www.trustwave.com Open in urlscan Pro
52.151.96.240  Public Scan

19 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

• https://www.trustwave.com/media/16657/gartner-mdr-cover.png?anchor=center&mode=crop&width=400&rnd=132308413190000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/3/b/7/b/a/6/3b7ba697d08de6c964b83f21b9a1a75ed153fd24.png

Request Chain 30

• https://www.trustwave.com/media/15951/database-security-in-the-cloud-cover.png?anchor=center&mode=crop&width=400&rnd=132007852950000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png

Request Chain 31

• https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png

Request Chain 32

• https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png

Request Chain 33

• https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png

Request Chain 34

• https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg

Request Chain 35

• https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg

Request Chain 36

• https://www.trustwave.com/media/16906/oft-mw-blog-header.jpg?anchor=center&mode=crop&width=400&rnd=132375042260000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/8/c/8/e/2/2/8c8e22116e1d86cb5ebbba6cf7dc44783fccf2e3.jpg

Request Chain 37

• https://www.trustwave.com/media/16896/the-golden-tax-department-and-emergence-of-goldenspy-malware.png?anchor=center&mode=crop&width=400&rnd=132374852340000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/c/b/3/c/5/9/cb3c59f253fc3da25984e875b59fa429c61a9aed.png

Request Chain 38

• https://www.trustwave.com/media/16694/adp-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315344100000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/d/8/1/1/e/c/d811ec63c804742ec35245598815fd42261061c5.png

Request Chain 39

• https://www.trustwave.com/media/16700/seg-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315350400000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/d/5/7/6/f/7/d576f70ba0a48444245aa3f69374a93c1e40bf5e.png

Request Chain 40

• https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000 HTTP 302
• https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg

Request Chain 64

• https://www.vimeo.com/api/oembed.json?url=https://vimeo.com/432221087&callback=vimeoCallback HTTP 301
• https://vimeo.com/api/oembed.json?callback=vimeoCallback&url=https://vimeo.com/432221087

Request Chain 71

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&time=1593100263674 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fblogs%252Fspiderlabs-blog%252Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%252F%26time%3D1593100263674%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&time=1593100263674&liSync=true

Request Chain 76

• https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e HTTP 302
• https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e HTTP 302
• https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e&t=638bd1a6-5fd9-48ca-afd0-ea64184936af

Request Chain 78

• https://www.google-analytics.com/r/collect?v=1&_v=j83&a=235709232&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&ul=en-us&de=UTF-8&dt=The%20Golden%20Tax%20Department%20and%20the%20Emergence%20of%20GoldenSpy%20Malware%20%7C%20Trustwave&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEADQ~&jid=239822994&gjid=1242881308&cid=1534877084.1593100264&tid=UA-123880220-1&_gid=1296968492.1593100264&_r=1&gtm=2wg6h154M2ZJN&z=78188473 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_gid=1296968492.1593100264&gjid=1242881308&_v=j83&z=78188473 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473&slf_rd=1&random=4134457195

