www.trendmicro.com Open in urlscan Pro
23.4.218.115 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-tric...
Submission: On July 26 via api (July 26th 2021, 10:58:34 pm UTC) from US

Summary HTTP 152 Redirects Links 62 Behaviour Indicators

Summary

This website contacted 54 IPs in 6 countries across 39 domains to perform 152 HTTP transactions. The main IP is 23.4.218.115, located in London, United Kingdom and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on July 15th 2021. Valid for: a year.

This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
25	23.4.218.115 23.4.218.115	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:10:... 2606:4700:10::6816:335d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::ac43:1b98	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	104.109.77.38 104.109.77.38	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
7	34.96.102.137 34.96.102.137	15169 (GOOGLE) (GOOGLE)
1	35.201.125.192 35.201.125.192	15169 (GOOGLE) (GOOGLE)
1	34.102.193.142 34.102.193.142	15169 (GOOGLE) (GOOGLE)
1 8	2600:9000:20b... 2600:9000:20bd:1600:0:f267:a5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	35.190.5.192 35.190.5.192	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
2	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2ae::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	52.70.141.7 52.70.141.7	14618 (AMAZON-AES) (AMAZON-AES)
1	13.224.111.35 13.224.111.35	16509 (AMAZON-02) (AMAZON-02)
1	13.224.111.126 13.224.111.126	16509 (AMAZON-02) (AMAZON-02)
14	23.4.213.149 23.4.213.149	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.95.105.148 34.95.105.148	15169 (GOOGLE) (GOOGLE)
1 3	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.224.114.214 13.224.114.214	16509 (AMAZON-02) (AMAZON-02)
1 1	35.201.70.94 35.201.70.94	15169 (GOOGLE) (GOOGLE)
2 2	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
3 3	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2600:9000:20c... 2600:9000:20c8:8a00:12:3734:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	2620:119:50e1... 2620:119:50e1:101::6cae:b25	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
1	2600:9000:20c... 2600:9000:20c8:2c00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	13.225.87.108 13.225.87.108	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
2	13.224.111.100 13.224.111.100	16509 (AMAZON-02) (AMAZON-02)
2 2	52.16.214.249 52.16.214.249	16509 (AMAZON-02) (AMAZON-02)
1 2	13.224.111.91 13.224.111.91	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	54.93.136.75 54.93.136.75	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	3.213.166.67 3.213.166.67	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
2	35.194.81.74 35.194.81.74	15169 (GOOGLE) (GOOGLE)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	34.254.127.126 34.254.127.126	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
152	54

25 23.4.218.115 (London, United Kingdom)

ASN16625 (AKAMAI-AS, US)
PTR: a23-4-218-115.deploy.static.akamaitechnologies.com

www.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:335d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.datatables.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:1b98 (United States)

ASN13335 (CLOUDFLARENET, US)

customer.cludo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 104.109.77.38 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-77-38.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.96.102.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.125.201.35.bc.googleusercontent.com

cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.193.142 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 142.193.102.34.bc.googleusercontent.com

ixfd1-api.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:20bd:1600:0:f267:a5c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

marvel-b1-cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.5.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.5.190.35.bc.googleusercontent.com

cdn.b0e8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2ae::3adf (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.74.206 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.141.7 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-141-7.compute-1.amazonaws.com

resources.xg4ken.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.111.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-111-35.mad50.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.111.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-111-126.mad50.r.cloudfront.net

js.idio.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.4.213.149 (London, United Kingdom)

ASN16625 (AKAMAI-AS, US)
PTR: a23-4-213-149.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.105.148 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 148.105.95.34.bc.googleusercontent.com

a.b0e8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

5427711.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.114.214 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-114-214.mad50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.70.94 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 94.70.201.35.bc.googleusercontent.com

marvel-processor.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.153.60 (Secaucus, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.53 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20c8:8a00:12:3734:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e1:101::6cae:b25 (United States) 2 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c8:2c00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.87.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-108.fra2.r.cloudfront.net

s.idio.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.111.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-111-100.mad50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.16.214.249 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-214-249.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.111.91 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-224-111-91.mad50.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.136.75 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-136-75.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.213.166.67 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-166-67.compute-1.amazonaws.com

a.idio.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.194.81.74 (Washington, United States)

ASN15169 (GOOGLE, US)
PTR: 74.81.194.35.bc.googleusercontent.com

r3.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.254.127.126 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-127-126.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	trendmicro.com www.trendmicro.com documents.trendmicro.com Failed resources.trendmicro.com	512 KB
18	tiqcdn.com tags.tiqcdn.com	57 KB
14	6sc.co j.6sc.co c.6sc.co b.6sc.co	18 KB
11	bc0a.com 2 redirects cdn.bc0a.com ixfd1-api.bc0a.com marvel-b1-cdn.bc0a.com marvel-processor.bc0a.com	225 KB
10	google-analytics.com www.google-analytics.com ssl.google-analytics.com	58 KB
9	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com r3.visualwebsiteoptimizer.com	179 KB
7	doubleclick.net 2 redirects stats.g.doubleclick.net 5427711.fls.doubleclick.net googleads.g.doubleclick.net	2 KB
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	4 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	3 KB
4	idio.co js.idio.co s.idio.co a.idio.co	12 KB
3	google.com 1 redirects www.google.com adservice.google.com	689 B
3	adnxs.com 3 redirects secure.adnxs.com	3 KB
3	bing.com bat.bing.com	9 KB
3	gstatic.com fonts.gstatic.com	44 KB
3	googleapis.com fonts.googleapis.com ajax.googleapis.com	76 KB
2	facebook.com www.facebook.com	388 B
2	google.de www.google.de	218 B
2	6sense.com epsilon.6sense.com	439 B
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	ml-api.io attr.ml-api.io	483 B
2	ml-attr.com 2 redirects s.ml-attr.com	566 B
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	3 KB
2	facebook.net connect.facebook.net	99 KB
2	googleadservices.com www.googleadservices.com	15 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	marketo.net munchkin.marketo.net	7 KB
2	youtube.com www.youtube.com	43 KB
2	b0e8.com cdn.b0e8.com a.b0e8.com	22 KB
2	googletagmanager.com www.googletagmanager.com	90 KB
1	twitter.com analytics.twitter.com	658 B
1	rlcdn.com id.rlcdn.com	66 B
1	t.co t.co	454 B
1	quantcount.com rules.quantcount.com	438 B
1	demandbase.com scripts.demandbase.com	17 KB
1	xg4ken.com resources.xg4ken.com	4 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	bizographics.com sjs.bizographics.com	2 KB
1	cludo.com customer.cludo.com	3 KB
1	datatables.net cdn.datatables.net	2 KB
152	39

	Domain	Requested by
25	www.trendmicro.com	www.trendmicro.com
18	tags.tiqcdn.com	www.trendmicro.com tags.tiqcdn.com
12	b.6sc.co	www.trendmicro.com
8	marvel-b1-cdn.bc0a.com	1 redirects www.trendmicro.com
8	www.google-analytics.com	www.trendmicro.com www.google-analytics.com www.googletagmanager.com
7	dev.visualwebsiteoptimizer.com	tags.tiqcdn.com dev.visualwebsiteoptimizer.com www.trendmicro.com
3	secure.adnxs.com	3 redirects
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.trendmicro.com
3	5427711.fls.doubleclick.net	1 redirects www.googletagmanager.com www.trendmicro.com
3	fonts.gstatic.com	fonts.googleapis.com
2	r3.visualwebsiteoptimizer.com	dev.visualwebsiteoptimizer.com
2	www.facebook.com	www.trendmicro.com
2	www.google.de	www.trendmicro.com
2	www.google.com	1 redirects www.trendmicro.com
2	epsilon.6sense.com	j.6sc.co
2	segments.company-target.com	1 redirects www.trendmicro.com
2	match.prod.bidr.io	2 redirects
2	api.company-target.com	scripts.demandbase.com
2	s.idio.co	js.idio.co
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	px.ads.linkedin.com	2 redirects
2	attr.ml-api.io	www.trendmicro.com
2	s.ml-attr.com	2 redirects
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	www.googleadservices.com	tags.tiqcdn.com www.googleadservices.com
2	munchkin.marketo.net	tags.tiqcdn.com munchkin.marketo.net
2	ssl.google-analytics.com	tags.tiqcdn.com www.trendmicro.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	www.youtube.com	tags.tiqcdn.com www.youtube.com
2	www.googletagmanager.com	www.trendmicro.com tags.tiqcdn.com
2	ajax.googleapis.com	www.trendmicro.com
1	insight.adsrvr.org	js.adsrvr.org
1	analytics.twitter.com	static.ads-twitter.com
1	pixel.quantserve.com	www.trendmicro.com
1	adservice.google.com	5427711.fls.doubleclick.net
1	a.idio.co	www.trendmicro.com
1	id.rlcdn.com	www.trendmicro.com
1	t.co	www.trendmicro.com
1	c.6sc.co	j.6sc.co
1	rules.quantcount.com	secure.quantserve.com
1	px4.ads.linkedin.com	www.trendmicro.com
1	www.linkedin.com	1 redirects
1	marvel-processor.bc0a.com	1 redirects
1	js.adsrvr.org	www.googletagmanager.com
1	a.b0e8.com	www.trendmicro.com
1	j.6sc.co	tags.tiqcdn.com
1	js.idio.co	tags.tiqcdn.com
1	scripts.demandbase.com	tags.tiqcdn.com
1	resources.xg4ken.com	tags.tiqcdn.com
1	static.ads-twitter.com	tags.tiqcdn.com
1	resources.trendmicro.com	tags.tiqcdn.com
1	sjs.bizographics.com	tags.tiqcdn.com
1	secure.quantserve.com	tags.tiqcdn.com
1	cdn.b0e8.com	www.trendmicro.com
1	ixfd1-api.bc0a.com	cdn.bc0a.com
1	cdn.bc0a.com	tags.tiqcdn.com
1	fonts.googleapis.com	www.trendmicro.com
1	customer.cludo.com	www.trendmicro.com
1	cdn.datatables.net	www.trendmicro.com
0	documents.trendmicro.com Failed	www.trendmicro.com
152	60

This site contains links to these domains. Also see Links.

Domain
downloadcenter.trendmicro.com
store.trendmicro.com
buyonline.trendmicro.com
renewonline.trendmicro.com
www.trendmicro.cz
success.trendmicro.com
esupport.trendmicro.com
community-trendmicro.force.com
www.trendsecure.com
pwm.trendmicro.com
clp.trendmicro.com
sso.trendmicro.com
tm.login.trendmicro.com
cloudone.trendmicro.com
signup.cj.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
www.instagram.com
www.zerodayinitiative.com
trendmicro.com
newsroom.trendmicro.com
plus.google.com
research.checkpoint.com
www.securitymagazine.com
www.secpod.com
www.bleepingcomputer.com
www.coveware.com
threatpost.com
www.wwnytv.com
www.nbcnews.com
support.microsoft.com
activedirectorypro.com
help.deepsecurity.trendmicro.com
us-cert.cisa.gov
gist.github.com
feeds.feedburner.com

Subject Issuer	Validity	Valid
www.trendmicro.com Entrust Certification Authority - L1M	`2021-07-15` - `2022-08-13`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-28` - `2022-06-27`	a year	crt.sh
*.cludo.com AlphaSSL CA - SHA256 - G2	`2021-04-06` - `2022-05-08`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2021-04-19` - `2022-04-27`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2020-06-19` - `2022-07-06`	2 years	crt.sh
cdn.bc0a.com GTS CA 1D4	`2021-06-30` - `2021-09-28`	3 months	crt.sh
ixfd-api.bc0a.com GTS CA 1D4	`2021-07-01` - `2021-09-29`	3 months	crt.sh
marvel-cdn.bc0a.com Amazon	`2021-03-10` - `2022-04-08`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
cdn.b0e8.com GTS CA 1D4	`2021-06-27` - `2021-09-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2020-03-23` - `2022-03-28`	2 years	crt.sh
resources.trendmicro.com Cloudflare Inc ECC CA-3	`2021-06-24` - `2022-06-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.xg4ken.com Go Daddy Secure Certificate Authority - G2	`2020-09-14` - `2021-10-16`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2020-10-14` - `2021-11-15`	a year	crt.sh
idio.co R3	`2021-06-18` - `2021-09-16`	3 months	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
b0e8.com GTS CA 1D4	`2021-06-29` - `2021-09-27`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-04-12` - `2021-10-12`	6 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.ml-api.io Amazon	`2021-01-20` - `2022-02-17`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-04-15` - `2021-10-15`	6 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2020-10-09` - `2021-10-28`	a year	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.6sense.com Amazon	`2021-06-30` - `2022-07-29`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Frame ID: E6446FE7E3CD692C6FDB04DA18E08563
Requests: 148 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Frame ID: FEDA54AC7EDDFF05057DE575B153553D
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&upid=803df29&upv=1.1.0
Frame ID: 671246137B6BE8E06B3C739773EE84B8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/clientlibs\//i
script /\/etc.clientlibs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/clientlibs\//i
script /\/etc.clientlibs\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Google Analytics Enhanced eCommerce (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

script /munchkin\.marketo\.net\/munchkin\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i

Visual Website Optimizer (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /dev\.visualwebsiteoptimizer\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

152
Requests

95 %
HTTPS

47 %
IPv6

39
Domains

60
Subdomains

54
IPs

6
Countries

1518 kB
Transfer

5057 kB
Size

29
Cookies

62 Outgoing links

These are links going to different origins than the main page.

