401trg.com Open in urlscan Pro
104.18.131.189 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://401trg.pw/burning-umbrella
Effective URL:
https://401trg.com/burning-umbrella/
Submission: On July 08 via manual (July 8th 2019, 4:06:36 pm UTC)

Summary HTTP 24 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 7 domains to perform 24 HTTP transactions. The main IP is 104.18.131.189, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is 401trg.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 1st 2019. Valid for: a year.

This is the only time 401trg.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:30:... 2606:4700:30::681f:5b32	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 15	104.18.131.189 104.18.131.189	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:815::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
24	6

1 2606:4700:30::681f:5b32 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

401trg.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 104.18.131.189 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

401trg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	401trg.com 1 redirects 401trg.com	3 MB
4	gstatic.com fonts.gstatic.com	54 KB
3	google-analytics.com www.google-analytics.com	18 KB
1	googletagmanager.com www.googletagmanager.com	25 KB
1	googleapis.com fonts.googleapis.com	807 B
1	401trg.pw 1 redirects 401trg.pw	312 B
0	ghost.io Failed protectwise-401trg.ghost.io Failed
24	7

	Domain	Requested by
15	401trg.com	1 redirects 401trg.com
4	fonts.gstatic.com	401trg.com
3	www.google-analytics.com	www.googletagmanager.com 401trg.com
1	www.googletagmanager.com	401trg.com
1	fonts.googleapis.com	401trg.com
1	401trg.pw	1 redirects
0	protectwise-401trg.ghost.io Failed	401trg.com
24	7

This site contains links to these domains. Also see Links.

Domain
cloud.feedly.com
twitter.com
github.com
securelist.com
www.novetta.com
krebsonsecurity.com
www.fireeye.com
blog.cylance.com
blog.trendmicro.com
citizenlab.ca
researchcenter.paloaltonetworks.com
www.intezer.com
www.facebook.com
plus.google.com
www.reddit.com
401trg.pw
www.protectwise.com

Subject Issuer	Validity	Valid
401trg.com CloudFlare Inc ECC CA-2	`2019-05-01` - `2020-05-01`	a year	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-06-11` - `2019-09-03`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://401trg.com/burning-umbrella/
Frame ID: 2C3E6A31ACAEBC619D1594B89C1614F4
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://401trg.pw/burning-umbrella HTTP 301
https://401trg.com/burning-umbrella HTTP 301
https://401trg.com/burning-umbrella/ Page URL

Detected technologies

Ghost (Blogs) Expand

Overall confidence: 100%
Detected patterns

meta generator /Ghost(?:\s([\d.]+))?/i

Node.js (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /Ghost(?:\s([\d.]+))?/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

24
Requests

96 %
HTTPS

83 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

3458 kB
Transfer

3922 kB
Size

3
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: http://cloud.feedly.com/#subscription/feed/https://401trg.com/rss/
Title: via RSS

Search URL Search Domain Scan URL

URL: https://twitter.com/401TRG

Search URL Search Domain Scan URL

URL: https://github.com/401TRG

Search URL Search Domain Scan URL

URL: https://github.com/401trg/detections/raw/master/pdfs/20180503_Burning_Umbrella.pdf
Title: in the PDF version

Search URL Search Domain Scan URL

URL: https://github.com/401trg/detections/tree/master/ioc
Title: GitHub Detection IOC

Search URL Search Domain Scan URL

URL: https://securelist.com/winnti-more-than-just-a-game/37029/
Title: on the original Winnti group

Search URL Search Domain Scan URL

URL: https://securelist.com/winnti-1-0-technical-analysis/37002/
Title: Winnti samples

Search URL Search Domain Scan URL

URL: https://securelist.com/the-winnti-honeypot-luring-intruders/35623/
Title: various honeypot analysis methods

Search URL Search Domain Scan URL

URL: http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
Title: outstanding report detailing “Operation SMN,”

Search URL Search Domain Scan URL

URL: https://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread-malware/
Title: Bit9 in 2013

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html
Title: FireEye’s “Operation DeputyDog”

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
Title: APT1 report by Mandiant

Search URL Search Domain Scan URL

URL: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies
Title: released a blog post

Search URL Search Domain Scan URL

URL: https://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/
Title: Trend Micro reported

Search URL Search Domain Scan URL

URL: https://blog.trendmicro.com/trendlabs-security-intelligence/pigs-malware-examining-possible-member-winnti-group/
Title: who happens to be a fan of pigs