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/	106 KB 27 KB	545ms 270ms	Document text/html	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 26df898fb0d14130c7524c88390bf30b6fa4fd4f60f5702b7ae9bad8fe5ab160 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.trustwave.com :scheme https :path /en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 cache-control no-cache pragma no-cache content-type text/html; charset=utf-8 content-encoding gzip expires -1 vary Accept-Encoding set-cookie ARRAffinity=44bf8a95b6652eed85464155b2b48df206df68d770a1d597282ffa9a3d6a301c;Path=/;HttpOnly;Domain=trustwave-umbraco-uk.azurewebsites.net ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890;Path=/;Domain=www.trustwave.com ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890;Path=/;Domain=www.trustwave.com;SameSite=None;Secure x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-aspnet-version date Thu, 25 Jun 2020 15:51:02 GMT content-length 26781
GET H2	200	9c85e15b-99ed-40a4-929d-2262f9ed2706.css fast.fonts.net/cssapi/	6 KB 1009 B	31ms 7ms	Stylesheet text/css	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40B6) / Resource Hash 6603122bf60f4b09cfab59cdc08d792c28773607d897ed680c7c0b607a44a879 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT content-encoding gzip last-modified Tue, 28 Apr 2020 14:50:47 GMT server ECS (fcn/40B6) age 2422749 status 200 etag "2121817011" vary Accept-Encoding x-cache HIT content-type text/css access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 817 expires Thu, 02 Jul 2020 15:51:02 GMT
GET H2	200	styles.min.css www.trustwave.com/dist/css/	238 KB 31 KB	146ms 145ms	Stylesheet text/css	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/dist/css/styles.min.css?v=33sa Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 980d7d5990527c0f1e05ab38b6c477df78d3b1ef93d5613df04fa6d0ba9f00f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:04:18 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "08d2888dc49d61:0" vary Accept-Encoding content-type text/css status 200 date Thu, 25 Jun 2020 15:51:02 GMT accept-ranges bytes content-length 31604 x-xss-protection 1; mode=block
GET H2	200	api.js Show response www.google.com/recaptcha/	674 B 533 B	16ms 15ms	Script text/javascript	2a00:1450:4001:80b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash cc15c325492dd5972c007635108f190eb6c75025e75c89d6b006ca7aeb4278a3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control private, max-age=300 content-security-policy frame-ancestors 'self' alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 446 x-xss-protection 1; mode=block expires Thu, 25 Jun 2020 15:51:02 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	708 B 545 B	21ms 20ms	Script text/javascript	2a00:1450:4001:80b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?render=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash c59b31da9bfc72d137199d0124f68cfbe3c5196eb72ef886410d1aa9aa02518a Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control private, max-age=300 content-security-policy frame-ancestors 'self' alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 477 x-xss-protection 1; mode=block expires Thu, 25 Jun 2020 15:51:02 GMT
GET H2	200	covid-recources-350x270.jpg www.trustwave.com/media/16633/	46 KB 46 KB	884ms 879ms	Image image/jpeg	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/media/16633/covid-recources-350x270.jpg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash ac774260c18aee68a2f1cb48c82fdbc6975fb4dd45dcaca352a43ee98c8cda91 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version x-frame-options SAMEORIGIN date Thu, 25 Jun 2020 15:51:03 GMT vary Accept-Encoding content-type image/jpeg status 200 cache-control public, must-revalidate, max-age=31536000 accept-ranges bytes content-length 47176 x-xss-protection 1; mode=block expires Fri, 25 Jun 2021 15:51:03 GMT
GET H2	200	Singtel%20Logo.svg www.trustwave.com/img/logo/	5 KB 2 KB	347ms 342ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/logo/Singtel%20Logo.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash ace78f63f590160b0748a26e60d8b453b4d4ac8bc4da20967632bf7e5bcb58e3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 2141 x-xss-protection 1; mode=block
GET H2	200	gtm.js Show response www.googletagmanager.com/	133 KB 44 KB	36ms 32ms	Script application/javascript	2a00:1450:4001:825::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e434b24b4ac1ea5bdc827b891fd71dc8abbedf50b07b2ed5508e462b36fd10b2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45404 x-xss-protection 0 last-modified Thu, 25 Jun 2020 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 Jun 2020 15:51:02 GMT
GET H2	200	Optus%20Logo.svg www.trustwave.com/img/logo/	3 KB 1 KB	347ms 342ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/logo/Optus%20Logo.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 2a1c9874549a1cb94b6e0dc5822b4f5ca14386d39214a8145670fc1c50045496 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 1228 x-xss-protection 1; mode=block
GET H2	200	twitter.svg www.trustwave.com/img/icon/social/svg/dark/	778 B 818 B	347ms 343ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/dark/twitter.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 778 x-xss-protection 1; mode=block
GET H2	200	linkedin.svg www.trustwave.com/img/icon/social/svg/dark/	636 B 730 B	342ms 338ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/dark/linkedin.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 636 x-xss-protection 1; mode=block
GET H2	200	facebook.svg www.trustwave.com/img/icon/social/svg/dark/	446 B 490 B	343ms 338ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/dark/facebook.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 446 x-xss-protection 1; mode=block
GET H2	200	the-golden-tax-department-and-emergence-of-goldenspy-malware.png trustwave.azureedge.net/media/16896/	175 KB 176 KB	113ms 40ms	Image image/png	2a01:4a0:1338:28::c38a:ff12 NETZBETRIEB-GMBH
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.azureedge.net/media/16896/the-golden-tax-department-and-emergence-of-goldenspy-malware.png?rnd=132374852340000000 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a01:4a0:1338:28::c38a:ff12 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash c75065dc223816e29e1c8ed8ed268af5ccaf4b608fea3165b5f1759a498783c4 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 25 Jun 2020 15:51:03 GMT content-encoding gzip content-md5 O3YqjOFXFxNbUOVUP95XiQ== status 200 content-length 179029 x-ms-lease-status unlocked last-modified Wed, 24 Jun 2020 15:13:54 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D8185135CCEE46 vary Accept-Encoding content-type image/png x-ms-request-id e9d25095-201e-00ec-1ff0-4ae597000000 cache-control public, max-age=31525869 x-ms-version 2009-09-19 x-ms-meta-createddate 06/24/2020 15:13:54 +00:00
GET H2	200	6a0133f264aa62970b0264e2e37dff200d-800wi npercoco.typepad.com/.a/	106 KB 107 KB	610ms 540ms	Image image/png	104.18.137.190 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://npercoco.typepad.com/.a/6a0133f264aa62970b0264e2e37dff200d-800wi Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.137.190 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a1449e4cedb3267dd97362786a19a9ef6c0ca41b41c2dd2f157c81af25a0d796 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT via 1.1 varnish cf-cache-status DYNAMIC age 11434 cf-ray 5a8fd903de1ed8c9-AMS status 200 content-disposition inline; filename=6a0133f264aa62970b0264e2e37dff200d-800wi.png content-length 108544 cf-request-id 038dc5f6650000d8c9269cf200000001 x-webserver oak-tp-web080 last-modified Thu, 18 Jun 2020 21:14:07 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary cookie x-varnish 2082092579 2079529733 cache-control s-maxage=14400 x-phapp oak-tp-web080 accept-ranges bytes content-type image/png
GET H2	200	6a0133f264aa62970b0263e95166fc200b-800wi npercoco.typepad.com/.a/	192 KB 192 KB	623ms 553ms	Image image/png	104.18.137.190 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://npercoco.typepad.com/.a/6a0133f264aa62970b0263e95166fc200b-800wi Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.137.190 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 596dddaedeb483f7a939e5ff2a0bebbb07e5235f4042051d377cdf9eac682922 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT via 1.1 varnish cf-cache-status DYNAMIC age 11434 cf-ray 5a8fd903de1fd8c9-AMS status 200 content-disposition inline; filename=6a0133f264aa62970b0263e95166fc200b-800wi.png content-length 196655 cf-request-id 038dc5f6650000d8c9269d0200000001 x-webserver oak-tp-web052 last-modified Thu, 18 Jun 2020 21:15:38 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary cookie x-varnish 365791750 363682287 cache-control s-maxage=14400 x-phapp oak-tp-web052 accept-ranges bytes content-type image/png
GET H2	200	logo-trustwave-white.svg www.trustwave.com/img/logo/	3 KB 1 KB	343ms 339ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/logo/logo-trustwave-white.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 1354 x-xss-protection 1; mode=block
GET H2	200	linkedin.svg www.trustwave.com/img/icon/social/svg/light/	636 B 676 B	343ms 340ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/light/linkedin.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 46647527924f0574eded74e7ef9a93d43044a47dcd1b11b9a203c0a9a8bb65e9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 636 x-xss-protection 1; mode=block