URL: http://downloadcenter.trendmicro.com/index.php?clk=left_nav&clkval=rss_feed&regs=NABU
Title: Subscribe to Download Center RSS

Search URL Search Domain Scan URL

URL: http://store.trendmicro.com/store/tmamer/Content/pbPage.Home/pgm.4823570300/
Title: Home Office Online Store

Search URL Search Domain Scan URL

URL: http://store.trendmicro.com/store/tmamer/html/pbPage.ManualRenew/ThemeID.7735600
Title: Renew Online

Search URL Search Domain Scan URL

URL: http://buyonline.trendmicro.com/
Title: Buy Online

Search URL Search Domain Scan URL

URL: http://renewonline.trendmicro.com/
Title: Renew Online

Search URL Search Domain Scan URL

URL: http://www.trendmicro.cz/
Title: Česká Republika

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/sign-in
Title: My Support

Search URL Search Domain Scan URL

URL: https://esupport.trendmicro.com/en-us/home/index.aspx
Title: Log In to Support

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Partner
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://www.trendsecure.com/my_account/signin/login
Title: My Account

Search URL Search Domain Scan URL

URL: https://www.trendsecure.com/report_stolen/locker/report
Title: Trend Micro Vault

Search URL Search Domain Scan URL

URL: http://pwm.trendmicro.com/
Title: Password Manager

Search URL Search Domain Scan URL

URL: https://clp.trendmicro.com/
Title: Customer Licensing Portal

Search URL Search Domain Scan URL

URL: https://esupport.trendmicro.com/oct
Title: Online Case Tracking

Search URL Search Domain Scan URL

URL: https://sso.trendmicro.com/sso/form/authenticate.aspx
Title: Worry-Free Business Security Services

Search URL Search Domain Scan URL

URL: https://tm.login.trendmicro.com/authenticate/api/false/tmrm
Title: Remote Manager

Search URL Search Domain Scan URL

URL: https://cloudone.trendmicro.com/
Title: Cloud One

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1157059
Title: Referral Affiliate

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t
Title: Referral Affiliate

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/technical-support
Title: Support

Search URL Search Domain Scan URL

URL: https://www.facebook.com/TrendMicro/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/trendmicro
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro/
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/TrendMicroInc
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/trendmicro/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.zerodayinitiative.com/about/
Title: Zero Day Initiative (ZDI)

Search URL Search Domain Scan URL

URL: http://trendmicro.com/public-cloud-risk-assessment
Title: Cloud Health Assessment

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/business-support
Title: Business Support

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/virus-and-threat-help
Title: Virus & Threat Help

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/renewals-and-registration
Title: Renewals & Registration

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/contact-support-north-america
Title: Contact Support

Search URL Search Domain Scan URL

URL: http://downloadcenter.trendmicro.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/virus-and-threat-help#threat-removal
Title: Free Cleanup Tools

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/deep-security-10-0
Title: Deep Security

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/apex-one
Title: Apex One

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/worry-free-business-security
Title: Worry-Free

Search URL Search Domain Scan URL

URL: http://renewonline.trendmicro.com/us/default.aspx
Title: Worry-Free Renewals

Search URL Search Domain Scan URL

URL: https://newsroom.trendmicro.com/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&text=Ryuk%202020:%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader&tw_p=tweetbutton&url=https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Title: Twitter

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=Ryuk%202020:%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Title: Google+

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&title=Ryuk%202020:%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader&summary=Ryuk%202020:%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2018/ryuk-ransomware-targeted-campaign-break/
Title: first appeared

Search URL Search Domain Scan URL

URL: https://www.securitymagazine.com/articles/93769-ryuk-ransomware-responsible-for-one-third-of-all-ransomware-attacks-in-2020
Title: third of all ransomware attacks

Search URL Search Domain Scan URL

URL: https://www.secpod.com/blog/ryuk-ransomware/
Title: propagation method

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/bazarloader-used-to-deploy-ryuk-ransomware-on-high-value-targets/
Title: BazarLoader (also known as BazarBackdoor)

Search URL Search Domain Scan URL

URL: https://www.coveware.com/blog/q1-2020-ransomware-marketplace-report
Title: the ransomware payment

Search URL Search Domain Scan URL

URL: https://threatpost.com/ryuk-ransomware-gang-zerologon-lightning-attack/160286/
Title: observed

Search URL Search Domain Scan URL

URL: https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-hospitals-dealing-with-computer-problems/
Title: were hit by a series of ransomware attacks

Search URL Search Domain Scan URL

URL: https://www.nbcnews.com/tech/tech-news/more-hospitals-hit-ransomware-feds-warn-about-cyberattacks-n1245292
Title: victimized by a Ryuk attack

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/solution/000280291
Title: this page

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/solution/000270328
Title: Zerologon

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/954422/how-to-remove-administrative-shares-in-windows-server-2008
Title: disabling administrative shares

Search URL Search Domain Scan URL

URL: https://activedirectorypro.com/disable-powershell-with-group-policy/
Title: PowerShell with Group Policy

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/solution/1122594-configuring-predictive-machine-learning-settings-in-apex-one
Title: Predictive Machine Learning

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/solution/1122593-configuring-behavior-monitoring-settings-in-apex-one
Title: Behavior Monitoring

Search URL Search Domain Scan URL

URL: https://help.deepsecurity.trendmicro.com/12_0/on-premise/disable-agent-self-protection.html?redirected=true
Title: enable Agent Self-Protection

Search URL Search Domain Scan URL

URL: https://us-cert.cisa.gov/ncas/alerts/aa20-302a
Title: found

Search URL Search Domain Scan URL

URL: https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456
Title: here

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro
Title: linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Trendmicro/
Title: facebook

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/TrendmicroSecurityNews
Title: rss

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 95

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader HTTP 302
https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Request Chain 99

https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314

Request Chain 104

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D46043%26time%3D1627340295320%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fvinfo%252Fus%252Fsecurity%252Fnews%252Fcybercrime-and-digital-threats%252Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&liSync=true&e_ipv6=AQLLsh9Y0o-ZxgAAAXrlCk6YLeJGPLXKQ9s11PS1NyRzGoFqTfl-LD0RtA6bKeyv7kySTsjD

Request Chain 116

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg&verifyHash=f581019d078d96a320d1a73cdbc805f62522a81c

Request Chain 124

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=Bz7_YN6sFtHC7_UPjayK0A4&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=Bz7_YN6sFtHC7_UPjayK0A4&cid=CAQSKQCNIrLMKgrpbDdfwTmGyCnP4uCsqXgZF6xIXMMvrKSqQe-8w_O1n0Ro&random=4224016767&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=Bz7_YN6sFtHC7_UPjayK0A4&cid=CAQSKQCNIrLMKgrpbDdfwTmGyCnP4uCsqXgZF6xIXMMvrKSqQe-8w_O1n0Ro&random=4224016767&resp=GooglemKTybQhCsO&ipr=y

Request Chain 133

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314

152 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader Show response
www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ 127 KB
21 KB 174ms
89ms Document
text/html 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

0577596e5918704476a4b3f46cb2fd1fe3430186d0b477c7edb11a28732a05db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:method: GET
:authority: www.trendmicro.com
:scheme: https
:path: /vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
content-type: text/html; charset=utf-8
strict-transport-security: max-age=15552000; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
x-prod-n-02: Yes
content-encoding: gzip
content-length: 21418
vary: Accept-Encoding
cache-control: private, max-age=246
date: Mon, 26 Jul 2021 22:58:14 GMT

GET
H2 200 TEx.css
www.trendmicro.com/vinfo/css/ 92 KB
16 KB 121ms
119ms Stylesheet
text/css 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/TEx.css?v1.1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

38955525fa945d94f96d6c5d969f5c1299fdd30c48ea471cba7f71490ee1ab61

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/TEx.css?v1.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 04 Mar 2019 06:59:58 GMT
server: nginx
etag: W/"4c814ce157d2d41:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=852
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-length: 16453
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:12:26 GMT

GET
H2 200 jquery.min.js Show response
www.trendmicro.com/etc/clientlibs/granite/ 111 KB
38 KB 138ms
136ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc/clientlibs/granite/jquery.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9f0173ed05fe8618c76272aaae6711ae0fa7ece07de8522cb6b0159d22b691f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /etc/clientlibs/granite/jquery.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-prod-a-01: Yes
x-prod-n-01: Yes
content-length: 38305
x-xss-protection: 1;mode=block
last-modified: Mon, 26 Jul 2021 19:32:11 GMT
server: nginx
date: Mon, 26 Jul 2021 22:58:14 GMT
x-frame-options: SAMEORIGIN
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=687
etag: "1ba4e-5c80bcf45d7fb"
accept-ranges: bytes
x-content-type-options: nosniff
expires: Mon, 26 Jul 2021 23:09:41 GMT

GET
H2 200 utils.min.js Show response
www.trendmicro.com/etc/clientlibs/granite/ 9 KB
4 KB 136ms
134ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc/clientlibs/granite/utils.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

fcea66becd77485eb760a9a65e38d47319f69b724ae046f9b246842a1daa6c18

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /etc/clientlibs/granite/utils.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-prod-a-01: Yes
x-prod-n-01: Yes
content-length: 3644
x-xss-protection: 1;mode=block
last-modified: Mon, 26 Jul 2021 19:25:24 GMT
server: nginx
date: Mon, 26 Jul 2021 22:58:14 GMT
x-frame-options: SAMEORIGIN
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=301
etag: "2547-5c80bb70a4d46"
accept-ranges: bytes
x-content-type-options: nosniff
expires: Mon, 26 Jul 2021 23:03:15 GMT

GET
H2 200 font-awesome.min.css
www.trendmicro.com/vinfo/css/ 30 KB
7 KB 97ms
96ms Stylesheet
text/css 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/font-awesome.min.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/font-awesome.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Dec 2016 07:50:34 GMT
server: nginx
etag: W/"0c15513285cd21:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=859
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-length: 6930
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:12:33 GMT

GET
H2 200 clientlibs.min.css
www.trendmicro.com/vinfo/css/ 303 KB
44 KB 125ms
124ms Stylesheet
text/css 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

01dbbe1ad2037e8bc294848eaccc27958f69e1ac205db64c6db69405e361b22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/clientlibs.min.css?Ver3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 15 May 2020 09:47:31 GMT
server: nginx
etag: W/"79c98da9d2ad61:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=896
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-length: 44964
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:13:10 GMT

GET
H2 200 customSiteStyle.css
www.trendmicro.com/vinfo/css/ 103 KB
16 KB 134ms
132ms Stylesheet
text/css 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

27dbc587cdeb9b04598011c76ee9511866c57028688169613a37005ed6d8ad84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/customSiteStyle.css?Ver3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Jul 2020 01:42:05 GMT
server: nginx
etag: W/"8bbd9dfa7f59d61:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=1709
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-length: 15923
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:26:43 GMT

