_v4=%7CBWZHCVGVU5GGVN5IX5I7Y3%3A20180805%3A1%7C3CYSTYITOVHO5JLQ3WNZZE%3A20180805%3A1%7CUIGGQATVINGULPRORTYNDM%3A20180805%3A1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2015 21:21:34 GMT
server
nginx
x-cacheable
YES
etag
"421b7-587-5205c9523db98"
x-frame-options
SAMEORIGIN
x-varnish
99103211 99099448
status
200
content-type
image/png
content-length
1415
x-xss-protection
1;mode=block
x-cache-hits
1
searchBg.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/
1 KB
1 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBg.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
746908a1b935d3ca0005ab17e8504e642f42cf3ce177dac795d898f5637dc0cb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBg.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2015 21:21:34 GMT
server
nginx
x-cacheable
YES
etag
"4ba-5205c95241248"
x-frame-options
SAMEORIGIN
x-varnish
741481725 741476914
status
200
cache-control
max-age=12100
content-type
image/png
content-length
1210
x-xss-protection
1;mode=block
x-cache-hits
3
searchSubmit.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/
2 KB
2 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchSubmit.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5f9eba6b4a09e7bbdfb3e9f52cc59625bb0a26854804928ffdf03c5ac2ad7d1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchSubmit.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2015 21:21:34 GMT
server
nginx
x-cacheable
YES
etag
"421ce-618-5205c95241248"
x-frame-options
SAMEORIGIN
x-varnish
741069739
status
200
content-type
image/png
content-length
1560
x-xss-protection
1;mode=block
searchBgHover.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/
2 KB
2 KB
Image
General
Full URL
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBgHover.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7d902673f947b5f070302fb19d049ed9d81694895de23552603e2da56782466b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBgHover.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2015 21:21:34 GMT
server
nginx
x-cacheable
YES
etag
"795-5205c9523d7b0"
x-frame-options
SAMEORIGIN
x-varnish
741479771 741476913
status
200
cache-control
max-age=40367
content-type
image/png
content-length
1941
x-xss-protection
1;mode=block
x-cache-hits
1
darkSeperator.png
blog.trendmicro.com/wp-content/themes/inspiredTrendLabs/images/
929 B
1 KB
Image
General
Full URL
https://blog.trendmicro.com/wp-content/themes/inspiredTrendLabs/images/darkSeperator.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ec8ada9c249466cc83ead6cfea75ba0851281bb5a850b2009034d993e6449715
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/wp-content/themes/inspiredTrendLabs/images/darkSeperator.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/736df.css
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/cache/minify/2/736df.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2015 21:21:34 GMT
server
nginx
x-cacheable
YES
etag
"3a1-5205c951a7d28"
x-frame-options
SAMEORIGIN
x-varnish
741394035 741391317
status
200
cache-control
max-age=70246
content-type
image/png
content-length
929
x-xss-protection
1;mode=block
x-cache-hits
5
stripe_2e31600cd015b400066a279bc8148c33.png
blog.trendmicro.com/wp-content/uploads/2013/07/
93 B
334 B
Image
General
Full URL
https://blog.trendmicro.com/wp-content/uploads/2013/07/stripe_2e31600cd015b400066a279bc8148c33.png
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
670d2452df4e20e6a2371d8a48fbe1bde1e4664081f1f20b478095d0b14d8685
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/wp-content/uploads/2013/07/stripe_2e31600cd015b400066a279bc8148c33.png
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
:scheme
https
:method
GET
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:40 GMT
x-content-type-options
nosniff
last-modified
Wed, 17 Jul 2013 19:56:49 GMT
server
nginx
x-cacheable
YES
etag
"e0244-5d-4e1ba7e7dd53a"
x-frame-options
SAMEORIGIN
x-varnish
99121160
status
200
content-type
image/png
content-length
93
x-xss-protection
1;mode=block
e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
blog.trendmicro.com/font/Interstate-Light/
68 KB
69 KB
Font
General
Full URL
https://blog.trendmicro.com/font/Interstate-Light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.45.78 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-45-78.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:path
/font/Interstate-Light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
pragma
no-cache
cookie
PHPSESSID=vivlrje5n6ged7bokvekv2osi5
origin
https://blog.trendmicro.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
blog.trendmicro.com
referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=4.9.7
Origin
https://blog.trendmicro.com

Response headers

x-dispatcher
Yes
date
Mon, 06 Aug 2018 09:07:41 GMT
x-content-type-options
nosniff
x-cacheable
YES
status
200
content-length
69724
x-xss-protection
1;mode=block
referrer-policy
server
nginx
x-frame-options
SAMEORIGIN
etag
"1105c-5035bb4d02380"
vary
Accept-Encoding
x-varnish
1702710163
cache-control
max-age=1800
accept-ranges
bytes
content-type
application/font-woff
utag.js
tags.tiqcdn.com/utag/trendmicro/nabu/prod/
72 KB
19 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E5) /
Resource Hash
e5b7fc351817a8d27486de06523a6549ab8db08c74ce5c82907284d8e0fa66ca

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 Aug 2018 09:07:40 GMT
content-encoding
gzip
last-modified
Thu, 12 Jul 2018 15:56:23 GMT
server
ECS (fcn/40E5)
etag
"1584181142"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19600
expires
Mon, 06 Aug 2018 09:12:40 GMT
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
Protocol
SPDY
Server
2a00:1450:4001:825::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abusing-settingcontent-ms-found-dropping-same-flawedammy-rat-distributed-by-necurs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 May 2018 01:10:24 GMT
server
Golfe2
age
3379
date
Mon, 06 Aug 2018 08:11:21 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
17168
expires
Mon, 06 Aug 2018 10:11:21 GMT
f9f1a771608a24e84c49a8532e282dc1.json
grace.shareaholic.com/
12 KB
2 KB
XHR