GET H2	200	twitter.svg www.trustwave.com/img/icon/social/svg/light/	778 B 822 B	344ms 340ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/light/twitter.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4fb02286499439e694d9a4220d6ca3ab664b2ba4bdb699b9068aa8e6fd5528c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 778 x-xss-protection 1; mode=block
GET H2	200	facebook.svg www.trustwave.com/img/icon/social/svg/light/	446 B 486 B	344ms 341ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/light/facebook.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 64ed842d23dcee23e4cf9257dd18ce0066a76cd75108e7fc95f13a4a9b0e892c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 446 x-xss-protection 1; mode=block
GET H2	200	youtube.svg www.trustwave.com/img/icon/social/svg/light/	525 B 569 B	345ms 341ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/icon/social/svg/light/youtube.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash c750113ac663d3ae3adea8e042237ac1c5ea21f9ad1749efc357ea93acbc5d78 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 525 x-xss-protection 1; mode=block
GET H/1.1	200 OK	player.js Show response player.vimeo.com/api/	16 KB 6 KB	61ms 21ms	Script application/javascript	151.101.112.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://player.vimeo.com/api/player.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3251d1a7dd9b4629dcd26b5a1709ef7e7558a026f13c401404387b49eb538bd5 Security Headers Name Value Content-Security-Policy default-src 'none'; style-src 'unsafe-inline' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-Varnish-Cache 1 Content-Security-Policy default-src 'none'; style-src 'unsafe-inline' Content-Encoding gzip X-Content-Type-Options nosniff Age 1142 X-Cache HIT P3p CP="This is not a P3P policy! See https://vimeo.com/privacy" Connection keep-alive X-VServer infra-playproxy-a-3 Content-Length 5244 X-Xss-Protection 1; mode=block X-Served-By cache-hhn4070-HHN Access-Control-Allow-Origin * Expires Thu, 25 Jun 2020 16:00:29 GMT Server nginx Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 X-Timer S1593100263.857198,VS0,VE0 Date Thu, 25 Jun 2020 15:51:02 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type application/javascript;charset=utf-8 Via 1.1 varnish, 1.1 varnish Vary Accept-Encoding X-Vimeo-DC ge Accept-Ranges bytes X-Cache-Hits 2201
GET H2	200	scripts.min.js Show response www.trustwave.com/dist/js/	437 KB 136 KB	389ms 389ms	Script application/x-javascript	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/dist/js/scripts.min.js?v=v32sa Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e80979f5ce0e4393c933937fb222a21947708b8eac9173b4c04c2d52fe3a73f4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:04:18 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "08d2888dc49d61:0" vary Accept-Encoding content-type application/x-javascript status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 138652 x-xss-protection 1; mode=block
GET H2	200	rum.js Show response www.atmrum.net/	301 B 587 B	85ms 20ms	Script application/javascript	204.79.197.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.atmrum.net/rum.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT x-content-type-options nosniff last-modified Mon, 01 Jun 2020 18:59:27 GMT x-msedge-ref Ref A: F389F707274F4972A8D84E7F49FEBAA6 Ref B: AMBEDGE0415 Ref C: 2020-06-25T15:51:02Z etag 0x8D4FC0223F2F653 status 200 content-type application/javascript access-control-allow-origin * access-control-expose-headers X-MSEdge-Ref cache-control no-store accept-ranges bytes timing-allow-origin * content-length 301
GET H2	200	addthis_widget.js Show response s7.addthis.com/js/300/	353 KB 114 KB	89ms 30ms	Script application/javascript	23.213.164.135 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/js/300/addthis_widget.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.213.164.135 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-213-164-135.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Thu, 04 Jun 2020 15:49:19 GMT server nginx/1.15.8 etag W/"5ed917ff-5834c" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Thu, 25 Jun 2020 15:51:03 GMT x-host s7.addthis.com content-length 116324
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/154/	8 KB 4 KB	112ms 41ms	Script application/x-javascript	104.121.186.179 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/154/munchkin.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.121.186.179 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-121-186-179.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 9298a280eda6b54290d3c69fda3ae7da0cec1a0169d01d4e5944af63d68939d5 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 25 Jun 2020 15:51:03 GMT Content-Encoding gzip Last-Modified Fri, 18 May 2018 02:45:27 GMT Server AkamaiNetStorage ETag "808fc844032f646c32adce24553838be:1526611527" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3700 Expires Sat, 03 Oct 2020 15:51:03 GMT
GET H2	200	5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js Show response cookie-cdn.cookiepro.com/langswitch/	2 KB 1 KB	63ms 41ms	Script application/x-javascript	2606:4700::6812:678 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9545498791418ba2847374815a974cc5bad7368ffb1df4c44c67d25027dd219e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 25 Jun 2020 15:51:02 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT content-md5 2Q95fkKCF+yYcVGygzYfBA== age 7034 status 200 cf-request-id 038dc5f62e00003258f8074200000001 x-ms-lease-status unlocked last-modified Mon, 29 Apr 2019 14:20:09 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5c642d12-a01e-0046-7f75-340cca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 cf-ray 5a8fd9037a763258-FRA
GET H2	200	1.css fast.fonts.net/t/	0 79 B	7ms 6ms	Stylesheet text/css	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/t/1.css?apiType=css&projectid=9c85e15b-99ed-40a4-929d-2262f9ed2706 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/41AE) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT last-modified Wed, 21 Feb 2018 12:55:22 GMT server ECS (fcn/41AE) age 6062760 etag "616070693" status 200 x-cache HIT content-type text/css access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 0 expires Thu, 02 Jul 2020 15:51:02 GMT
GET H2	200	ai.0.js Show response az416426.vo.msecnd.net/scripts/a/	94 KB 22 KB	31ms 8ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://az416426.vo.msecnd.net/scripts/a/ai.0.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FA5) / Resource Hash 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 25 Jun 2020 15:51:02 GMT content-encoding gzip content-md5 HdY95yzx9wIyQkVEGES+Ew== age 579 x-cache HIT status 200 content-length 22495 x-ms-lease-status unlocked last-modified Tue, 04 Feb 2020 19:23:51 GMT server ECAcc (frc/8FA5) etag 0x8D7A9A7C460F06C vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id ec207cd4-001e-001d-1507-4b3d0e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=1800 x-ms-version 2009-09-19 expires Thu, 25 Jun 2020 16:21:02 GMT
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/NMoy4HgGiLr5NAQaEQa2ho8X/	323 KB 127 KB	9ms 6ms	Script text/javascript	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/NMoy4HgGiLr5NAQaEQa2ho8X/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c1533bc39e2dd8ede3893909d6f42760e0598d075951447afe88158e57b0961a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Jun 2020 16:39:34 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 22 Jun 2020 20:56:25 GMT server sffe age 169888 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 129939 x-xss-protection 0 expires Wed, 23 Jun 2021 16:39:34 GMT
GET H/1.1	200 OK	432221087 player.vimeo.com/video/ Frame BD88	0 0	126ms 125ms	Document text/html	151.101.112.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://player.vimeo.com/video/432221087?api=1&player_id=vimeo_id_0 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host player.vimeo.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Response headers Connection keep-alive Content-Length 10074 Server nginx Content-Type text/html; charset=UTF-8 X-Xss-Protection 1; mode=block Content-Security-Policy script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp X-Content-Type-Options nosniff Content-Encoding gzip Strict-Transport-Security max-age=31536000; includeSubDomains; preload Link <https://i.vimeocdn.com>; rel=preconnect; crossorigin <https://f.vimeocdn.com>; rel=preconnect; crossorigin <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin P3p CP="This is not a P3P policy! See https://vimeo.com/privacy" Expires Thu, 25 Jun 2020 15:52:46 GMT Via 1.1 varnish 1.1 varnish Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 X-Varnish-Cache 1 X-VServer infra-playproxy-a-7 X-Vimeo-DC ge Accept-Ranges bytes Date Thu, 25 Jun 2020 15:51:03 GMT Age 0 X-Served-By cache-hhn4070-HHN X-Cache MISS X-Cache-Hits 0 X-Timer S1593100263.951179,VS0,VE101 Vary Accept-Encoding