GET
H2 200 jquery.dataTables.min.css
cdn.datatables.net/1.10.16/css/ 14 KB
2 KB 32ms
14ms Stylesheet
text/css 2606:4700:10::6816:335d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.datatables.net/1.10.16/css/jquery.dataTables.min.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:335d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

618d62ceaca1223e16de2c8939a1963a95c34b0ac75852f835f93e5b42f20871

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 4195881
content-length: 2109
last-modified: Tue, 08 Jun 2021 08:47:53 GMT
server: cloudflare
etag: "11209a1-364c-5c43d36b99356-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 67513b473abad6e9-FRA
access-control-allow-headers: origin, x-requested-with, content-type
expires: Wed, 08 Jun 2022 09:26:52 GMT

GET
H2 200 cludo-search.min.css
customer.cludo.com/css/296/1798/ 16 KB
3 KB 51ms
13ms Stylesheet
text/css 2606:4700:10::ac43:1b98
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 23 Jul 2021 06:41:16 GMT
server: cloudflare
age: 59556
etag: W/"0ce7abc8d7fd71:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=300
cf-ray: 67513b475f714db2-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-lb: 2

GET
H2 200 analytics.js Show response
www.trendmicro.com/vinfo/js/ 451 B
731 B 134ms
132ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/analytics.js?v1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3807e44914c34f9e293702693b49039f774b1eef7798a0fa8dfbb3c1992e32dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/analytics.js?v1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Tue, 14 Feb 2017 04:38:17 GMT
server: nginx
etag: "cee15a297c86d21:0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=582
date: Mon, 26 Jul 2021 22:58:14 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 451
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:07:56 GMT

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 24ms
9ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 833837b11cdc53ccd1bf38e94fec85d423a69ca8eab3791dd282434006fe9089

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Thu, 22 Jul 2021 19:37:51 GMT
server: AkamaiNetStorage
etag: "9b767e38eb594f1f2bb2480feafed7c2:1626982671.169595"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 953
expires: Mon, 26 Jul 2021 23:03:14 GMT

GET
H2 200 css
fonts.googleapis.com/ 10 KB
943 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cd618f046c2bae673dc4a831bce22b29c1b3c16a118a74b102ccc6343eb3539b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 22:58:14 GMT
server: ESF
date: Mon, 26 Jul 2021 22:58:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 26 Jul 2021 22:58:14 GMT

GET
H2 200 rssfeedgetter2017.js Show response
www.trendmicro.com/vinfo/js/ 5 KB
2 KB 143ms
142ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/rssfeedgetter2017.js?v=1.0

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

aa0fb12210395609982a73f34b179f54280417eb48f18497e9b6a964569c27a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/rssfeedgetter2017.js?v=1.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 2037
x-xss-protection: 1;mode=block
last-modified: Mon, 17 Apr 2017 08:24:01 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=37
etag: "cde5f7f753b7d21:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 22:58:51 GMT

GET logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/ 0
0

GET
H2 200 search-script.min.js Show response
www.trendmicro.com/vinfo/js/ 227 KB
42 KB 28ms
28ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/search-script.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

95c483d25f3a25069cb236935aa0cf2fae798d087078610b9634e052780f8ed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/search-script.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 42183
x-xss-protection: 1;mode=block
last-modified: Fri, 15 May 2020 11:55:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=817
etag: "9da94ecaaf2ad61:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:11:51 GMT

GET 2018121200510157-433-vkncmmd-800.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET 20191203180901913-12-z33lspb-800.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET WFH_protect_know-symptoms-device-compromise-work-from-home_infographic.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET 20190329045728893-745-gifbzua-800.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET 2021-predictions-web-cover-sm.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET 20200818233121257-572-kje883p-800.jpg
documents.trendmicro.com/images/TEx/articles/ 0
0

GET
H2 200 customPageScripts.js Show response
www.trendmicro.com/vinfo/js/ 19 KB
5 KB 20ms
20ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/customPageScripts.js?Ver3.1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bc40f55dc0399b99382412b3f312bd466bf2b0c3d1b227edc7bf2152ad7f43ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/customPageScripts.js?Ver3.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 4375
x-xss-protection: 1;mode=block
last-modified: Wed, 13 May 2020 08:51:09 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=817
etag: "c79e7ea5329d61:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:11:51 GMT

GET
H2 200 share.js Show response
www.trendmicro.com/vinfo/js/ 2 KB
1 KB 19ms
19ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/share.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d1d326206efc842a8035a2d3a1d53aa66176de9d45039389d090c0ee72a39a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/share.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 762
x-xss-protection: 1;mode=block
last-modified: Wed, 08 Feb 2017 03:51:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=850
etag: "3ddd4e9ebe81d21:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:12:24 GMT

GET
H2 200 TEX.tooltip.js Show response
www.trendmicro.com/vinfo/js/ 3 KB
1 KB 31ms
31ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/TEX.tooltip.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6f2adcf50cdc9374afa8b93818776ca2f36eef0f27b356df715d4d98aa6b5e19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/TEX.tooltip.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 877
x-xss-protection: 1;mode=block
last-modified: Tue, 09 Jan 2018 07:44:37 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=809
etag: "b0101fb31d89d31:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:11:43 GMT

GET
H2 200 eqlcolList.js Show response
www.trendmicro.com/vinfo/js/ 1 KB
720 B 27ms
24ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/eqlcolList.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

563772f765890f5c4e868355b1c9755deae8e886e1281cec1c15ee708543eb79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/eqlcolList.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 421
x-xss-protection: 1;mode=block
last-modified: Fri, 10 Feb 2017 04:02:02 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=836
etag: "57233c6f5283d21:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:12:10 GMT

GET
H2 200 viewportchecker.js Show response
www.trendmicro.com/vinfo/js/ 3 KB
1 KB 28ms
25ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/viewportchecker.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

42e1111a0ebc79d1aa68af2ccac42031123c6a60fcdcc893c1452c9a76ef33da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/viewportchecker.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 1214
x-xss-protection: 1;mode=block
last-modified: Mon, 13 Feb 2017 04:19:52 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=859
etag: "fdd9636cb085d21:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:12:33 GMT

GET
H2 200 scroller.js Show response
www.trendmicro.com/vinfo/js/ 8 KB
2 KB 29ms
26ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/scroller.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7f57ae8c90a70d08a93990e3a24863fb52ad58e46587ebb3cbb93a0ad030d65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/js/scroller.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 1252
x-xss-protection: 1;mode=block
last-modified: Mon, 13 Feb 2017 06:02:40 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=798
etag: "5d6699c8be85d21:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:11:32 GMT

GET
H2 200 jquery.dataTables.min.js Show response
www.trendmicro.com/vinfo/cloudlink/datatables/ 80 KB
28 KB 33ms
30ms Script
application/javascript 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/cloudlink/datatables/jquery.dataTables.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a9c575c2bf9b9f836806dc58aa0866cb558806fc5ea1ef2f4250a8c0b1be7278

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/cloudlink/datatables/jquery.dataTables.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 27879
x-xss-protection: 1;mode=block
last-modified: Thu, 22 Feb 2018 12:41:33 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1144
etag: "71114878daabd31:0"
accept-ranges: bytes
expires: Mon, 26 Jul 2021 23:17:18 GMT

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ 36 KB
9 KB 9ms
6ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 10:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132932
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Jul 2022 10:02:42 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ 248 KB
67 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 14:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31465
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 14:13:49 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 98 KB
39 KB 23ms
21ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f9fafbfcd768ec521736b7e23414e69d54e621f3591c5420ddedd3f6572b8c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39411
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Jul 2021 22:58:14 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/js/analytics.js?v1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 2986
date: Mon, 26 Jul 2021 22:08:28 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 27 Jul 2021 00:08:28 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 7 KB
3 KB 28ms
9ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&f=1&r=0.24924654620027087
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 390ab4863b8548cf945c78179069799870ce5c08df70daa24d3be8724b698fc3

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 26 Jul 2021 22:58:13 GMT
via: 1.1 google
server: gfra1
content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type: application/javascript; charset=UTF-8

GET
H2 200 autopilot_sdk.js Show response
cdn.bc0a.com/autopilot/f00000000017219/ 45 KB
16 KB 22ms
7ms Script
application/javascript 35.201.125.192
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 192.125.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d41399db4aaff4debebdea57ef41573593d7735c911e06e42391dff7cd00e667

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-goog-meta-marvel_enabled: true
content-encoding: gzip
age: 2919
x-guploader-uploadid: ADPycdsJ2SEGQ_3MdYc8E_Qh9nAwDyC0OwEW12bAjJbx4R1_MR10SBKL2Wn9IximfNhuCZ_bN_4PErkdO3ZcvV2r_e0
x-goog-meta-sdk_canonical_host
x-goog-meta-sdk_whitelist
x-goog-stored-content-encoding: gzip
x-goog-meta-publishingdate: 2021-06-16 17:49:51
x-goog-meta-sdk_canonical_protocol
etag: "28e246b2997b009c4e4f10163af66f2f"
vary: Accept-Encoding
x-goog-generation: 1623865791647402
content-language: en
access-control-allow-origin: *
x-goog-meta-custom: true
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-meta-spa: false
expires: Mon, 26 Jul 2021 23:09:35 GMT
x-goog-meta-sdk_version: 1.5.0
date: Mon, 26 Jul 2021 22:09:35 GMT
x-goog-meta-sdk_account_id: f00000000017219
x-goog-meta-sdk_request_parameters_case_sensitive: false
x-goog-meta-marvel_config_consistency_custom: {"data-customerid":"f00000000017219"}
x-goog-storage-class: MULTI_REGIONAL
x-goog-meta-marvel_customer_id
x-goog-metageneration: 3
alt-svc: clear
content-length: 15450
x-goog-meta-content_only: false
x-goog-meta-sdk_log_level: 2
last-modified: Wed, 16 Jun 2021 17:49:51 GMT
server: UploadServer
x-goog-hash: crc32c=O/yXsQ==, md5=KOJGspl7AJxOTxAWOvZvLw==
x-goog-stored-content-length: 15450
accept-ranges: bytes
content-type: application/javascript
x-goog-meta-marvel_test_mode: false

GET
H2 200 0797622384 Show response
ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/ 6 KB
1 KB 32ms
15ms XHR
application/json 34.102.193.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/0797622384?client=js_sdk&client_version=1.5.0&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36
Requested by: Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.193.142 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 142.193.102.34.bc.googleusercontent.com
Software: bws/1.0 /
Resource Hash: 4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-be-pop: BRU-1-301
date: Mon, 26 Jul 2021 22:58:05 GMT
content-encoding: br
server: bws/1.0
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
alt-svc: clear
via: 1.1 google

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 119 KB
27 KB 11ms
10ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f03b7388ad623970e5f9731591649158ae4c2e36e0197370f5d08a749faabbe2

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Thu, 22 Jul 2021 19:37:51 GMT
server: AkamaiNetStorage
etag: "6fc17bb0b033d93760460e36def28b36:1626982671.599208"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 27221
expires: Mon, 26 Jul 2021 23:03:14 GMT

GET
H2 200 logo-desktop.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/ 5 KB
6 KB 1010ms
664ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 13:42:25 GMT
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
x-amz-request-id: EKJ3DR8A7VKXFX6D
x-cache: Hit from cloudfront
content-length: 5310
x-amz-id-2: 2mL39etVbrEpPGNRtOtN9grqfMVm5EcnIQPqXsLBoc1e8JhUPMT9KuGP0J5H6kxEk0Mk9b1gfeE=
last-modified: Wed, 14 Jul 2021 16:32:28 GMT
server: AmazonS3
etag: "52561d918e54912574b9ed5bb5993edb"
x-amz-version-id: .uO9R1UDQbX.a.ec1EBzTChqhFVbU71g
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
content-type: image/webp
x-amz-cf-id: hmBoCDIzEwA3Eo3YSQL3-Iw89lGBIhODkMlELkXFAB3HK-gK7eW4qQ==