Search URL Search Domain Scan URL

URL: https://citizenlab.ca/2017/07/insider-information-an-intrusion-campaign-targeting-chinese-language-news-sites/
Title: Citizen Lab reported

Search URL Search Domain Scan URL

URL: https://researchcenter.paloaltonetworks.com/2015/11/attack-campaign-on-the-government-of-thailand-delivers-bookworm-trojan/
Title: a Palo Alto Unit 42 blog post

Search URL Search Domain Scan URL

URL: https://securelist.com/shadowpad-in-corporate-networks/81432/
Title: Kaspersky reported on ShadowPad

Search URL Search Domain Scan URL

URL: https://twitter.com/craiu/status/910059453948579840
Title: Kaspersky

Search URL Search Domain Scan URL

URL: http://www.intezer.com/evidence-aurora-operation-still-active-supply-chain-attack-through-ccleaner/
Title: Intezer

Search URL Search Domain Scan URL

URL: http://www.novetta.com/wp-content/uploads/2014/11/Hashes.txt
Title: many associated hashes

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Burning%20Umbrella%3A%20An%20Intelligence%20Report%20on%20the%20Winnti%20Umbrella%20and%20Associated%20State-Sponsored%20Attackers&url=https://401trg.com/burning-umbrella/
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://401trg.com/burning-umbrella/
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://401trg.com/burning-umbrella/
Title:

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://401trg.com/burning-umbrella/
Title:

Search URL Search Domain Scan URL

URL: https://401trg.pw/rss/
Title: via RSS

Search URL Search Domain Scan URL

URL: https://www.protectwise.com/
Title: ProtectWise

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://401trg.pw/burning-umbrella HTTP 301
https://401trg.com/burning-umbrella HTTP 301
https://401trg.com/burning-umbrella/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
401trg.com/burning-umbrella/
Redirect Chain

http://401trg.pw/burning-umbrella
https://401trg.com/burning-umbrella
https://401trg.com/burning-umbrella/

49 KB
15 KB

113ms
113ms

Document
text/html

104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cc4a818498689c00c8506251eb28c9322607b57bd5b714ccec58547bab37539

Request headers

:method: GET
:authority: 401trg.com
:scheme: https
:path: /burning-umbrella/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
cookie: __cfduid=d87746b237f8ae69eb41c894292ef27f51562601980
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200 200 OK
date: Mon, 08 Jul 2019 16:06:20 GMT
content-type: text/html; charset=utf-8
cache-control: public, max-age=0
cf-railgun: 3b32b60b11 stream 0.000000 0200 e6be
last-modified: Mon, 08 Jul 2019 13:43:44 GMT
vary: Accept-Encoding
x-ghost-cache-status: From Cache
x-request-id: 05bb47ede1b04eb6a52919adbe1360c5
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4f334e09ecd59bd9-AMS
content-encoding: gzip

Redirect headers

status: 301 301 Moved Permanently
date: Mon, 08 Jul 2019 16:06:20 GMT
content-length: 0
set-cookie: __cfduid=d87746b237f8ae69eb41c894292ef27f51562601980; expires=Tue, 07-Jul-20 16:06:20 GMT; path=/; domain=.401trg.com; HttpOnly
cache-control: public, max-age=31536000
cf-railgun: direct (starting new WAN connection)
last-modified: Mon, 08 Jul 2019 15:17:46 GMT
location: /burning-umbrella/
x-ghost-cache-status: From Cache
x-request-id: 80a2dc3eb37477301fb7f41a6b8118e2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4f334e092c049bd9-AMS

GET
H2 200 styles.min.css
401trg.com/assets/css/ 118 KB
22 KB 105ms
104ms Stylesheet
text/css 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/css/styles.min.css?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb0d0cc4c156ac9be2b02558b83d1cc1c3b2ff898135a81f4c82de627fc95147

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 03 Jul 2019 13:39:44 GMT
server: cloudflare
age: 433654
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0a9dc79bd9-AMS
x-request-id: 74fcbc1852c0d73aa0b0f03a11505383
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 vendors.min.css
401trg.com/assets/css/ 15 KB
4 KB 104ms
104ms Stylesheet
text/css 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/css/vendors.min.css?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18ab41f7bec11dcbec81224e3892c94bf5254e4f8d552ccace0b047fef3a6875