GET H/1.1	200 OK	3b7ba697d08de6c964b83f21b9a1a75ed153fd24.png trustwave.blob.core.windows.net/cache/3/b/7/b/a/6/ Redirect Chain https://www.trustwave.com/media/16657/gartner-mdr-cover.png?anchor=center&mode=crop&width=400&rnd=132308413190000000 https://trustwave.blob.core.windows.net/cache/3/b/7/b/a/6/3b7ba697d08de6c964b83f21b9a1a75ed153fd24.png	39 KB 40 KB	475ms 109ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/3/b/7/b/a/6/3b7ba697d08de6c964b83f21b9a1a75ed153fd24.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 6fbc9436bf1ea8e9568562182031024ae2960a3c3dfdd706ccec19c0fb04b445 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Wed, 08 Apr 2020 17:55:20 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 wPZ3WeOl75NahAH1egrikg== ETag 0x8D7DBE6013FC4E5 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 7c27668d-501e-00e8-1808-4b1015000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 40008 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/3/b/7/b/a/6/3b7ba697d08de6c964b83f21b9a1a75ed153fd24.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	72f4fa87e98f4082904da04fd7c4b3135add7f78.png trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/ Redirect Chain https://www.trustwave.com/media/15951/database-security-in-the-cloud-cover.png?anchor=center&mode=crop&width=400&rnd=132007852950000000 https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png	57 KB 57 KB	474ms 109ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 64f5b163f57390ef83cfaa8e328cdbaa6baf4305cedf341549b37f8e68986d83 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:02 GMT Last-Modified Tue, 28 Apr 2020 12:16:04 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 87yixUc9UDs1DHGy/tsWfw== ETag 0x8D7EB6DEC6656B1 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 0541d6f8-f01e-006d-6308-4b47c0000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 57903 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/ Redirect Chain https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000 https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png	276 KB 277 KB	496ms 129ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 19a5abc3ee71d9689286163dd786564ab2d59a118563fc140e62fa96d0d386df Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Mon, 05 Aug 2019 14:54:10 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 2nJMTgekKPiIq9CgmTKqrg== ETag 0x8D719B4C5DE07E9 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 289cbaac-701e-015a-5908-4bad3a000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 282667 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	5a6834a869db6f970c8f090a022f77a1c482c6a8.png trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/ Redirect Chain https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000 https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png	53 KB 54 KB	346ms 105ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 049bf83ad4e353fb4bce7d9fff2ba6b0996aa1a8bbdba76ca83a2ee78c887687 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Thu, 07 Nov 2019 12:23:34 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 7yCcZEg8vp+Cqn2BqP21Mw== ETag 0x8D7637D4EF0E3A5 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 2360295e-101e-0127-5708-4b31f2000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 54413 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	95b0df699cb216066e4e2043e54a3680a0fb2a3c.png trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/ Redirect Chain https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000 https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png	142 KB 143 KB	396ms 105ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 2e45a8996ec5c8b3fce4c3f71fc56ef806673998113d09c32f73c7a3d6efdb38 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Tue, 07 Apr 2020 18:45:01 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 5UtgQThYJzYHnzR2krDd3w== ETag 0x8D7DB23C7529E1A x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 7c2766f7-501e-00e8-7508-4b1015000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 145855 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/ Redirect Chain https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000 https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg	32 KB 32 KB	433ms 110ms	Image image/jpeg	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 14da1d6311764bee490145f7909d480858b94fc01c6ba2b5d8c112feabe53a99 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Wed, 29 Jan 2020 22:23:46 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 wcV8714ZrmJmS6VqXbqxbQ== ETag 0x8D7A509E865C6AD x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/jpeg x-ms-request-id 352c0e73-601e-0005-0308-4b1991000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 32269 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/ Redirect Chain https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000 https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg	9 KB 10 KB	451ms 177ms	Image image/jpeg	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 9998a28912966aa8ae78c7bae4b70bce32095ac4cafb972428f96c60bf374a98 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Wed, 29 Jan 2020 22:23:46 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 MsdJ7/i6e4BXG2Gh7eeTmQ== ETag 0x8D7A509E865C6AD x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/jpeg x-ms-request-id 0541d7ac-f01e-006d-7f08-4b47c0000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 9529 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	8c8e22116e1d86cb5ebbba6cf7dc44783fccf2e3.jpg trustwave.blob.core.windows.net/cache/8/c/8/e/2/2/ Redirect Chain https://www.trustwave.com/media/16906/oft-mw-blog-header.jpg?anchor=center&mode=crop&width=400&rnd=132375042260000000 https://trustwave.blob.core.windows.net/cache/8/c/8/e/2/2/8c8e22116e1d86cb5ebbba6cf7dc44783fccf2e3.jpg	20 KB 21 KB	491ms 128ms	Image image/jpeg	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/8/c/8/e/2/2/8c8e22116e1d86cb5ebbba6cf7dc44783fccf2e3.jpg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 13231257ca4c0d67b4676b458c901701282b1640e123543e7517c62fd81806e1 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Wed, 24 Jun 2020 20:36:04 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 a4kPd7wuEqfAczzsdCMp1A== ETag 0x8D8187E3742E297 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/jpeg x-ms-request-id 23602913-101e-0127-1508-4b31f2000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 20697 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/8/c/8/e/2/2/8c8e22116e1d86cb5ebbba6cf7dc44783fccf2e3.jpg cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	cb3c59f253fc3da25984e875b59fa429c61a9aed.png trustwave.blob.core.windows.net/cache/c/b/3/c/5/9/ Redirect Chain https://www.trustwave.com/media/16896/the-golden-tax-department-and-emergence-of-goldenspy-malware.png?anchor=center&mode=crop&width=400&rnd=132374852340000000 https://trustwave.blob.core.windows.net/cache/c/b/3/c/5/9/cb3c59f253fc3da25984e875b59fa429c61a9aed.png	204 KB 205 KB	385ms 106ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/c/b/3/c/5/9/cb3c59f253fc3da25984e875b59fa429c61a9aed.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 953d237baa33d2be44ea87ea0f152bdde5ec93c7f473b2cb2890b6403276e42b Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Thu, 25 Jun 2020 13:02:45 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 FhtXxPHZhJXR1YqBLTK/cg== ETag 0x8D819080DE6DFA7 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 352c0f19-601e-0005-1a08-4b1991000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 209298 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/c/b/3/c/5/9/cb3c59f253fc3da25984e875b59fa429c61a9aed.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	d811ec63c804742ec35245598815fd42261061c5.png trustwave.blob.core.windows.net/cache/d/8/1/1/e/c/ Redirect Chain https://www.trustwave.com/media/16694/adp-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315344100000000 https://trustwave.blob.core.windows.net/cache/d/8/1/1/e/c/d811ec63c804742ec35245598815fd42261061c5.png	17 KB 18 KB	395ms 117ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/d/8/1/1/e/c/d811ec63c804742ec35245598815fd42261061c5.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 931d1e18c99133e074631d74ef9b90050a447af3c0cfa7df64c963428d829631 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Thu, 16 Apr 2020 18:30:42 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 LTrmvDJtyOYYOIRhwdpPCg== ETag 0x8D7E234450BFDE2 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 8be47133-701e-0092-5e08-4b7a58000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 17533 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/d/8/1/1/e/c/d811ec63c804742ec35245598815fd42261061c5.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	d576f70ba0a48444245aa3f69374a93c1e40bf5e.png trustwave.blob.core.windows.net/cache/d/5/7/6/f/7/ Redirect Chain https://www.trustwave.com/media/16700/seg-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315350400000000 https://trustwave.blob.core.windows.net/cache/d/5/7/6/f/7/d576f70ba0a48444245aa3f69374a93c1e40bf5e.png	18 KB 19 KB	511ms 106ms	Image image/png	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/d/5/7/6/f/7/d576f70ba0a48444245aa3f69374a93c1e40bf5e.png Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 7d00e70b1cbd30ce63bb8ea01a9a289087a43c22bac98e3f61d42488bd8ed917 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Thu, 16 Apr 2020 19:25:20 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 o6M2HJTL/BzObrNMynoY8A== ETag 0x8D7E23BE755FA90 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/png x-ms-request-id 236029d2-101e-0127-4008-4b31f2000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 18554 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/d/5/7/6/f/7/d576f70ba0a48444245aa3f69374a93c1e40bf5e.png cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H/1.1	200 OK	9449054b6e599d2c6ae326fc940e1718f740d84d.jpg trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/ Redirect Chain https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000 https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg	8 KB 9 KB	505ms 105ms	Image image/jpeg	52.239.152.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash cb8fd428f0d96267a4df07e3603d7e9fc4f424096eec1923269d49efa9f31dbb Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob Date Thu, 25 Jun 2020 15:51:03 GMT Last-Modified Wed, 29 Jan 2020 22:23:46 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 Content-MD5 YYg1/108u00f4mbVmhIfVw== ETag 0x8D7A509E868AD64 x-ms-meta-ImageProcessedBy ImageProcessor.Web/4.10.0.100 Content-Type image/jpeg x-ms-request-id 8be47172-701e-0092-1608-4b7a58000000 Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 Content-Length 8271 Redirect headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff x-aspnet-version status 302 date Thu, 25 Jun 2020 15:51:03 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 location https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg cache-control no-cache content-length 219 x-xss-protection 1; mode=block