GET
H2 200 icomoon.ttf
www.trendmicro.com/vinfo/css/clientlibs/fonts/ 21 KB
21 KB 20ms
19ms Font
application/octet-stream 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs/fonts/icomoon.ttf

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a6a263a68b55f1629a4096b4fb6e81e2ba99c571185a5a6471c564fd7e334f84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/clientlibs/fonts/icomoon.ttf
pragma: no-cache
origin: https://www.trendmicro.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Fri, 15 May 2020 00:56:45 GMT
server: nginx
etag: "4825bab4532ad61:0"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
date: Mon, 26 Jul 2021 22:58:14 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 21532
x-xss-protection: 1;mode=block

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v20/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 18:26:10 GMT
x-content-type-options: nosniff
age: 16324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:19 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 18:26:10 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:08:26 GMT
x-content-type-options: nosniff
age: 2988
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:26 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 22:08:26 GMT

GET
H3-29 200 mem5YaGs126MiZpBA-UN_r8OUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN_r8OUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 03:39:05 GMT
x-content-type-options: nosniff
age: 587949
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14992
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 03:39:05 GMT

GET
H2 200 2018121200510157-433-vkncmmd-800.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 20 KB
21 KB 1361ms
1076ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/2018121200510157-433-vkncmmd-800.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b1ca6c5a1c70b6fb3e0b31cbf89ff9ace0ce3216a5f9e2725d9d93f517e815f1

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:16 GMT
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
x-amz-request-id: 8WGC5YHVPZ1E00K2
x-cache: Miss from cloudfront
content-length: 20826
x-amz-id-2: m5Ypz8n42j1Tm58wDKl5ZHpjgdZXXMkYIKurmYRPnES3p/i6dzMq+hXn+0k29hrDUYES2w4Jlq0=
last-modified: Thu, 15 Jul 2021 08:22:38 GMT
server: AmazonS3
etag: "f03f000274bd64bc9401cde8baf01ac8"
x-amz-version-id: tFS6W2zIZ.J2NS_iDOWTZ4SnY9qYgRaB
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
content-type: image/webp
x-amz-cf-id: D_pib5uP4QEeTRkA4L6uX3vFm0p54cHV_TAhedvzFumVZqGuDHgtAw==

GET
H2 200 20191203180901913-12-z33lspb-800.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 36 KB
36 KB 1363ms
1078ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/20191203180901913-12-z33lspb-800.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fbc539b200ba348a60fe6e58cdd63ce5f968db1bab991c7aa6117559b3e9d0b9

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:16 GMT
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
x-amz-request-id: 8WG639VR896HJH3Y
x-cache: Miss from cloudfront
content-length: 36620
x-amz-id-2: 6fmchsa3YLm3kek4AY0UVfUvd3MtAoHF3t0vk4LAGqrlTM0xSzh0Xz4zMnUNG2yIexCawTSANCw=
last-modified: Wed, 14 Jul 2021 16:43:18 GMT
server: AmazonS3
etag: "b39618c32b8eb416215aab3068dd95c2"
x-amz-version-id: 8CNsE3l8CS4syD4lW8QoDNYAskx6zQrj
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
content-type: image/webp
x-amz-cf-id: QGKM1sY-z6mrGfdFik-qJemW8vIJb5HJhcMaGZw7oCktUioGDvvLUQ==

GET
H2 200 WFH_protect_know-symptoms-device-compromise-work-from-home_infographic.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 24 KB
24 KB 1655ms
1371ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/WFH_protect_know-symptoms-device-compromise-work-from-home_infographic.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d9976fd81899c7e209753b60183d3c5351a9443079f15403ce483b74a3fc662d

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:16 GMT
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
x-amz-request-id: 8WG82V09QTN2HJV2
x-cache: Miss from cloudfront
content-length: 24234
x-amz-id-2: bla6bk6eUADmG3IwgjsdxoXt7GniZblhTfAVsbKVnCHVopQomk0TWHmJy0CCVGeHtudLlxXGfEU=
last-modified: Wed, 14 Jul 2021 17:06:10 GMT
server: AmazonS3
etag: "4f7ad5beefc841db8989cc06231df8f9"
x-amz-version-id: atav9mzyPZ_LUZK5IHJuNuVhRVuTdDB4
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
content-type: image/webp
x-amz-cf-id: rbbBu4JduCedbWWblwIX9fFSrZAb3cEhgsw_2eXbwEFrnj4okParWA==

GET
H2 200 20190329045728893-745-gifbzua-800.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 19 KB
20 KB 519ms
234ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/20190329045728893-745-gifbzua-800.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 54cc923337e17a1c1b3479bda331e073eeef378ed93e449d9bb75c502c4d067b

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: pzrYXLK1zbeq0.aXZVg0neKSfHcGKP7M
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
etag: "0f48f4dc284e50a2aaa3c5a724cd1d9d"
x-amz-request-id: KWPHMT7C5FAFCWC2
x-cache: Hit from cloudfront
content-length: 19826
x-amz-id-2: kTgyiMGXEdXWxNP2oMB57krrCZ+Vm4YFsrVVq/Gjyrjw9Udn9PCEeTqpE79zv08DbCfps2ksodQ=
last-modified: Wed, 14 Jul 2021 15:21:55 GMT
server: AmazonS3
date: Mon, 26 Jul 2021 20:05:45 GMT
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
x-amz-cf-id: mIAU-gLgi5TsHkHYn-K603JRbJYLs17_rl6lUSkdMd3jVstGXVHfiA==

GET
H2 200 2021-predictions-web-cover-sm.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 73 KB
73 KB 665ms
445ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/2021-predictions-web-cover-sm.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a65b32aca19da2992006993d0266465ef57c9eac50fd532329df732d993b467

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 10AA_nAPgPDPoVu9uC4JmdmPtKQ86XXd
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
etag: "fba2405b188f83c918f64f2e49d305e0"
x-amz-request-id: Q8BYT07WRESMGWTY
x-cache: Hit from cloudfront
content-length: 74522
x-amz-id-2: Do83q/XBakyW2m1L9NEbmBhGfAwj3qusZBKM0Dlaij4FJWyoBIdIM4NnL5rkulLm5NqcF86jVT8=
last-modified: Wed, 14 Jul 2021 17:06:11 GMT
server: AmazonS3
date: Mon, 26 Jul 2021 22:43:05 GMT
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
x-amz-cf-id: yzZipoQBZS1ls-aL9sYb1a3766wXnHQ-Nb405fxrWtCMFdSMzYYZ6Q==

GET
H2 200 20200818233121257-572-kje883p-800.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/ 27 KB
27 KB 633ms
633ms Image
image/webp 2600:9000:20bd:1600:0:f267:a5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marvel-b1-cdn.bc0a.com/f00000000017219/documents.trendmicro.com/images/TEx/articles/20200818233121257-572-kje883p-800.jpg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20bd:1600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09714a1ccbcdbb06a978469b56cd2c438a1067cb60c0d4410aa113a8b5ecbafd

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: uTNWdQ6sFKTkFspg9Z4hW.V6SCbidKvt
via: 1.1 6bd3f0b2365f9e7bd35cb62c288b6fb6.cloudfront.net (CloudFront)
etag: "18a71a97adf8e390a062f5bf944d20be"
x-amz-request-id: 6XD3TNV0E2NZ2070
x-cache: Hit from cloudfront
content-length: 27352
x-amz-id-2: SbU1Fg5FyXIKoz8/92BxaUk22Lw/FAVgkHjVplSVQSH9gBXzXrxLthTYVaU2i/k64XyhptI79Oo=
last-modified: Wed, 14 Jul 2021 17:06:10 GMT
server: AmazonS3
date: Mon, 26 Jul 2021 22:43:05 GMT
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: MAA50-C2
accept-ranges: bytes
x-amz-cf-id: YuzBY5yvMmaJntkWgHR508QwLI-bDsRIPradSafft48ntwLL7VtgVg==

GET
H2 200 conv_v3.js Show response
cdn.b0e8.com/ 67 KB
22 KB 36ms
7ms Script
application/javascript 35.190.5.192
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.b0e8.com/conv_v3.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.5.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 192.5.190.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:16:52 GMT
content-encoding: gzip
age: 2482
x-guploader-uploadid: ADPycdvftwd25QyZEicOVpNlkHsg6P0PNd7nMW3JtGHwVkLwMHyF9q3-GkoLa2SRDitNlh623riDoINsCP4OdY5tL9A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 21570
last-modified: Fri, 07 Aug 2020 06:51:36 GMT
server: UploadServer
etag: "befb3eb28cd6dd99609966faf9c239e0"
vary: Accept-Encoding
x-goog-hash: crc32c=kqf0jw==, md5=vvs+sozW3ZlgmWb6+cI54A==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1596783096708452
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 21570
accept-ranges: bytes
content-type: application/javascript
expires: Mon, 26 Jul 2021 23:16:52 GMT

GET
H2 200 customSiteStyle.css
www.trendmicro.com/vinfo/css/ 64 KB
64 KB 28ms
28ms Image
text/css 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/customSiteStyle.css?Ver3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Jul 2020 01:42:05 GMT
server: nginx
etag: W/"8bbd9dfa7f59d61:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=1709
date: Mon, 26 Jul 2021 22:58:14 GMT
vary: Accept-Encoding
content-length: 15923
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:26:43 GMT

GET
H2 200 bg_rank.gif
www.trendmicro.com/vinfo/css/images/ 1 KB
2 KB 187ms
186ms Image
image/gif 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/css/images/bg_rank.gif

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1fc2bcdf22cbe5500216e1a0fbf394183d2b3232953301ae2bb7b88d072dea5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/images/bg_rank.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 21 Sep 2017 01:42:41 GMT
server: nginx
etag: "bff1d0e97a32d31:0"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=1800
date: Mon, 26 Jul 2021 22:58:14 GMT
set-cookie: NSC_MC_TKD-UFY-GUQ_IUUQ_Qvc=ffffffff09227a1f45525d5f4f58455e445a4a423660;Version=1;Max-Age=120;path=/;httponly
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 1502
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:28:14 GMT

GET
H2 200 ico_link_rank.gif
www.trendmicro.com/vinfo/css/images/ 276 B
635 B 183ms
182ms Image
image/gif 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/css/images/ico_link_rank.gif

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

20bc0332d042b3ea9852627b50008b0814d1ffd8bfef28452038e96926aeb357

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/images/ico_link_rank.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 21 Sep 2017 02:53:33 GMT
server: nginx
etag: "206318d08432d31:0"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=1788
date: Mon, 26 Jul 2021 22:58:14 GMT
set-cookie: NSC_MC_TKD-UFY-GUQ_IUUQ_Qvc=ffffffff09227a1d45525d5f4f58455e445a4a423660;Version=1;Max-Age=120;path=/;httponly
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 276
x-xss-protection: 1;mode=block
expires: Mon, 26 Jul 2021 23:28:02 GMT

GET
H2 200 fontawesome-webfont.woff2
www.trendmicro.com/vinfo/fonts/ 75 KB
76 KB 26ms
25ms Font
application/x-font-woff2 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/fonts/fontawesome-webfont.woff2?v=4.7.0
pragma: no-cache
origin: https://www.trendmicro.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/font-awesome.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/font-awesome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 22 Dec 2016 07:50:34 GMT
server: nginx
etag: "0c15513285cd21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff2
date: Mon, 26 Jul 2021 22:58:14 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 77160
x-xss-protection: 1;mode=block

GET
H2 200 e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
www.trendmicro.com/vinfo/css/clientlibs/fonts/interstate-light/ 68 KB
68 KB 37ms
37ms Font
application/x-font-woff 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/clientlibs/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
pragma: no-cache
origin: https://www.trendmicro.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 18 Sep 2014 11:08:13 GMT
server: nginx
etag: "7382b6d630d3cf1:0"
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff
date: Mon, 26 Jul 2021 22:58:14 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 69724
x-xss-protection: 1;mode=block

GET
H2 200 dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/vinfo/css/clientlibs/fonts/InterstateExtraLight/ 36 KB
37 KB 39ms
38ms Font
application/x-font-woff 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ceb868b629bf55a5a9b7ccfa2c7d210177cf73f81ccdd5f388665524a11349fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /vinfo/css/clientlibs/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff
pragma: no-cache
origin: https://www.trendmicro.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: www.trendmicro.com
referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 18 Sep 2014 11:08:13 GMT
server: nginx
etag: "43b3c4d630d3cf1:0"
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff
date: Mon, 26 Jul 2021 22:58:14 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 37063
x-xss-protection: 1;mode=block