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 03 Jul 2019 13:44:55 GMT
server: cloudflare
age: 433654
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0a9dc99bd9-AMS
x-request-id: 97b4db0c3491572cceeee1c0b447a3ed
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 css
fonts.googleapis.com/ 9 KB
807 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:815::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,400i,500,700,700i

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

669594bf88f12c0c989af8b067f39c4b68e86593d3931ce2d2c72d544c971db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 08 Jul 2019 16:06:20 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 08 Jul 2019 16:06:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Mon, 08 Jul 2019 16:06:20 GMT

GET
H2 200 ghost-sdk.min.js Show response
401trg.com/public/ 763 B
656 B 98ms
98ms Script
application/javascript 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/public/ghost-sdk.min.js?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 315118a9459632492ce41d3c1172906a89a6c729d6c8527886ae7e710f7a86a6

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 07 Jul 2019 14:05:21 GMT
server: cloudflare
age: 97259
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200, 200 OK
x-ghost-cache-status: From Backend - Cached
cache-control: public, max-age=31536000
cf-ray: 4f334e0aadca9bd9-AMS
x-request-id: 795ddf765041fba7749a038ca1606a54
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 65 KB
25 KB 41ms
40ms Script
application/javascript 2a00:1450:4001:824::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-106829284-1

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

53596caf4bb8d90c611cd2138df7714ee0c012e27fc41ac3ed043d2b0f87a4ce

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: br
last-modified: Mon, 08 Jul 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 25541
x-xss-protection: 0
expires: Mon, 08 Jul 2019 16:06:20 GMT

GET
H2 200 401trg_large_dark.png
401trg.com/content/images/2017/10/ 57 KB
57 KB 100ms
99ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2017/10/401trg_large_dark.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc3b708d034e0b2175cef2de23b7224c13128b8d0b38c3522c2f5edfca41507d

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Sat, 06 Jul 2019 18:04:59 GMT
server: cloudflare
age: 163028
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0aadcb9bd9-AMS
x-request-id: d3f2d943451956f645084319a92814c1
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 1.png
401trg.com/content/images/2018/04/ 206 KB
206 KB 94ms
93ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2018/04/1.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 606f00a94ed073c9ce9169cb20fe71d196453b9fbf42ee4ef3468969f2e3e278

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jul 2019 08:01:13 GMT
server: cloudflare
age: 27524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf059bd9-AMS
x-request-id: e477219710a8bc3abf3f7c4de40bce57
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 email_phish.png
401trg.com/content/images/2018/04/ 202 KB
202 KB 132ms
131ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2018/04/email_phish.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 410185ee0ceb0e927bfded1f6d25f43390a369feccec3f86bcbbee63ec876d57

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jul 2019 08:01:13 GMT
server: cloudflare
age: 27524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf069bd9-AMS
x-request-id: adef39b262fff84f0c8adea2aecc7c09
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 t2.png
401trg.com/content/images/2018/04/ 147 KB
148 KB 132ms
131ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2018/04/t2.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dad5530be9775476bd3dc431b429360a5b08226526413b3ee058732b48619c8

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jul 2019 08:01:13 GMT
server: cloudflare
age: 27524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf079bd9-AMS
x-request-id: 3243cc65df993dc68d476ef0a63d5e38
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 Screen-Shot-2018-03-30-at-1.07.29-PM-copy.png
401trg.com/content/images/2018/04/ 339 KB
340 KB 132ms
131ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2018/04/Screen-Shot-2018-03-30-at-1.07.29-PM-copy.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 183762c4f6aa617882cf4c3709fd80b04d452bee429bf5cefefc4b052706bd4e

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jul 2019 08:01:13 GMT
server: cloudflare
age: 27524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf0a9bd9-AMS
x-request-id: 71488f1a7a3bcb1fdc1b73132ae28796
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 map.png
401trg.com/content/images/2018/04/ 2 MB
2 MB 133ms
132ms Image
image/png 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://401trg.com/content/images/2018/04/map.png
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 107a129a1fdbf4f9fb1ea07a5e3cad255c85359221f9e2a0aa730ceee97a3675

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: HIT
last-modified: Mon, 08 Jul 2019 09:27:36 GMT
server: cloudflare
age: 27524
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200, 200 OK
x-ghost-cache-status: From Backend - Cached
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf0c9bd9-AMS
x-request-id: 905c4c8db7c1c048983d4177c4fcc81d
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 vendors.min.js Show response
401trg.com/assets/js/ 332 KB
90 KB 142ms
142ms Script
application/javascript 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/js/vendors.min.js?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 824abdffc4d69f4154d48489f39c32fef7e8109d622a07d975450e0200bff72c