GET H2	200	loading-white.svg www.trustwave.com/img/utility/	687 B 731 B	405ms 405ms	Image image/svg+xml	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://www.trustwave.com/img/utility/loading-white.svg Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version etag "09893a3dc49d61:0" x-frame-options SAMEORIGIN content-type image/svg+xml status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 687 x-xss-protection 1; mode=block
GET H2	200	MaterialIcons-Regular.woff2 www.trustwave.com/fonts/material-icons/	43 KB 43 KB	401ms 400ms	Font application/x-font-woff2	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/fonts/material-icons/MaterialIcons-Regular.woff2 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:04:18 GMT x-aspnet-version etag "08d2888dc49d61:0" x-frame-options SAMEORIGIN content-type application/x-font-woff2 status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 44300 x-xss-protection 1; mode=block
GET H2	200	KFOmCnqEu92Fr1Mu4mxP.ttf fonts.gstatic.com/s/roboto/v20/	35 KB 20 KB	6ms 6ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxP.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Wed, 10 Jun 2020 07:55:38 GMT content-encoding gzip x-content-type-options nosniff age 1324524 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20742 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:18:36 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 10 Jun 2021 07:55:38 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc9.ttf fonts.gstatic.com/s/roboto/v20/	36 KB 21 KB	8ms 8ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc9.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 719df7954428f52779f3fa18641c19fc854b39394193d87eea5a61795dec8dbe Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Wed, 10 Jun 2020 08:10:24 GMT content-encoding gzip x-content-type-options nosniff age 1323638 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20908 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:18:36 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 10 Jun 2021 08:10:24 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc9.ttf fonts.gstatic.com/s/roboto/v20/	35 KB 20 KB	9ms 8ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc9.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a637d3ff767789f9b113bbfa208bdb6a76efed7c4c111da2a130f6a38a51d353 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Thu, 11 Jun 2020 02:31:40 GMT content-encoding gzip x-content-type-options nosniff age 1257562 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20796 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:18:59 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 11 Jun 2021 02:31:40 GMT
GET H2	200	d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2 fast.fonts.net/dv2/14/	20 KB 20 KB	28ms 9ms	Font application/octet-stream	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/dv2/14/d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2?d44f19a684109620e4841470a190e8187da2675ee4d21384fcc31c18ab36cd3000b30c7b2714554b2fa45c7114a369ae46a92d2cbcc413b53d0101698114ce8d7e74e9017f28ef808677fbf0b28df9dd5c148045f073a59c253d54554cb37ea9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/4193) / Resource Hash f422b8961953524e333d562521c3b4e0a2ed33da87079bd92c08ec4389372358 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css Origin https://www.trustwave.com Response headers date Thu, 25 Jun 2020 15:51:02 GMT last-modified Fri, 05 Dec 2014 01:40:36 GMT server ECS (fcn/4193) age 28867134 etag "2369653874" status 200 x-cache HIT content-type application/octet-stream access-control-allow-origin * cache-control max-age=7776000 accept-ranges bytes content-length 20472 expires Wed, 23 Sep 2020 15:51:02 GMT
GET H2	200	71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2 fast.fonts.net/dv2/14/	20 KB 20 KB	32ms 16ms	Font application/octet-stream	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/dv2/14/71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2?d44f19a684109620e4841470a190e8187da2675ee4d21384fcc31c18ab36cd3000b30c7b2714554b2fa45c7114a369ae46a92d2cbcc413b53d0101698114ce8d7e74e9017f28ef808677fbf0b28df9dd5c148045f073a59c253d54554cb37ea9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40E7) / Resource Hash bd1f1f47a863ac3be54dab002af884683776e666b68d50ec7641ca732991d54f Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css Origin https://www.trustwave.com Response headers date Thu, 25 Jun 2020 15:51:02 GMT last-modified Fri, 05 Dec 2014 01:42:38 GMT server ECS (fcn/40E7) age 29193919 etag "2674825278" status 200 x-cache HIT content-type application/octet-stream access-control-allow-origin * cache-control max-age=7776000 accept-ranges bytes content-length 20080 expires Wed, 23 Sep 2020 15:51:02 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc9.ttf fonts.gstatic.com/s/roboto/v20/	35 KB 20 KB	7ms 7ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc9.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b4c96f55c265e0a80be4243a16f7e88b9a67c85b71b4e2aa8cea4e1aa989b0d1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Tue, 09 Jun 2020 03:31:23 GMT content-encoding gzip x-content-type-options nosniff age 1426779 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20827 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:18:53 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 09 Jun 2021 03:31:23 GMT
GET H2	200	KFOjCnqEu92Fr1Mu51TzBic6CsE.ttf fonts.gstatic.com/s/roboto/v20/	36 KB 22 KB	9ms 8ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TzBic6CsE.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 01143fda63dfbffb1115a0726d8867aa3898553e2f318f2be69ca2e8b9d9b154 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Wed, 10 Jun 2020 08:06:20 GMT content-encoding gzip x-content-type-options nosniff age 1323882 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21915 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:19:13 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 10 Jun 2021 08:06:20 GMT
GET H2	200	52be0694-00c1-4daa-8782-419021c48e95.woff2 fast.fonts.net/dv2/14/	20 KB 20 KB	28ms 14ms	Font application/octet-stream	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/dv2/14/52be0694-00c1-4daa-8782-419021c48e95.woff2?d44f19a684109620e4841470a190e8187da2675ee4d21384fcc31c18ab36cd3000b30c7b2714554b2fa45c7114a369ae46a92d2cbcc413b53d0101698114ce8d7e74e9017f28ef808677fbf0b28df9dd5c148045f073a59c253d54554cb37ea9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/418C) / Resource Hash 34ede3e0ed28152b38a721fd42c348162e01e6e53fd526b80e385c095b2b4082 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css Origin https://www.trustwave.com Response headers date Thu, 25 Jun 2020 15:51:02 GMT last-modified Fri, 05 Dec 2014 01:27:43 GMT server ECS (fcn/418C) age 1018695 etag "3413759195" status 200 x-cache HIT content-type application/octet-stream access-control-allow-origin * cache-control max-age=7776000 accept-ranges bytes content-length 20524 expires Wed, 23 Sep 2020 15:51:02 GMT
GET H2	200	KFOkCnqEu92Fr1Mu51xIIzc.ttf fonts.gstatic.com/s/roboto/v20/	37 KB 22 KB	10ms 8ms	Font font/ttf	2a00:1450:4001:81f::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzc.ttf Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0dfa4684ad9c52a1a97d91764ef1d404c15dd95ed20f00a2f9f3f4d11df2abf9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/dist/css/styles.min.css?v=33sa Origin https://www.trustwave.com Response headers date Wed, 10 Jun 2020 11:03:50 GMT content-encoding gzip x-content-type-options nosniff age 1313232 status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22299 x-xss-protection 0 last-modified Wed, 24 Jul 2019 01:19:00 GMT server sffe vary Accept-Encoding content-type font/ttf access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 10 Jun 2021 11:03:50 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 04 Jun 2020 23:38:14 GMT server Golfe2 age 4285 date Thu, 25 Jun 2020 14:39:38 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18469 expires Thu, 25 Jun 2020 16:39:38 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	42ms 42ms	Script application/x-javascript	2a02:26f0:10c:382::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:382::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 25 Jun 2020 15:51:03 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=33771 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	hotjar-1372211.js Show response static.hotjar.com/c/	8 KB 3 KB	18ms 18ms	Script application/javascript	147.75.100.161 PACKET