GET
H2 200 dict.en.json Show response
www.trendmicro.com/libs/cq/i18n/ 13 KB
14 KB 33ms
32ms XHR
application/json 23.4.218.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/libs/cq/i18n/dict.en.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc/clientlibs/granite/jquery.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.4.218.115 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-218-115.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:path: /libs/cq/i18n/dict.en.json
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: application/json, text/javascript, */*; q=0.01
cache-control: no-cache
sec-fetch-dest: empty
:authority: www.trendmicro.com
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
:method: GET
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
server: nginx
etag: "def5866d2a6bd1b5e1123ce5b1a6217e"
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
cache-control: public, max-age=833
date: Mon, 26 Jul 2021 22:58:14 GMT
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 13552
x-xss-protection: 1;mode=block

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1906336889&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&ul=en-us&de=UTF-8&dt=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1239844663&gjid=24301682&cid=1664422917.1627340295&tid=UA-15678759-2&_gid=800602123.1627340295&_r=1&_slc=1&z=825946031

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
822 B 24ms
23ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bc651792c3eacad4ce85752b2d112d5cdc7d119b4455d20de2f77f07191efa21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control: private, max-age=0
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
content-type: text/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 26 Jul 2021 22:58:14 GMT

GET
H2 200 utag.69.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 7ms
7ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.42.202006041752
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:03 GMT
server: AkamaiNetStorage
etag: "96165357acc3d7253ab0fc2f07c66ff9:1486318443"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1007
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H3-29 200 tag-26aee43f4d7d6fca54a567a22064af80.js Show response
dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/ 159 KB
45 KB 24ms
8ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-26aee43f4d7d6fca54a567a22064af80.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&f=1&r=0.24924654620027087
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 510403f36d77cf2e8d8dc92c332d9e8cbd786bd5e97d542681e3f1afd50e78fd

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: br
last-modified: Thu, 22 Jul 2021 06:25:22 GMT
server: gfra1
etag: "60f90f52-b440"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46144
via: 1.1 google

GET
H3-29 200 tag-90f7ad34a20d16e567f35cfeab8cf938.js Show response
dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/ 90 KB
23 KB 23ms
8ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/tag-90f7ad34a20d16e567f35cfeab8cf938.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&f=1&r=0.24924654620027087
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: d53579d075f3e05299f0e771827e8c701f75966ff410ecbd47265a037d75f289

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: br
last-modified: Thu, 22 Jul 2021 06:25:23 GMT
server: gfra1
etag: "60f90f53-5bec"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23532
via: 1.1 google

GET
H3-29 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
52 B 101ms
92ms Image
image/gif 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=D4D57D66F1EA7AC6FBB7990463C66DCF3&h=cb298568d035287875c25fe14d10989d&t=false&r=0.2830827491119241

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv1c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv1c
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
87 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-15678759-2&cid=1664422917.1627340295&jid=1239844663&gjid=24301682&_gid=800602123.1627340295&_u=IEBAAEAAAAAAAC~&z=1284180744

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 26 Jul 2021 22:58:14 GMT
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 utag.81.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 24 KB
6 KB 11ms
10ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.42.202106161605
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a5279c6531a32a985181ed015e1a27a078018296ec37ebcf5651a6f5e1885b97

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Wed, 16 Jun 2021 16:05:37 GMT
server: AkamaiNetStorage
etag: "3283f9e55383c0b5794cf6a5b7335dcb:1623859537.598502"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 5882
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.29.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 10ms
9ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:02 GMT
server: AkamaiNetStorage
etag: "7b0575b394704ec7f76bef0f68cfc059:1486318442"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1706
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.18.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 12ms
11ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:01 GMT
server: AkamaiNetStorage
etag: "15598bba639efba2403d00ec82947e93:1486318441"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1024
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.22.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 12ms
11ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.22.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1c0c3ded4bc24bbeaf3c728afd0e56ca95e44714285fca8d8f0edcaa471806c4

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:00 GMT
server: AkamaiNetStorage
etag: "bd58d1fcdbd29988cdaf2f96d9322e68:1486318440"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1229
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 13ms
12ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 20:29:43 GMT
server: AkamaiNetStorage
etag: "9751bf6877a19200475422195b7c3174:1594153783.485339"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1390
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.43.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 14ms
13ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c8e456c702931234478001bef4424a5063d46be7b65fc032ba05eba7186e08c0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:04 GMT
server: AkamaiNetStorage
etag: "d25bbf3981a87a9c659c1c90890e67ae:1486318444"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 924
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.75.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 15ms
14ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.42.201608171750
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:03 GMT
server: AkamaiNetStorage
etag: "afbbd577745f63042227302506a07e1a:1486318443"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1454
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.115.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 16ms
15ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.42.201807241753
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 578459f8ab219b96f7c3d3d0799841ae14894b07b2a2db5c8a518acb4b52b429

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Tue, 24 Jul 2018 17:54:10 GMT
server: AkamaiNetStorage
etag: "506cc61aaf3a606826e06df844659b94:1532454850"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3246
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.89.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 730 B
934 B 14ms
14ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.89.js?utv=ut4.42.201705092005
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e57d7aa2aa173860f1ae7b0b56e8eb3bbe8e1fc20f857c6579d972cda7164e1b

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
last-modified: Tue, 09 May 2017 20:05:45 GMT
server: AkamaiNetStorage
etag: "2d31d4ef6b1e3d47ab14a0e50a32a692:1494360345"
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 730
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.99.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 18ms
17ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.99.js?utv=ut4.42.201709111706
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d2f173c3e8fb35ee2ade37ef2238b67f3d58002efe8e4ab1d995f896e6462f17

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 20:29:44 GMT
server: AkamaiNetStorage
etag: "a73e014a0c492c526a3266c1166de977:1594153784.421082"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2502
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.117.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 19ms
18ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.42.201810152028
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5531265ecdebe91ac3fdfd4841c1d32fd4bd9694507d6448fce0ad21a3faa137

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Mon, 15 Oct 2018 20:28:28 GMT
server: AkamaiNetStorage
etag: "710195e0ca7c52bf6db852c203f53c4e:1539635308"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 974
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.142.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 19ms
19ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.142.js?utv=ut4.42.202011251638
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7ec1d086e7097a2c886285426b44f633f58ec4096b8552b42b3ddbdb00a17d4b

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Wed, 25 Nov 2020 16:38:39 GMT
server: AkamaiNetStorage
etag: "81f6520d2aaec54172bc535ab57ef967:1606322319.787959"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1295
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.144.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 19ms
19ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.144.js?utv=ut4.42.202101191804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a3903721b127ebb8858772e6a6ba13d11e8d280e671b5138028660ba168cda45

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Tue, 12 Jan 2021 18:46:27 GMT
server: AkamaiNetStorage
etag: "a76f483d7d01bd532d74c87d301f3dac:1610477187.628385"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 869
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H2 200 utag.145.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 19ms
19ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.42.202101222212
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: abcf473fe6c84884b5c5b5042486a82ece6097aa9534fd75914216faa0db6e71

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Fri, 22 Jan 2021 22:13:04 GMT
server: AkamaiNetStorage
etag: "2bea6f9834df056411c850105f16405d:1611353584.506883"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1777
expires: Tue, 10 Aug 2021 22:58:14 GMT

GET
H3-29 200 gtm.js Show response
www.googletagmanager.com/ 252 KB
52 KB 39ms
38ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b308572903859e63435aa6a135410fe82aa85174683ff66d500dd0fba4d5d3bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53103
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Jul 2021 22:58:14 GMT

GET
H3-29 200 www-widgetapi.js Show response
www.youtube.com/s/player/408a20d8/www-widgetapi.vflset/ 125 KB
42 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/408a20d8/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2055b192b6e6d98f46520f5bd8ca0d88879ab44026a34da0c3a8a35acace6e05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:06:04 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 22 Jul 2021 00:24:36 GMT
server: sffe
age: 6730
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42817
x-xss-protection: 0
expires: Tue, 26 Jul 2022 21:06:04 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 320
date: Mon, 26 Jul 2021 22:52:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 27 Jul 2021 00:52:55 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 40ms
8ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H3-29 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:52:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 358
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
expires: Mon, 26 Jul 2021 23:52:17 GMT

GET
H3-29 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
882 B 12ms
12ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:33:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1506
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Mon, 26 Jul 2021 23:33:09 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 38ms
10ms Script
application/javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Mon, 02 Aug 2021 22:58:15 GMT

GET
H3-29 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 1 MB
95 KB 64ms
64ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=7.0&r=0.7601603973744264&exc=69|95
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-26aee43f4d7d6fca54a567a22064af80.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 2de330fdfc819034dea42557b7e21d3e746b0313129154592bbfc315e7554c30

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
via: 1.1 google
server: gfra1
content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type: application/javascript; charset=UTF-8

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 43ms
16ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13910
x-xss-protection: 0
server: cafe
etag: 8154934153164151798
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 26 Jul 2021 22:58:15 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 5 KB
2 KB 34ms
6ms Script
application/x-javascript 2a02:26f0:6c00:2ae::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.42.201510262117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2ae::3adf Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Jun 2021 01:25:13 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=10971
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2079

GET
H2 200 revenuepulse-lib-v3.js Show response
resources.trendmicro.com/rs/945-CXD-062/images/ 2 KB
1 KB 317ms
141ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Sat, 26 Jun 2021 02:20:03 GMT
server: cloudflare
etag: "521a31-6f3-5c5a1e4d86920"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=60
accept-ranges: bytes
cf-ray: 67513b4daf884e55-FRA
content-length: 695
expires: Mon, 26 Jul 2021 22:59:15 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 95 KB
25 KB 30ms
6ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24676
x-xss-protection: 0
pragma: public
x-fb-debug: FfdZxxV43VMtJGlLOB+f0BUSDenhsf5mwx8qzbY2xomTzBdJXCcHX9P9NDeb/PkeADKu8QO75Csj+mgXiqn3iQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Mon, 26 Jul 2021 22:58:15 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 31ms
6ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.99.js?utv=ut4.42.201709111706
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 82267
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1627340295.180094,VS0,VE0
x-served-by: cache-fra19133-FRA

GET
H/1.1 200
OK ktag.js Show response
resources.xg4ken.com/js/v2/ 10 KB
4 KB 404ms
96ms Script
text/plain 52.70.141.7
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EB

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.42.201810152028

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.70.141.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-70-141-7.compute-1.amazonaws.com

Software

nginx /

Resource Hash

6be2d3525ac65706af2673badcb5232afe47ae9e1bf5099948db1f767565b8b7

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Content-Encoding: gzip
Last-Modified: Wed, 21 Jul 2021 07:00:44 GMT
Server: nginx
ETag: "60f7c61c-ef2"
Content-Type: text/plain
Cache-Control: max-age=86400, public
Connection: keep-alive
Content-Length: 3826
X-XSS-Protection: 1; mode=block
Expires: Tue, 27 Jul 2021 22:58:15 GMT

GET
H2 200 5e1fe3df4dced1c6.min.js Show response
scripts.demandbase.com/ 62 KB
17 KB 121ms
35ms Script
application/javascript 13.224.111.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/5e1fe3df4dced1c6.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.111.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-111-35.mad50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: acbba0c9e3a02eff012468de2f60e83bb911869af8f7b165dec69af52791e976

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UZpqqaaKIg1.TW_DUjsUSs1GJfP3jbUF
content-encoding: gzip
last-modified: Wed, 03 Mar 2021 22:02:47 GMT
server: AmazonS3
age: 2604
etag: W/"bddaf951005b9c9a7938fbcb0a325d96"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 315f537a0be356b37267f2ae21a5363d.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
date: Mon, 26 Jul 2021 22:14:52 GMT
x-amz-cf-pop: MAD50-C1
x-amz-cf-id: PcVjgkh7MuuXveMOtQI9ntTZ0QctXldjXJGbudBYHcp4I3JBTD5pgw==