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 03 Jul 2019 02:53:33 GMT
server: cloudflare
age: 482977
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0ade199bd9-AMS
x-request-id: 0580629b1c18d169ae7b3fe23157b94b
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 main.min.js Show response
401trg.com/assets/js/ 2 KB
1 KB 94ms
93ms Script
application/javascript 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/js/main.min.js?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b5a4399e1f0b331e31017bcfbe5c8b5e09861402ea233273e5bddcec0eb976d

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 03 Jul 2019 15:27:27 GMT
server: cloudflare
age: 433654
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0b3e759bd9-AMS
x-request-id: 99f51d749f2589f84206320f323ae2a9
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 prism.min.js Show response
401trg.com/assets/js/ 17 KB
7 KB 133ms
131ms Script
application/javascript 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/js/prism.min.js?v=506578765a
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5cb184c3e8093cf7825531764e7a9eabb0ca69065f785578e1202387baf2530

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 Jul 2019 19:34:59 GMT
server: cloudflare
age: 239158
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf049bd9-AMS
x-request-id: 2b757bc1f2d11a7daba8c257ca549218
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 fontawesome-webfont.woff2
401trg.com/assets/fonts/ 75 KB
76 KB 128ms
128ms Font
application/font-woff2 104.18.131.189
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://401trg.com/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: 401trg.com
URL: https://401trg.com/burning-umbrella/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.18.131.189 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://401trg.com/assets/css/styles.min.css?v=506578765a
Origin: https://401trg.com

Response headers

date: Mon, 08 Jul 2019 16:06:20 GMT
cf-cache-status: MISS
last-modified: Mon, 08 Jul 2019 13:39:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff2
status: 200, 200 OK
x-ghost-cache-status: From Cache
cache-control: public, max-age=31536000
cf-ray: 4f334e0bcf149bd9-AMS
x-request-id: 4be18b830b2bf0ffc330fb5798d553b4
expires: Tue, 07 Jul 2020 16:06:20 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v13/ 13 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v13/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:400,400i,500,700,700i
Origin: https://401trg.com

Response headers

date: Sat, 01 Jun 2019 12:20:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:05:58 GMT
server: sffe
age: 3210358
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13708
x-xss-protection: 0
expires: Sun, 31 May 2020 12:20:22 GMT

GET
H2 200 JTUQjIg1_i6t8kCHKm459WxRyS7m0dR9pA.woff2
fonts.gstatic.com/s/montserrat/v13/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v13/JTUQjIg1_i6t8kCHKm459WxRyS7m0dR9pA.woff2

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ff4eb7e4df6e09b7fba76e1957f3fc0f703496a13d23a5a245bb2709810b0c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:400,400i,500,700,700i
Origin: https://401trg.com

Response headers

date: Sat, 01 Jun 2019 00:16:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:06:53 GMT
server: sffe
age: 3253802
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14024
x-xss-protection: 0
expires: Sun, 31 May 2020 00:16:18 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v13/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v13/JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:400,400i,500,700,700i
Origin: https://401trg.com

Response headers

date: Fri, 31 May 2019 07:24:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:07:24 GMT
server: sffe
age: 3314519
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13612
x-xss-protection: 0
expires: Sat, 30 May 2020 07:24:21 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v13/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v13/JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Montserrat:400,400i,500,700,700i
Origin: https://401trg.com

Response headers

date: Sat, 01 Jun 2019 00:14:21 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:06:19 GMT
server: sffe
age: 3253919
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13640
x-xss-protection: 0
expires: Sun, 31 May 2020 00:14:21 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-106829284-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jun 2019 21:35:04 GMT
server: Golfe2
age: 5922
date: Mon, 08 Jul 2019 14:27:38 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17707
expires: Mon, 08 Jul 2019 16:27:38 GMT

GET /
protectwise-401trg.ghost.io/ghost/api/v0.1/posts/ 0
0

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 14ms
13ms Image
image/gif 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j77&a=638564239&t=pageview&_s=1&dl=https%3A%2F%2F401trg.com%2Fburning-umbrella%2F&ul=en-us&de=UTF-8&dt=Burning%20Umbrella%3A%20An%20Intelligence%20Report%20on%20the%20Winnti%20Umbrella%20and%20Associated%20State-Sponsored%20Attackers&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=1672761259&gjid=1089044234&cid=2142610970.1562601981&tid=UA-106829284-1&_gid=505336022.1562601981&_r=1&gtm=2ou6k2&z=1224149343