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1372211.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.100.161 Central, Hong Kong, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress17 Software / Resource Hash 8d1675ee04a40b49bd75002b8533327bcc2bc3de5ad5e4e5ada61c5d95d9f519 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT content-encoding br x-content-type-options nosniff content-type application/javascript section-io-tag hotjarjs age 30 status 200 section-io-cache Hit vary Accept-Encoding content-length 2229 cache-control max-age=60 etag W/14f2b835feacc0fe93d16bcc557da3e8 access-control-max-age 600 section-io-origin-status 304 access-control-allow-origin * x-cache-hit 1 section-io-origin-time-seconds 0.074 accept-ranges bytes section-io-id 806ad5210fc37f2748ec4ae99ff3756d section-origin-responded true
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	40ms 40ms	Script application/x-javascript	104.121.186.179 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.trustwave.com URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v32sa Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.121.186.179 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-121-186-179.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 25 Jun 2020 15:51:03 GMT Content-Encoding gzip Last-Modified Fri, 03 Apr 2020 02:45:45 GMT Server AkamaiNetStorage ETag "aa520b8aca3502dbdbf62462e6f4be67:1585881945" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 751
GET H2	200	fpv2.min.js Show response www.atmrum.net/client/v1/atm/	3 KB 3 KB	33ms 32ms	Script application/javascript	204.79.197.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.atmrum.net/client/v1/atm/fpv2.min.js Requested by Host: www.atmrum.net URL: https://www.atmrum.net/rum.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:02 GMT x-content-type-options nosniff last-modified Mon, 01 Jun 2020 18:59:27 GMT x-msedge-ref Ref A: 49758C362E60440C83C09D62A1CBC2FF Ref B: AMBEDGE0415 Ref C: 2020-06-25T15:51:03Z etag 0x8D501F7AFB7338D status 200 content-type application/javascript access-control-allow-origin * access-control-expose-headers X-MSEdge-Ref cache-control no-store accept-ranges bytes timing-allow-origin * content-length 2983
GET		sh.f48a1a04fe8dbf021b4cda1d.html s7.addthis.com/static/ Frame 8F95	0 0
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	122ms 38ms	Script application/x-javascript	184.51.10.56 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.51.10.56 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-51-10-56.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id D4F9BC037745A45A etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=39584 accept-ranges bytes content-length 948 x-amz-id-2 gnz0ua21kg5yJNFXNFsbCAMRUIGVR8efGH4YbaY9gEEBDpOa0NAtsztaQ1J9dcnHXzcgPPszAaw=
GET H2	200	d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js Show response cookie-cdn.cookiepro.com/consent/	69 KB 16 KB	28ms 27ms	Script application/x-javascript	2606:4700::6812:678 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js Requested by Host: cookie-cdn.cookiepro.com URL: https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1c3bfab00f5e70133e4daafbd95aea46f572bbcf33335ee75b9f2240742c7982 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 25 Jun 2020 15:51:03 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT content-md5 tokLCuVTsBOR85IgoPx1iA== age 1935 status 200 cf-request-id 038dc5f83800003258f8093200000001 x-ms-lease-status unlocked last-modified Mon, 29 Apr 2019 14:20:11 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 127d04d8-301e-0036-27d7-23b53d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 cf-ray 5a8fd906c9843258-FRA
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-5286e9523a723348/	166 B 325 B	290ms 245ms	Script application/javascript	2.21.36.164 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-5286e9523a723348/_ate.track.config_resp Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a2-21-36-164.deploy.static.akamaitechnologies.com Software / Resource Hash 4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT content-encoding gzip etag 659743217 vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=60, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 154
GET H2	200	300lo.json Show response m.addthis.com/live/red_lojson/	89 B 249 B	268ms 266ms	Script application/javascript	23.213.164.135 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://m.addthis.com/live/red_lojson/300lo.json?si=5ef4c7e7d6668e79&bkl=0&bl=1&pdt=560&sid=5ef4c7e7d6668e79&pub=ra-5286e9523a723348&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.trustwave.com&fp=en-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1593100263491&jsl=1&uvs=5ef4c7e7ecf6dfbc000&skipb=1&callback=addthis.cbs.jsonp__76635812753763210 Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.213.164.135 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-213-164-135.deploy.static.akamaitechnologies.com Software / Resource Hash 24fa03691fb2ecf370e4f630a8313582f6e20d6be364fcd80ee60d3ad30206c2 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 pragma no-cache date Thu, 25 Jun 2020 15:51:03 GMT cache-control max-age=0, no-cache, no-store, no-transform content-disposition attachment; filename=1.txt content-length 89 content-type application/javascript;charset=utf-8
GET H2	200	sh.f48a1a04fe8dbf021b4cda1d.html s7.addthis.com/static/ Frame 0153	0 0	43ms 43ms	Document text/html	23.213.164.135 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html Requested by Host: s7.addthis.com URL: https://s7.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.213.164.135 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-213-164-135.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers :method GET :authority s7.addthis.com :scheme https :path /static/sh.f48a1a04fe8dbf021b4cda1d.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Response headers status 200 server nginx/1.15.8 content-type text/html last-modified Tue, 21 Jan 2020 20:57:37 GMT etag W/"5e2765c1-114a1" timing-allow-origin * cache-control public, max-age=86313600 p3p CP="NON ADM OUR DEV IND COM STA" strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip content-length 25594 date Thu, 25 Jun 2020 15:51:03 GMT vary Accept-Encoding x-host s7.addthis.com
GET H2	200	anchor www.google.com/recaptcha/api2/ Frame 0ACD	0 0	47ms 47ms	Document text/html	2a00:1450:4001:80b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=NMoy4HgGiLr5NAQaEQa2ho8X&size=invisible&cb=korj9uz12wp6 Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/NMoy4HgGiLr5NAQaEQa2ho8X/recaptcha__en.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-I7Fm2UZS1lUiqnhx/t2TcQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=NMoy4HgGiLr5NAQaEQa2ho8X&size=invisible&cb=korj9uz12wp6 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Response headers status 200 content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Thu, 25 Jun 2020 15:51:03 GMT content-security-policy script-src 'report-sample' 'nonce-I7Fm2UZS1lUiqnhx/t2TcQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 9463 server GSE alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	oembed.json Show response vimeo.com/api/ Redirect Chain https://www.vimeo.com/api/oembed.json?url=https://vimeo.com/432221087&callback=vimeoCallback https://vimeo.com/api/oembed.json?callback=vimeoCallback&url=https://vimeo.com/432221087	1 KB 2 KB	206ms 169ms	Script application/javascript	151.101.64.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://vimeo.com/api/oembed.json?callback=vimeoCallback&url=https://vimeo.com/432221087 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.64.217 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ec4079bf845eef90f0ef128b063310a427b875a932050673d11a2b4f5814a48f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff Age 0 Content-Security-Policy-Report-Only default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /_csp X-Cache MISS, MISS Connection keep-alive Content-Length 656 X-XSS-Protection 1; mode=block X-UA-Compatible IE=edge Access-Control-Allow-Origin * Last-Modified Thu, 25 Jun 2020 15:37:36 GMT Server nginx Cache-Control max-age=60 X-Timer S1593100264.942749,VS0,VE148 X-Frame-Options sameorigin Date Thu, 25 Jun 2020 15:51:04 GMT X-Served-By cache-bwi5135-BWI, cache-ams21032-AMS Vary User-Agent,Accept-Encoding Content-Type application/javascript Via 1.1 varnish, 1.1 varnish Expires Thu, 25 Jun 2020 15:52:04 GMT X-Vimeo-DC ge Etag "4aab2f3cd35d88cbe1a6fc37198114d36e6bbdce" Accept-Ranges bytes Access-Control-Allow-Headers X-Requested-With X-Cache-Hits 0, 0 Redirect headers X-Varnish-Cache 1 Date Thu, 25 Jun 2020 15:51:03 GMT Content-Encoding gzip Age 0 X-Cache MISS, MISS Connection keep-alive X-VServer infra-webproxy-a-5 Content-Length 246 X-Served-By cache-bwi5144-BWI, cache-ams21079-AMS Server nginx X-Timer S1593100264.688241,VS0,VE85 Location https://vimeo.com/api/oembed.json?callback=vimeoCallback&url=https://vimeo.com/432221087 Vary Accept-Encoding Content-Type text/html; charset=iso-8859-1 Via 1.1 varnish, 1.1 varnish, 1.1 varnish Expires Sun, 23 Jun 2030 12:59:26 GMT X-Vimeo-DC ge Accept-Ranges bytes X-Cache-Hits 0, 0