GET
H2 200 3083.js Show response
js.idio.co/ 24 KB
5 KB 96ms
32ms Script
application/javascript 13.224.111.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.idio.co/3083.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.144.js?utv=ut4.42.202101191804
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.111.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-111-126.mad50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ff4bb445e800c0fcdccd031f09c550d6e628943d205bd4a70c5524b8499fe187

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 01:29:02 GMT
content-encoding: gzip
last-modified: Wed, 02 Jun 2021 15:55:55 GMT
server: AmazonS3
age: 77354
etag: W/"26f95bd8a664e8683af1d95b90905336"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 02fcbf68a81897cc093ee1510fb7e93e.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: MAD50-C1
x-amz-cf-id: hdH6Q7v-8dJ7ufU_8aox2pX-cRRsmmK38Wdz2pq3RaED7v35dOf8GQ==

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 25 KB
9 KB 71ms
21ms Script
application/javascript 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

9fd49a60b770f517f719373a0297b43246efc3e39bcf6735a7f8a0449789f9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8067
Pragma: no-cache
Last-Modified: Wed, 21 Jul 2021 22:38:08 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60f8a1d0-62f2"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 2021 22:58:15 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 11ms
11ms Script
application/x-javascript 104.109.77.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202107221937&cb=1627340295136
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-77-38.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 26 Jul 2021 23:08:15 GMT

GET
H2 200 brightedge3.php
a.b0e8.com/ 35 B
194 B 39ms
15ms Image
image/gif 34.95.105.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.b0e8.com/brightedge3.php?id=f00000000017219&p_id=N4RNJ8A6PL84R2JRA6NJR8LRAAAAAAAAAH&bf=138a7b20e85d8646e9e2227e523ee4cc&url=https%3A//www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&ref=&bn=1&bv=3.43&title=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&metadesc=Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20%28also%20known%20as%20BazarBackdoor%29%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20&metakeywords=Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware&s_id=N4RNJ8A6PL84R6P2R86JR8LRAAAAAAAAAH
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.105.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.105.95.34.bc.googleusercontent.com
Software: bws/1.0 /
Resource Hash: a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-be-pop: BRU-1-301
date: Mon, 26 Jul 2021 22:58:08 GMT
via: 1.1 google
last-modified: Wed, 23 Jun 2021 22:46:15 GMT
server: bws/1.0
etag: "60d3b9b7-23"
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: clear
content-length: 35

GET
H3-29 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
54 B 28ms
13ms Image
image/gif 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1826971775&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&utmhid=1906336889&utmr=-&utmp=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&utmht=1627340295203&utmac=UA-29051577-12&utmcc=__utma%3D44797537.1664422917.1627340295.1627340295.1627340295.1%3B%2B__utmz%3D44797537.1627340295.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=325449344&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-di... Show response
5427711.fls.doubleclick.net/ Frame FEDA
Redirect Chain

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-...
https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2...

664 B
452 B

41ms
26ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

fdfb717e6b71353401aa30798bee93e8bfbfba324bb5c5709780d93f4e5550bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5427711.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.trendmicro.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 26 Jul 2021 22:58:15 GMT
expires: Mon, 26 Jul 2021 22:58:15 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 427
x-xss-protection: 0
set-cookie: IDE=AHWqTUlApRTp0S5J6lxoQoCNdAIVZ0iRJCnLJqyjYjxWc1WXJ7tBunBhFpGuLTstZuE; expires=Sat, 20-Aug-2022 22:58:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 26 Jul 2021 22:58:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 51ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 6e9e8d16e703a71a0020912bb5435e8af2e5b41bbd4661905471f84dfb52e1d3

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:14 GMT
content-encoding: gzip
last-modified: Tue, 20 Jul 2021 18:24:21 GMT
x-msedge-ref: Ref A: 10476C407B6B4F968AA3A530B0087114 Ref B: FRAEDGE1314 Ref C: 2021-07-26T22:58:15Z
etag: "80b87575947dd71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9014

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 96ms
30ms Script
application/x-javascript 13.224.114.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.114.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-114-214.mad50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 02:21:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 74201
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 0645caa18be2b3be5e4612d40f45a0ba.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: MAD50-C1
X-Amz-Cf-Id: qptBt62ZG5s_zHPe8YPp0uxKNXxqC40js5nh9eetAXzEJXHJbGFJDQ==

GET
H2 200 activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threat...
5427711.fls.doubleclick.net/ 0
0 38ms
17ms Image
text/html 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://5427711.fls.doubleclick.net/activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader?
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314

0
241 B

518ms
403ms

Image
application/json

2600:9000:20c8:8a00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:8a00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:17 GMT
via: 1.1 77fcce204f96e329df7227f192690939.cloudfront.net (CloudFront)
apigw-requestid: DGahegnHoAMES8g=
x-amz-cf-pop: MAD50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: Jw4TnYo1ZqECICSjeYGxlmf4px10qPtSXo2fq0m_3dUCh1B9dpL-ig==

Redirect headers

Pragma: no-cache
Date: Mon, 26 Jul 2021 22:58:16 GMT
X-Proxy-Origin: 159.48.53.215; 159.48.53.215; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3084ff3d-41bf-4fe3-8a7b-03310d4eeca6
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 worker-70faafffa0475802f5ee03ca5ff74179.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 47 KB
13 KB 60ms
59ms XHR
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-26aee43f4d7d6fca54a567a22064af80.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: br
last-modified: Thu, 22 Jul 2021 06:25:22 GMT
server: gfra1
etag: "60f90f52-351f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13599
via: 1.1 google

GET
H3-29 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
52 B 92ms
92ms Image
image/gif 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=215154&u=D4D57D66F1EA7AC6FBB7990463C66DCF3&s=1627340293&p=1&ed=%7B%22tO%22%3A%22-2%22%2C%22lt%22%3A%221627340295281%22%2C%22r%22%3A%22%22%2C%22ul%22%3A%22en-us%22%2C%22de%22%3A%22UTF-8%22%2C%22sc%22%3A%2224%22%2C%22sr%22%3A%221600x1200%22%7D&cu=https%253A%252F%252Fwww.trendmicro.com%252Fvinfo%252Fus%252Fsecurity%252Fnews%252Fcybercrime-and-digital-threats%252Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&r=0&cq=1&vn=7.0.151&vns=undefined&vno=4.0.71&eTime=1627340293282&random=0.23453293998810776

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv1c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv1c
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1906336889&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&ul=en-us&de=UTF-8&dt=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.1664422917.1627340295.1627340295.1627340295.1&_utmz=44797537.1627340295.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1627340295316&_u=aGDCCEIrBAAAAC~&cid=1664422917.1627340295&tid=UA-44592531-1&_gid=800602123.1627340295&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&z=1727791004

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/160/ 11 KB
5 KB 7ms
7ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/160/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Feb 2021 02:54:38 GMT
Server: AkamaiNetStorage
ETag: "19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4811
Expires: Wed, 03 Nov 2021 22:58:15 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distribu...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D46043%26time%3D1627340295320%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fv...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distribu...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distrib...

0
64 B

188ms
187ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&liSync=true&e_ipv6=AQLLsh9Y0o-ZxgAAAXrlCk6YLeJGPLXKQ9s11PS1NyRzGoFqTfl-LD0RtA6bKeyv7kySTsjD
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:16 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: 8d++jmB5lRbQoviWIisAAA==

Redirect headers

date: Mon, 26 Jul 2021 22:58:15 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=46043&time=1627340295320&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&liSync=true&e_ipv6=AQLLsh9Y0o-ZxgAAAXrlCk6YLeJGPLXKQ9s11PS1NyRzGoFqTfl-LD0RtA6bKeyv7kySTsjD
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: KDUahGB5lRbwtJIiXysAAA==

GET
H2 200 rules-p-yyb3JEF9Pm8ey.js Show response
rules.quantcount.com/ 3 B
438 B 121ms
40ms Script
application/javascript 2600:9000:20c8:2c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-yyb3JEF9Pm8ey.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:2c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 04:46:16 GMT
via: 1.1 89229acad212ad74c20ccd0ac96a8cbe.cloudfront.net (CloudFront)
age: 65520
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 21:25:15 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: MAD50-C1
accept-ranges: bytes
x-amz-cf-id: roUCnPJA1i1IsSEWfMhTREjRPTCYCDbI-FoQOwHcjObI8I1NZNX0xw==

GET
H3-29 200 243552383039605 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 56ms
55ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/243552383039605?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

db7dd0bb0667b3e81c8d551810cd3de813ef229d5440290a2ef7b783a534a1d9

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 64d68bKhb69ReVxy4Ty+pM+Cm7E+8D1GWLNMcoHOhzZwU5jsuFtmJJPKx90auSVzsNyQilcN3YLaqeJLmY9VYQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 26 Jul 2021 22:58:15 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/1015287688/ 2 KB
1 KB 31ms
15ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1015287688/?random=1627340295338&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

7fa0d05a98db2c5a29497813a7a0511bff4a3dc23a50c4fdd6929d3f93e279bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1224
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/ 2 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1627340295347&cv=9&fst=1627340295347&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9610ebfd292017e8d8ae7ab5ef26191e650e5be3135f41775a6ed9a6dc203dd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1111
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
374 B 85ms
21ms XHR
text/plain 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-4-213-149.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7e9f0c7612737ef01fcc80a84cefd086544093695c601ee65bc057b3ed94f9b3

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.trendmicro.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 244ms
203ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=0d3db6fe-b35c-4096-8ef0-9d6914b32794&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A15%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 ia.js Show response
s.idio.co/ 2 KB
2 KB 37ms
7ms Script
application/javascript 13.225.87.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.idio.co/ia.js
Requested by: Host: js.idio.co
URL: https://js.idio.co/3083.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-108.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dd21acbddbfa634e9870ed1b19093b0eb7bbe8636d4de590e2aadb23ead5cb3e

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 06:11:48 GMT
content-encoding: gzip
etag: W/"46727094ad49ed02b04a5f128b993736"
last-modified: Wed, 05 Aug 2020 11:08:42 GMT
server: AmazonS3
age: 79566
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 1fCcV5L8IXkxfTtKCQy9C4JPKx4qS272uFVrAcJeV-3bPEV-kz5bBw==

GET
H2 200 ip.js Show response
s.idio.co/ 12 KB
5 KB 10ms
8ms Script
application/javascript 13.225.87.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.idio.co/ip.js
Requested by: Host: js.idio.co
URL: https://js.idio.co/3083.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-108.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f8c26695e4fe2f4397e1a08c7b39633b2811b38d9023d42d3be32a27d23caa2

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:55:55 GMT
content-encoding: gzip
etag: W/"667295c9be42d098b9271c04e336acee"
last-modified: Wed, 05 Aug 2020 11:08:59 GMT
server: AmazonS3
age: 281
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: Mjmq_9bH0__tNFD7Xt4mrbwBfluRvBNf9VOXPAnvMr3RoH9p-11FPQ==

GET
H2 200 adsct
t.co/i/ 43 B
454 B 136ms
121ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Mon, 26 Jul 2021 22:58:15 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 8118611f2a4fb1b00b71b5eeb1d17874555dc30cab95c67d2b1632c8da705917
x-transaction: 61bc0869542467a3
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 4 KB
1 KB 202ms
132ms XHR
application/json 13.224.111.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&page_title=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&src=tag&auth=bsm2q1mFUUesT7p5FPkP4KxmVQufSigYFBCXjLA0
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/5e1fe3df4dced1c6.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.111.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-111-100.mad50.r.cloudfront.net
Software: nginx /
Resource Hash: 4edeaf750f0b80319b418267f5b3027a3ba59d78fd78e4b4ebcf61c68c893ea5

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: MAD50-C1
x-cache: Miss from cloudfront
request-id: cf7a2104-5927-4a47-9d56-48024f011aec
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.trendmicro.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 eb28dde7b66308b26496e3a543c93412.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XfWfkioeGkv0qLc9Sn4DQM8K58iseu2Zo0ggPAc1IjknV_Px9Wlcew==
expires: Sun, 25 Jul 2021 22:58:15 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 4 KB
1 KB 200ms
131ms XHR
application/json 13.224.111.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&page_title=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&src=tag&auth=xg8VGFJF06KUFN4yt8DlsqVFBwKmajHokMmxbhyk
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/5e1fe3df4dced1c6.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.111.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-111-100.mad50.r.cloudfront.net
Software: nginx /
Resource Hash: 4edeaf750f0b80319b418267f5b3027a3ba59d78fd78e4b4ebcf61c68c893ea5