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 08 Jul 2019 16:06:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
99 B 6ms
5ms Image
image/gif 2a00:1450:4001:814::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j77&a=638564239&t=pageview&_s=2&dl=https%3A%2F%2F401trg.com%2Fburning-umbrella%2F&ul=en-us&de=UTF-8&dt=Burning%20Umbrella%3A%20An%20Intelligence%20Report%20on%20the%20Winnti%20Umbrella%20and%20Associated%20State-Sponsored%20Attackers&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=KEBAAUAB~&jid=&gjid=&cid=2142610970.1562601981&tid=UA-106829284-1&_gid=505336022.1562601981&gtm=2ou6k2&z=1367432722

Requested by

Host: 401trg.com
URL: https://401trg.com/burning-umbrella/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://401trg.com/burning-umbrella/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Jun 2019 04:34:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3151890
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: protectwise-401trg.ghost.io
URL: https://protectwise-401trg.ghost.io/ghost/api/v0.1/posts/?limit=all&include=tags&client_id=ghost-frontend&client_secret=33c00364a977

Verdicts & Comments Add Verdict or Comment

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.401trg.com/	1970-01-19 02:03:22	Name: _gat_gtag_UA_106829284_1 Value: 1
.401trg.com/	1970-01-19 02:04:48	Name: _gid Value: GA1.2.505336022.1562601981
.401trg.com/	1970-01-19 19:34:33	Name: _ga Value: GA1.2.2142610970.1562601981

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

401trg.com
401trg.pw
fonts.googleapis.com
fonts.gstatic.com
protectwise-401trg.ghost.io
www.google-analytics.com
www.googletagmanager.com
protectwise-401trg.ghost.io
104.18.131.189
2606:4700:30::681f:5b32
2a00:1450:4001:814::200e
2a00:1450:4001:815::200a
2a00:1450:4001:819::2003
2a00:1450:4001:824::2008
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
107a129a1fdbf4f9fb1ea07a5e3cad255c85359221f9e2a0aa730ceee97a3675
183762c4f6aa617882cf4c3709fd80b04d452bee429bf5cefefc4b052706bd4e
18ab41f7bec11dcbec81224e3892c94bf5254e4f8d552ccace0b047fef3a6875
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b5a4399e1f0b331e31017bcfbe5c8b5e09861402ea233273e5bddcec0eb976d
315118a9459632492ce41d3c1172906a89a6c729d6c8527886ae7e710f7a86a6
3cc4a818498689c00c8506251eb28c9322607b57bd5b714ccec58547bab37539
410185ee0ceb0e927bfded1f6d25f43390a369feccec3f86bcbbee63ec876d57
4c6cf0709b8e52572cae1fb57128acd0a5a453c9ce99dc3712a1860ff90c6bf8
4dad5530be9775476bd3dc431b429360a5b08226526413b3ee058732b48619c8
53596caf4bb8d90c611cd2138df7714ee0c012e27fc41ac3ed043d2b0f87a4ce
606f00a94ed073c9ce9169cb20fe71d196453b9fbf42ee4ef3468969f2e3e278
669594bf88f12c0c989af8b067f39c4b68e86593d3931ce2d2c72d544c971db8
824abdffc4d69f4154d48489f39c32fef7e8109d622a07d975450e0200bff72c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
b5cb184c3e8093cf7825531764e7a9eabb0ca69065f785578e1202387baf2530
bc3b708d034e0b2175cef2de23b7224c13128b8d0b38c3522c2f5edfca41507d
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
fb0d0cc4c156ac9be2b02558b83d1cc1c3b2ff898135a81f4c82de627fc95147
ff4eb7e4df6e09b7fba76e1957f3fc0f703496a13d23a5a245bb2709810b0c43

401trg.com Open in urlscan Pro 104.18.131.189 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

24 Requests

96 %HTTPS

83 %IPv6

7 Domains

7 Subdomains

6 IPs

2 Countries

3458 kBTransfer

3922 kBSize

3 Cookies

27 Outgoing links

Page URL History

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

34 JavaScript Global Variables

3 Cookies

Indicators

401trg.com Open in urlscan Pro
104.18.131.189 Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

96 %
HTTPS

83 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

3458 kB
Transfer

3922 kB
Size

3
Cookies

24 HTTP transactions
0 data transactions