GET H2	200	t.js Show response vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/	4 KB 2 KB	61ms 61ms	Script application/javascript	13.226.154.6 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.226.154.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-226-154-6.dus51.r.cloudfront.net Software nginx/1.10.3 (Ubuntu) / Resource Hash 4014a05aacaa586346e71903afbc4537863681e4df786fa132e4a547cd6cfeb0 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:10:14 GMT content-encoding gzip x-content-type-options nosniff age 2449 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Mon, 11 May 2020 13:58:10 GMT server nginx/1.10.3 (Ubuntu) vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript;charset=utf-8 via 1.1 cddd3e95f67291463f7a95d065c7fcff.cloudfront.net (CloudFront) access-control-expose-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization cache-control public, s-maxage=2700 x-amz-cf-pop DUS51-C1 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization x-amz-cf-id UWFwQ8fGh25NnsCRrdcfwlcnY837DUXOInlsFs9i92FXDeuVil2OLA==
GET H2	200	en-us.json Show response www.trustwave.com/locale/en-us/LC_MESSAGES/	1 KB 875 B	159ms 158ms	XHR application/json	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/locale/en-us/LC_MESSAGES/en-us.json Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 21c3d65ef1a0105fb3114d843bd4c68e474e7571db6b0af5ca759fbfec9eca81 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ X-Requested-With XMLHttpRequest Request-Id |RiGJB.CRB5k User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type application/json status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 590 x-xss-protection 1; mode=block
GET H2	200	ja-jp.json Show response www.trustwave.com/locale/ja-jp/LC_MESSAGES/	1 KB 923 B	159ms 159ms	XHR application/json	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/locale/ja-jp/LC_MESSAGES/ja-jp.json Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 7b0ef13b754c456f5621d74ca260e49b061f759bcaeb9223e0eaa78ff4359189 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ X-Requested-With XMLHttpRequest Request-Id |RiGJB.7Bl1I User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type application/json status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 877 x-xss-protection 1; mode=block
GET H2	200	de-de.json Show response www.trustwave.com/locale/de-de/LC_MESSAGES/	1 KB 610 B	166ms 165ms	XHR application/json	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/locale/de-de/LC_MESSAGES/de-de.json Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash b5e5c5c8b9ebe9fb7f4a8cde7f2ff4f6652e6beb87585c18e99fb446fbb301a4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ X-Requested-With XMLHttpRequest Request-Id |RiGJB.MxjRK User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff last-modified Wed, 24 Jun 2020 04:05:04 GMT x-aspnet-version x-frame-options SAMEORIGIN etag "09893a3dc49d61:0" vary Accept-Encoding content-type application/json status 200 date Thu, 25 Jun 2020 15:51:03 GMT accept-ranges bytes content-length 564 x-xss-protection 1; mode=block
GET H2	200	js Show response www.google-analytics.com/gtm/	69 KB 27 KB	29ms 29ms	Script application/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-5B38B7F&t=gtm1&cid=1534877084.1593100264 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 18651262e9241e83f43d9987e4570513cd3dcdfd83cf3f0340fa287d99c7b390 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27976 x-xss-protection 0 last-modified Thu, 25 Jun 2020 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 25 Jun 2020 15:51:03 GMT
GET H2	200	modules.875e8181449a9cd033c6.js Show response script.hotjar.com/	370 KB 70 KB	20ms 19ms	Script application/javascript	147.75.102.13 PACKET
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.875e8181449a9cd033c6.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1372211.js?sv=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.102.13 Central, Hong Kong, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress3 Software / Resource Hash 23f41c0c9227bdefcf8e0564962990544adf98a3433206cf2c715f55c37804bd Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:04 GMT content-encoding br age 37 status 200 section-io-cache Hit content-length 71627 last-modified Thu, 25 Jun 2020 15:03:51 GMT etag "0073506d488c2667cedb0ba69e614c73" vary Accept-Encoding section-io-origin-status 200 access-control-allow-origin * cache-control max-age=31536000 section-io-origin-time-seconds 0.088 section-io-id 26188edb8af1bb5ae4f7ea3c74c3a24f accept-ranges bytes content-type application/javascript section-origin-responded true
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fb... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy...	0 63 B	113ms 111ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&time=1593100263674&liSync=true Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:04 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 0 x-li-uuid tccM6D/UGxZQbBsKwSoAAA== Redirect headers strict-transport-security max-age=2592000 x-content-type-options nosniff linkedin-action 1 status 302 content-length 0 x-li-uuid nXxW4z/UGxbA5VsOXSsAAA== pragma no-cache x-li-pop afd-prod-edc2 x-msedge-ref Ref A: 7C25EFF5A44443F496E9E6C32AFF92DA Ref B: FRAEDGE0721 Ref C: 2020-06-25T15:51:04Z date Thu, 25 Jun 2020 15:51:03 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&time=1593100263674&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	fpconfig.min.json Show response www.atmrum.net/conf/v1/atm/	191 B 482 B	113ms 22ms	XHR text/plain	204.79.197.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.atmrum.net/conf/v1/atm/fpconfig.min.json Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT x-content-type-options nosniff last-modified Mon, 01 Jun 2020 18:59:27 GMT x-msedge-ref Ref A: 901FDE6F4C0E4779895377683EC99C31 Ref B: BRU30EDGE0318 Ref C: 2020-06-25T15:51:03Z etag 0x8D501F7AFB7338D status 200 content-type text/plain; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-MSEdge-Ref cache-control no-store accept-ranges bytes timing-allow-origin * content-length 191
GET H/1.1	200 OK	visitWebPage Show response 815-rfm-693.mktoresp.com/webevents/	2 B 304 B	596ms 105ms	XHR text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://815-rfm-693.mktoresp.com/webevents/visitWebPage?_mchNc=1593100263679&_mchCn=&_mchId=815-RFM-693&_mchTk=_mch-trustwave.com-1593100263678-51367&_mchHo=www.trustwave.com&_mchPo=&_mchRu=%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&_mchPc=https%3A&_mchVr=154&_mchHa=&_mchRe=&_mchQp= Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 25 Jun 2020 15:51:04 GMT Content-Encoding gzip Server akka-http/10.1.11 Transfer-Encoding chunked X-Request-Id 8761ab4c-6ae8-4325-9f76-d996fb2f1467 Content-Type text/plain; charset=UTF-8
GET H2	200	optanon.css cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/	23 KB 5 KB	17ms 17ms	Stylesheet text/css	2606:4700::6812:678 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/optanon.css Requested by Host: cookie-cdn.cookiepro.com URL: https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 25 Jun 2020 15:51:03 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT content-md5 jzLE25vmrDR3ZmMxTSa8+w== age 5730 status 200 cf-request-id 038dc5f90400003258f80a2200000001 x-ms-lease-status unlocked last-modified Thu, 19 Sep 2019 18:59:46 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css access-control-allow-origin * x-ms-request-id df1cc734-401e-0085-58d7-231590000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 cf-ray 5a8fd9080c8d3258-FRA
GET H2	200	EU Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/	32 B 404 B	37ms 24ms	Script text/javascript	2606:4700:10::6814:b944 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery331021721882009766502_1593100263387&_=1593100263388 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v32sa Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:51:03 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 5a8fd9081f78c303-FRA content-length 32 cf-request-id 038dc5f9130000c3033b2ac200000001
GET H2	200	s.gif vidassets.terminus.services/ Redirect Chain https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e&t=638bd1a6-5fd9-48ca-afd0-ea64184936af	42 B 683 B	41ms 40ms	Image image/gif	13.226.154.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e&t=638bd1a6-5fd9-48ca-afd0-ea64184936af Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.226.154.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-226-154-6.dus51.r.cloudfront.net Software nginx/1.10.3 (Ubuntu) / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:07:30 GMT via 1.1 cddd3e95f67291463f7a95d065c7fcff.cloudfront.net (CloudFront) x-content-type-options nosniff age 2614 x-cache Hit from cloudfront status 200 content-length 42 last-modified Mon, 11 May 2020 13:58:10 GMT server nginx/1.10.3 (Ubuntu) access-control-allow-methods GET, POST, OPTIONS content-type image/gif access-control-allow-origin * access-control-expose-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization cache-control public, s-maxage=2700 x-amz-cf-pop DUS51-C1 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization x-amz-cf-id m-GfJeDjGJ_UQ4R4UmWyhHaYt2Vbeq29VZDWjBNg1vh4SE3r6s2w2g== Redirect headers pragma no-cache date Thu, 25 Jun 2020 15:51:03 GMT x-aspnet-version 4.0.30319 status 302 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" location https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|da4409f3-1514-49b8-82f1-fc98700fc92e&t=638bd1a6-5fd9-48ca-afd0-ea64184936af cache-control private,no-cache, must-revalidate content-type text/html content-length 343