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: MAD50-C1
x-cache: Miss from cloudfront
request-id: a8ee0502-e6de-4642-9664-969b1d28a055
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://www.trendmicro.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 eb28dde7b66308b26496e3a543c93412.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Om-uWf2xSrTGF3sYE9J83JJrDWeAvmYRljkn5YrkKzXDU1g6ARF7CA==
expires: Sun, 25 Jul 2021 22:58:15 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg&verifyHash=f581019d078d96a320d1a73cdbc805f62522a81c

26 B
409 B

227ms
227ms

Image
image/gif

13.224.111.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg&verifyHash=f581019d078d96a320d1a73cdbc805f62522a81c
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.111.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-111-91.mad50.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Via: 1.1 8aa451f83e0a7ce3b7e0bc3b04314535.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAD50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: ac01cd809e96393b
X-Amz-Cf-Id: 7Y-L6u42Y3DEytw6LiIfxgRmLT1nhGcIrCVdpRMuPrZ3gw34wLxhEw==

Redirect headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Via: 1.1 8aa451f83e0a7ce3b7e0bc3b04314535.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAD50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AABqBU7B_nwAAFhgd8B8Jg&verifyHash=f581019d078d96a320d1a73cdbc805f62522a81c
Connection: keep-alive
trace-id: cf65742d44dc18ec
Content-Length: 0
X-Amz-Cf-Id: Ha0aTN1bMg9KHYY0QFvOO3G8hJ1SC2ueSKBRhR28Gp29KG04uDG8tQ==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
66 B 38ms
16ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2 204 26044208.js Show response
bat.bing.com/p/action/ 0
128 B 189ms
188ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/26044208.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 26 Jul 2021 22:58:14 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: 6C7D414403EC4BC5B9AC491662DCD0FC Ref B: FRAEDGE1314 Ref C: 2021-07-26T22:58:15Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
149 B 29ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26044208&tm=gtm001&Ver=2&mid=8f9205bb-ef93-4f2c-ab88-b530e0fe572a&sid=f5df0dd0ee6411eb8ec7013d6d80c79f&vid=f5df5090ee6411ebb87707fb60a50018&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&kw=Cybercrime%20%26%20Digital%20Threats,%20Ransomware&p=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&r=&lt=620&evt=pageLoad&msclkid=N&sv=1&rn=168082
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 26 Jul 2021 22:58:14 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 6729AFD67A534C9591A3C684B05DBAAD Ref B: FRAEDGE1314 Ref C: 2021-07-26T22:58:15Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 45ms
8ms Preflight 54.93.136.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Server: 54.93.136.75 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-136-75.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,epsiloncookie
Origin: https://www.trendmicro.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
server: nginx
access-control-allow-origin: https://www.trendmicro.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization,epsiloncookie

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 429 B
439 B 30ms
14ms XHR
application/json 54.93.136.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.136.75 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-136-75.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: db0fb39e1dbd75f117c08ee1a6b8085b9f781ecec8eb14adc7dbc7a4fdb9dfba

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.trendmicro.com/
Authorization: Token f0978075a275d14104571cd0b3e9919c9748869b
EpsilonCookie: 6e3307600a480000073eff60e900000077ff1400

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.trendmicro.com
access-control-allow-credentials: true
content-length: 252

GET
H2 200 /
www.google.com/pagead/1p-user-list/929919117/ 42 B
150 B 16ms
16ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/929919117/?random=1627340295347&cv=9&fst=1627336800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&async=1&fmt=3&is_vtc=1&random=193796559&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/929919117/ 42 B
154 B 18ms
18ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/929919117/?random=1627340295347&cv=9&fst=1627336800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg7l1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&async=1&fmt=3&is_vtc=1&random=193796559&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTy...
https://www.google.com/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1...
https://www.google.de/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=16...

42 B
64 B

29ms
26ms

Image
image/gif

2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=Bz7_YN6sFtHC7_UPjayK0A4&cid=CAQSKQCNIrLMKgrpbDdfwTmGyCnP4uCsqXgZF6xIXMMvrKSqQe-8w_O1n0Ro&random=4224016767&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/1015287688/?random=1277892249&cv=9&fst=1627340295338&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&tiba=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=Bz7_YN6sFtHC7_UPjayK0A4&cid=CAQSKQCNIrLMKgrpbDdfwTmGyCnP4uCsqXgZF6xIXMMvrKSqQe-8w_O1n0Ro&random=4224016767&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 19ms
6ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&rl=&if=false&ts=1627340295476&sw=1600&sh=1200&v=2.9.43&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1627340295474.1220362418&it=1627340295332&coo=false&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Jul 2021 22:58:15 GMT

GET
H/1.1 200
OK ia.gif
a.idio.co/ 26 B
239 B 393ms
97ms Image
image/gif 3.213.166.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.idio.co/ia.gif?r=&s=9f62912d-4fe5-47cd-80bf-2f9f5fd10576&x%5Bidio_visitor_id%5D%5B0%5D=98655363-e84e-4459-a8f4-a5227a46c707&c=trendmicro&d=3083&a=consume&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&l=1627340295491&z=0.7349619597420503

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.166.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-166-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:15 GMT
Server: nginx
Connection: keep-alive
Content-Length: 26
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: image/gif

GET
H2 200 dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=*;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-dist...
adservice.google.com/ddm/fls/z/ Frame FEDA 42 B
515 B 61ms
41ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=*;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Requested by

Host: 5427711.fls.doubleclick.net
URL: https://5427711.fls.doubleclick.net/activityi;dc_pre=CLmo64HrgfICFbLIuwgdciIFVw;src=5427711;type=remar0;cat=allsi0;ord=1;num=8179856598747;gtm=2wg7l1;auiddc=1099598716.1627340295;u1=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5427711.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=1417347693;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-b...
pixel.quantserve.com/ 35 B
371 B 12ms
9ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1417347693;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader;uht=2;fpan=1;fpa=P0-930520186-1627340295497;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=trendmicro.com;je=0;sr=1600x1200x24;dst=1;et=1627340295497;tzo=-120;ogl=image.https%3A%2F%2Fdocuments%252Etrendmicro%252Ecom%2Fimages%2FTEx%2Farticles%2F20190219213148738-601-9g0uc

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:15 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
BLOB 200
OK 741e75a8-d43f-4ce8-af1c-b997f061bac7
https://www.trendmicro.com/ 47 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.trendmicro.com/741e75a8-d43f-4ce8-af1c-b997f061bac7
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 47679
Content-Type: text/javascript

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
91 B 8ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=Microdata&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&rl=&if=false&ts=1627340295993&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%2C%22meta%3Adescription%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22meta%3Akeywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%7D&cd[OpenGraph]=%7B%22og%3Aimage%22%3A%22https%3A%2F%2Fdocuments.trendmicro.com%2Fimages%2FTEx%2Farticles%2F20190219213148738-601-9g0uc44-800.jpg%22%2C%22twitter%3Acard%22%3A%22summary_large_image%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&a=tmtealium&ec=1&o=30&fbp=fb.1.1627340295474.1220362418&it=1627340295332&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:15 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Mon, 26 Jul 2021 22:58:15 GMT

POST
H2 200 analyze Show response
r3.visualwebsiteoptimizer.com/ 0
143 B 421ms
230ms XHR
application/javascript 35.194.81.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://r3.visualwebsiteoptimizer.com/analyze?_a=215154&_u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/tag-90f7ad34a20d16e567f35cfeab8cf938.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.194.81.74 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 74.81.194.35.bc.googleusercontent.com
Software: r3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWDMTdYPqAC3q5ucB

Response headers

access-control-allow-origin: *
date: Mon, 26 Jul 2021 22:58:16 GMT
content-encoding: gzip
server: r3
content-type: application/javascript; charset=UTF-8

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 189ms
189ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=6e3307600a480000073eff60e900000077ff1400&session=0d3db6fe-b35c-4096-8ef0-9d6914b32794&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A15%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%221004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:16 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314

0
242 B

497ms
497ms

Image
application/json

2600:9000:20c8:8a00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c8:8a00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:17 GMT
via: 1.1 77fcce204f96e329df7227f192690939.cloudfront.net (CloudFront)
apigw-requestid: DGahkixRoAMESlQ=
x-amz-cf-pop: MAD50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: ZBv62El3Aw98_rRZ_ylBFol5e1_a1o0BwOGftTmWvhNgxkZaCZ7Omw==

Redirect headers

Pragma: no-cache
Date: Mon, 26 Jul 2021 22:58:17 GMT
X-Proxy-Origin: 159.48.53.215; 159.48.53.215; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2f884637-4041-41ff-8218-7299f36a5601
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=8116164618287803314
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 216ms
212ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=6e3307600a480000073eff60e900000077ff1400&session=0d3db6fe-b35c-4096-8ef0-9d6914b32794&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:17 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
658 B 150ms
135ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 22:58:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Mon, 26 Jul 2021 22:58:18 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 7aa26ccaa3e0caa6c6be436da341d38e600ad8c2a263b7d86617fcbf75344c8d
x-transaction: 1bcdf68788924cee
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 6712 0
182 B 84ms
28ms Document
text/html 34.254.127.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&upid=803df29&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.127.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-127-126.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&upid=803df29&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.trendmicro.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

date: Mon, 26 Jul 2021 22:58:18 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1906336889&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&ul=en-us&de=UTF-8&dt=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&el=10%25%20Scroll&ev=0&_utma=44797537.1664422917.1627340295.1627340295.1627340295.1&_utmz=44797537.1627340295.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1627340297969&_u=aHDCCEIrBAAAAC~&jid=1932591904&gjid=1211533336&cid=1664422917.1627340295&tid=UA-15678759-2&_gid=800602123.1627340295&_r=1&gtm=2wg7l1MT6DHL8&z=1291856341

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 22:58:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 2989
date: Mon, 26 Jul 2021 22:08:28 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 27 Jul 2021 00:08:28 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j91&a=1906336889&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&ul=en-us&de=UTF-8&dt=Ryuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&el=25%25%20Scroll&ev=0&_utma=44797537.1664422917.1627340295.1627340295.1627340295.1&_utmz=44797537.1627340295.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1627340297979&_u=aHDCCEIrBAAAAC~&jid=&gjid=&cid=1664422917.1627340295&tid=UA-15678759-2&_gid=800602123.1627340295&gtm=2wg7l1MT6DHL8&z=799454753

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Jul 2021 05:53:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61463
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 31ms
16ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-15678759-2&cid=1664422917.1627340295&jid=1932591904&gjid=1211533336&_gid=800602123.1627340295&_u=aHDCCEIrBAAAAC~&z=619721792

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 26 Jul 2021 22:58:18 GMT
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 192ms
192ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=6e3307600a480000073eff60e900000077ff1400&session=0d3db6fe-b35c-4096-8ef0-9d6914b32794&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A17%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%223012%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:18 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 208ms
208ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=e6443586-10e6-4532-8069-04ba72bc41eb&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224013%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:19 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 192ms
192ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=e6443586-10e6-4532-8069-04ba72bc41eb&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:20 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Mon, 07 Jun 2021 21:53:38 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60be9562-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 analyze Show response
r3.visualwebsiteoptimizer.com/ 0
142 B 99ms
98ms XHR
application/javascript 35.194.81.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://r3.visualwebsiteoptimizer.com/analyze?_a=215154&_u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/tag-90f7ad34a20d16e567f35cfeab8cf938.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.194.81.74 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 74.81.194.35.bc.googleusercontent.com
Software: r3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAUIs5JPfqoy9MRgB

Response headers

access-control-allow-origin: *
date: Mon, 26 Jul 2021 22:58:20 GMT
content-encoding: gzip
server: r3
content-type: application/javascript; charset=UTF-8