GET H2	200	t.gif vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/	42 B 692 B	57ms 57ms	Image image/gif	13.226.154.6 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.gif?d=da4409f3-1514-49b8-82f1-fc98700fc92e&s=227b6c4a-1a97-406a-8f15-1a3df0b752c4&p=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-the-emergence-of-goldenspy-malware%2F&cb=1593100263693 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.226.154.6 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-226-154-6.dus51.r.cloudfront.net Software nginx/1.10.3 (Ubuntu) / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Jun 2020 15:36:08 GMT via 1.1 cddd3e95f67291463f7a95d065c7fcff.cloudfront.net (CloudFront) x-content-type-options nosniff age 895 x-cache Hit from cloudfront status 200 content-length 42 last-modified Mon, 11 May 2020 13:58:10 GMT server nginx/1.10.3 (Ubuntu) access-control-allow-methods GET, POST, OPTIONS content-type image/gif access-control-allow-origin * access-control-expose-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization cache-control public, s-maxage=2700 x-amz-cf-pop DUS51-C1 access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization x-amz-cf-id 3ycCyowJHDsXOmx_IAYQv1oWxao9lLFg-rKtYRvP8eJRfsuawnmrkw==
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j83&a=235709232&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-golden-tax-department-and-th... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_gid=1296968492.1593100264&gjid=1242881308&_v=j83&z=78188473 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473&slf_rd=1&random=4134457195	42 B 106 B	17ms 17ms	Image image/gif	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473&slf_rd=1&random=4134457195 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 25 Jun 2020 15:51:04 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Thu, 25 Jun 2020 15:51:04 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1534877084.1593100264&jid=239822994&_v=j83&z=78188473&slf_rd=1&random=4134457195 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	box-469cf41adb11dc78be68c1ae7f9457a4.html vars.hotjar.com/ Frame 5FE1	0 0	19ms 18ms	Document text/html	147.75.100.161 PACKET
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1372211.js?sv=7 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.100.161 Central, Hong Kong, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress17 Software / Resource Hash Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-469cf41adb11dc78be68c1ae7f9457a4.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Response headers status 200 date Thu, 25 Jun 2020 15:51:03 GMT content-type text/html content-length 851 last-modified Thu, 18 Jun 2020 15:53:04 GMT etag "d594f1d4c3e5dbd6b556c60d34e0daea" cache-control max-age=31536000 content-encoding br section-io-origin-status 200 section-io-origin-time-seconds 0.098 section-origin-responded true age 564023 vary Accept-Encoding section-io-cache Hit accept-ranges bytes section-io-id 9f7994da503f8c39a2bae481fb946529
GET H2	200	IsUserAusi Show response www.trustwave.com/umbraco/surface/AJAX/	5 B 214 B	359ms 358ms	XHR text/html	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/umbraco/surface/AJAX/IsUserAusi Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ X-Requested-With XMLHttpRequest Request-Id |RiGJB.JxiQv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff x-aspnet-version date Thu, 25 Jun 2020 15:51:04 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 status 200 cache-control private vary Accept-Encoding content-length 123 x-xss-protection 1; mode=block
GET H2	200	IsUserAPAC Show response www.trustwave.com/umbraco/surface/AJAX/	5 B 163 B	516ms 514ms	XHR text/html	52.151.96.240 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.trustwave.com/umbraco/surface/AJAX/IsUserAPAC Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ X-Requested-With XMLHttpRequest Request-Id |RiGJB.ma2nS User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-content-type-options nosniff x-aspnet-version date Thu, 25 Jun 2020 15:51:04 GMT x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 status 200 cache-control private vary Accept-Encoding content-length 123 x-xss-protection 1; mode=block
GET H2	200	trans.gif 8a9ffa7b3a7f3bdf4ec4205cc8bea068.azr.footprintdns.com/apc/	43 B 243 B	117ms 17ms	Image image/gif	2603:1020:d01:2:: MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://8a9ffa7b3a7f3bdf4ec4205cc8bea068.azr.footprintdns.com/apc/trans.gif?a9452a74ecd1dada99330316f2525a07 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1020:d01:2:: Berlin, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
GET H2	200	trans.gif 8a9ffa7b3a7f3bdf4ec4205cc8bea068.azr.footprintdns.com/apc/	43 B 81 B	15ms 14ms	Image image/gif	2603:1020:d01:2:: MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://8a9ffa7b3a7f3bdf4ec4205cc8bea068.azr.footprintdns.com/apc/trans.gif?46eb2b671f43153ca0d6cac6c2e5b280 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1020:d01:2:: Berlin, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
GET H2	200	trans.gif f532e23ff00cf7a67ab0f260841a8c1c.azr.footprintdns.com/apc/	43 B 243 B	86ms 7ms	Image image/gif	2603:1020:c01:2::3 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://f532e23ff00cf7a67ab0f260841a8c1c.azr.footprintdns.com/apc/trans.gif?1feccc5770ef168af874b9e6917a3a95 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1020:c01:2::3 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
GET H2	200	trans.gif f532e23ff00cf7a67ab0f260841a8c1c.azr.footprintdns.com/apc/	43 B 81 B	6ms 6ms	Image image/gif	2603:1020:c01:2::3 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://f532e23ff00cf7a67ab0f260841a8c1c.azr.footprintdns.com/apc/trans.gif?af29c398bd99874fd6b180546b70af75 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1020:c01:2::3 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
GET H2	200	trans.gif 11da6d1da12d1065f8cf853b406154eb.azr.footprintdns.com/apc/	43 B 243 B	798ms 246ms	Image image/gif	2603:1010:2::121 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://11da6d1da12d1065f8cf853b406154eb.azr.footprintdns.com/apc/trans.gif?0a90203244e7f65eaeceea9c6fb98761 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1010:2::121 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
POST H2	200	visit-data Show response in.hotjar.com/api/v2/client/sites/1372211/	178 B 320 B	39ms 38ms	XHR application/json	34.252.87.155 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://in.hotjar.com/api/v2/client/sites/1372211/visit-data?sv=7 Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.87.155 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-87-155.eu-west-1.compute.amazonaws.com Software / Resource Hash 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers date Thu, 25 Jun 2020 15:51:04 GMT content-encoding br status 200 vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-max-age 86400 access-control-allow-credentials true
GET H2	200	trans.gif 11da6d1da12d1065f8cf853b406154eb.azr.footprintdns.com/apc/	43 B 81 B	247ms 246ms	Image image/gif	2603:1010:2::121 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://11da6d1da12d1065f8cf853b406154eb.azr.footprintdns.com/apc/trans.gif?2a543dde536fd945e91354accb98b2f2 Requested by Host: www.trustwave.com URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1010:2::121 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Wed, 06 May 2020 21:53:26 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET content-type image/gif status 200 date Thu, 25 Jun 2020 15:51:04 GMT accept-ranges bytes content-length 43 etag "a6573bc5f023d61:0"
GET H2	200	r.gif Show response www.atmrum.net/report/v1/atm/	42 B 195 B	23ms 22ms	XHR image/gif	204.79.197.234 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.atmrum.net/report/v1/atm/r.gif?MonitorID=atm&rid=41602d6f9c79f51dffa18d26e8ffb8b6&w3c=true&prot=https:&v=2017061301&tag=602cc9bb0a513db2b327299487211347&DATA=[{%22RequestID%22:%228a9ffa7b3a7f3bdf4ec4205cc8bea068%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:120},{%22RequestID%22:%228a9ffa7b3a7f3bdf4ec4205cc8bea068%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:16},{%22RequestID%22:%22f532e23ff00cf7a67ab0f260841a8c1c%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:87},{%22RequestID%22:%22f532e23ff00cf7a67ab0f260841a8c1c%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:7},{%22RequestID%22:%2211da6d1da12d1065f8cf853b406154eb%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:798},{%22RequestID%22:%2211da6d1da12d1065f8cf853b406154eb%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:247}] Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Thu, 25 Jun 2020 15:51:05 GMT cache-control no-store x-msedge-ref Ref A: 62C35410928F452197DC876CFAAF256D Ref B: BRU30EDGE0318 Ref C: 2020-06-25T15:51:05Z access-control-allow-origin https://www.trustwave.com content-type image/gif
POST H2	200	track Show response dc.services.visualstudio.com/v2/	98 B 238 B	198ms 198ms	XHR application/json	40.79.138.41 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dc.services.visualstudio.com/v2/track Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.79.138.41 Paris, France, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 7c5d440d89193672644268455d304dfb1cb2fda5d2eb84574b069a8b8ea6264c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ Sdk-Context appId User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-type application/json Response headers x-ms-session-id 9D5A79E7-1B91-45E9-9A36-32BFBB8B6787 strict-transport-security max-age=31536000 x-content-type-options nosniff status 200 date Thu, 25 Jun 2020 15:51:05 GMT access-control-max-age 3600 content-type application/json; charset=utf-8 access-control-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context content-length 98

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

s7.addthis.com

URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html