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 191ms
189ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=e6443586-10e6-4532-8069-04ba72bc41eb&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A20%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226016%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:21 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 199ms
199ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=2e4c14da-e3a1-4c54-8755-4c60f89831da&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A21%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%227018%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:22 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 176ms
175ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=2e4c14da-e3a1-4c54-8755-4c60f89831da&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A22%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%228021%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:23 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 190ms
189ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=2e4c14da-e3a1-4c54-8755-4c60f89831da&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229022%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:24 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 196ms
196ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=2e4c14da-e3a1-4c54-8755-4c60f89831da&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A24%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%2210024%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:25 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 208ms
208ms Image
image/gif 23.4.213.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=2e4c14da-e3a1-4c54-8755-4c60f89831da&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2026%20Jul%202021%2022%3A58%3A25%20GMT%22%2C%22timeSpent%22%3A%223002%22%2C%22totalTimeSpent%22%3A%2213026%22%7D&isIframe=false&m=%7B%22description%22%3A%22Starting%20this%20year%2C%20Ryuk%20began%20using%20another%20dropper%20called%20BazarLoader%20(also%20known%20as%20BazarBackdoor)%2C%20which%20is%20primarily%20distributed%20via%20phishing%20emails%20that%20contain%20either%20malicious%20attachments%20or%20links%20to%20websites%20that%20host%20malware.%20%22%2C%22keywords%22%3A%22Cybercrime%20%26%20Digital%20Threats%2C%20Ransomware%22%2C%22title%22%3A%22%5Cn%5CtRyuk%202020%3A%20Distributing%20Ransomware%20via%20TrickBot%20and%20BazarLoader%20-%20Security%20News%5Cn%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fsecurity%2Fnews%2Fcybercrime-and-digital-threats%2Fryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader&pageViewId=4ce39563-b068-48fd-8432-68518bf8716f

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.4.213.149 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-4-213-149.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 26 Jul 2021 22:58:28 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Mon, 07 Jun 2021 21:53:38 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60be9562-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.trendmicro.com
URL: https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/2018121200510157-433-vkncmmd-800.jpg

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/20191203180901913-12-z33lspb-800.jpg

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/WFH_protect_know-symptoms-device-compromise-work-from-home_infographic.jpg

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/20190329045728893-745-gifbzua-800.jpg

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/2021-predictions-web-cover-sm.jpg

Domain: documents.trendmicro.com
URL: https://documents.trendmicro.com/images/TEx/articles/20200818233121257-572-kje883p-800.jpg

Verdicts & Comments Add Verdict or Comment

244 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 05:23:56	Name: IDE Value: AHWqTUm9JhlmfPJng_oUrww-7bs4n39YYOUcTSpdDfFkp7jrQTI_TPLJIpJiVVsR
.trendmicro.com/	1970-01-20 05:26:49	Name: __qca Value: P0-930520186-1627340295497
.trendmicro.com/	1970-01-20 13:33:32	Name: iv Value: 98655363-e84e-4459-a8f4-a5227a46c707
.trendmicro.com/	1970-01-19 20:02:22	Name: is Value: 9f62912d-4fe5-47cd-80bf-2f9f5fd10576
.trendmicro.com/	1970-01-19 22:11:56	Name: _fbp Value: fb.1.1627340295474.1220362418
www.trendmicro.com/	1970-01-20 13:33:32	Name: _gd_svisitor Value: 6e3307600a480000073eff60e900000077ff1400
.trendmicro.com/	1969-12-31 23:59:59	Name: __utmc Value: 44797537
.trendmicro.com/	1970-01-19 20:03:46	Name: _uetsid Value: f5df0dd0ee6411eb8ec7013d6d80c79f
www.trendmicro.com/	1970-01-19 20:02:34	Name: _gd_session Value: 0d3db6fe-b35c-4096-8ef0-9d6914b32794
.trendmicro.com/	1970-01-19 20:03:46	Name: _gid Value: GA1.2.800602123.1627340295
.trendmicro.com/	1970-01-19 22:11:56	Name: _vwo_ds Value: 3%3At_0%2Ca_1%3A0%241627340293%3A11.66063133%3A%3A%3A95_1%2C69_1%3A0
.trendmicro.com/	1969-12-31 23:59:59	Name: _c1Ref Value: /vinfo/us/security/news/cybercrime-and-digital-threats/ryuk-2020-distributing-ransomware-via-trickbot-and-bazarloader
.trendmicro.com/	1970-01-20 05:23:56	Name: _uetvid Value: f5df5090ee6411ebb87707fb60a50018
.trendmicro.com/	1970-01-19 20:02:20	Name: _gat Value: 1
.trendmicro.com/	1970-02-26 00:50:20	Name: BE_CLA3 Value: p_id%3DN4RNJ8A6PL84R2JRA6NJR8LRAAAAAAAAAH%26bf%3D138a7b20e85d8646e9e2227e523ee4cc%26bn%3D1%26bv%3D3.43%26s_expire%3D1627426695165%26s_id%3DN4RNJ8A6PL84R6P2R86JR8LRAAAAAAAAAH
.trendmicro.com/	1970-01-23 11:38:20	Name: _vwo_uuid Value: D4D57D66F1EA7AC6FBB7990463C66DCF3
.trendmicro.com/	1970-01-20 13:33:32	Name: _ga Value: GA1.2.1664422917.1627340295
.trendmicro.com/	1970-01-19 22:11:56	Name: _gcl_au Value: 1.1.1099598716.1627340295
.trendmicro.com/	1970-01-20 13:33:32	Name: __utma Value: 44797537.1664422917.1627340295.1627340295.1627340295.1
.trendmicro.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.trendmicro.com/	1970-01-19 22:26:20	Name: _vis_opt_s Value: 1%7C
.trendmicro.com/	1970-01-19 20:02:22	Name: _vwo_sn Value: 0%3A1%3Ar3.visualwebsiteoptimizer.com%3A1%3A1
www.trendmicro.com/	1970-01-20 13:33:32	Name: _gd_visitor Value: c61181b5-be5f-45b7-850b-305e8afb6941
.trendmicro.com/	1970-01-20 00:25:08	Name: __utmz Value: 44797537.1627340295.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
www.trendmicro.com/	1970-01-19 20:02:20	Name: NSC_MC_TKD-UFY-GUQ_IUUQ_Qvc Value: ffffffff09227a1f45525d5f4f58455e445a4a423660
.trendmicro.com/	1970-01-19 20:02:22	Name: __utmb Value: 44797537.1.10.1627340295
.trendmicro.com/	1970-01-20 04:47:56	Name: utag_main Value: v_id:017ae50a4a4b002d1f5e7795e04600072008f06a00b08$_sn:1$_ss:1$_st:1627342094732$ses_id:1627340294732%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/	1970-01-19 20:02:20	Name: __utmt Value: 1
.trendmicro.com/	1970-01-20 04:49:22	Name: _vwo_uuid_v2 Value: D4D57D66F1EA7AC6FBB7990463C66DCF3\|cb298568d035287875c25fe14d10989d

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
a.b0e8.com
a.idio.co
adservice.google.com
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.b0e8.com
cdn.bc0a.com
cdn.datatables.net
connect.facebook.net
customer.cludo.com
dev.visualwebsiteoptimizer.com
documents.trendmicro.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
id.rlcdn.com
insight.adsrvr.org
ixfd1-api.bc0a.com
j.6sc.co
js.adsrvr.org
js.idio.co
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
match.prod.bidr.io
munchkin.marketo.net
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
r3.visualwebsiteoptimizer.com
resources.trendmicro.com
resources.xg4ken.com
rules.quantcount.com
s.idio.co
s.ml-attr.com
scripts.demandbase.com
secure.adnxs.com
secure.quantserve.com
segments.company-target.com
sjs.bizographics.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.tiqcdn.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
documents.trendmicro.com
www.trendmicro.com
104.109.77.38
104.111.234.67
104.17.74.206
104.244.42.67
104.244.42.69
108.174.10.14
13.224.111.100
13.224.111.126
13.224.111.35
13.224.111.91
13.224.114.214
13.225.87.108
142.250.186.70
151.101.12.157
172.217.23.98
185.33.221.53
23.4.213.149
23.4.218.115
2600:9000:20bd:1600:0:f267:a5c0:93a1
2600:9000:20c8:2c00:6:44e3:f8c0:93a1
2600:9000:20c8:8a00:12:3734:2a40:93a1
2606:4700:10::6816:335d
2606:4700:10::ac43:1b98
2620:116:800d:21:5a23:9c4e:e774:96c1
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:801::2003
2a00:1450:4001:802::200e
2a00:1450:4001:808::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2003
2a00:1450:4001:828::2004
2a00:1450:4001:828::2008
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2008
2a00:1450:4001:831::2002
2a00:1450:4001:831::200a
2a00:1450:400c:c08::9a
2a00:1450:400c:c08::9c
2a02:26f0:6c00:2ae::3adf
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.213.166.67
34.102.193.142
34.254.127.126
34.95.105.148
34.96.102.137
35.190.5.192
35.194.81.74
35.201.125.192
35.201.70.94
35.244.174.68
52.16.214.249
52.70.141.7
54.93.136.75
68.67.153.60
01dbbe1ad2037e8bc294848eaccc27958f69e1ac205db64c6db69405e361b22b
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
0577596e5918704476a4b3f46cb2fd1fe3430186d0b477c7edb11a28732a05db
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
09714a1ccbcdbb06a978469b56cd2c438a1067cb60c0d4410aa113a8b5ecbafd
0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5
0f8c26695e4fe2f4397e1a08c7b39633b2811b38d9023d42d3be32a27d23caa2
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b
1a65b32aca19da2992006993d0266465ef57c9eac50fd532329df732d993b467
1c0c3ded4bc24bbeaf3c728afd0e56ca95e44714285fca8d8f0edcaa471806c4
1fc2bcdf22cbe5500216e1a0fbf394183d2b3232953301ae2bb7b88d072dea5c
2055b192b6e6d98f46520f5bd8ca0d88879ab44026a34da0c3a8a35acace6e05
20bc0332d042b3ea9852627b50008b0814d1ffd8bfef28452038e96926aeb357
27dbc587cdeb9b04598011c76ee9511866c57028688169613a37005ed6d8ad84
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de330fdfc819034dea42557b7e21d3e746b0313129154592bbfc315e7554c30
3807e44914c34f9e293702693b49039f774b1eef7798a0fa8dfbb3c1992e32dc
38955525fa945d94f96d6c5d969f5c1299fdd30c48ea471cba7f71490ee1ab61
390ab4863b8548cf945c78179069799870ce5c08df70daa24d3be8724b698fc3
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
42e1111a0ebc79d1aa68af2ccac42031123c6a60fcdcc893c1452c9a76ef33da
4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120
4edeaf750f0b80319b418267f5b3027a3ba59d78fd78e4b4ebcf61c68c893ea5
510403f36d77cf2e8d8dc92c332d9e8cbd786bd5e97d542681e3f1afd50e78fd
540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
54cc923337e17a1c1b3479bda331e073eeef378ed93e449d9bb75c502c4d067b
5531265ecdebe91ac3fdfd4841c1d32fd4bd9694507d6448fce0ad21a3faa137
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
563772f765890f5c4e868355b1c9755deae8e886e1281cec1c15ee708543eb79
578459f8ab219b96f7c3d3d0799841ae14894b07b2a2db5c8a518acb4b52b429
618d62ceaca1223e16de2c8939a1963a95c34b0ac75852f835f93e5b42f20871
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6be2d3525ac65706af2673badcb5232afe47ae9e1bf5099948db1f767565b8b7
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271
6e9e8d16e703a71a0020912bb5435e8af2e5b41bbd4661905471f84dfb52e1d3
6f2adcf50cdc9374afa8b93818776ca2f36eef0f27b356df715d4d98aa6b5e19
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7e9f0c7612737ef01fcc80a84cefd086544093695c601ee65bc057b3ed94f9b3
7ec1d086e7097a2c886285426b44f633f58ec4096b8552b42b3ddbdb00a17d4b
7f57ae8c90a70d08a93990e3a24863fb52ad58e46587ebb3cbb93a0ad030d65a
7fa0d05a98db2c5a29497813a7a0511bff4a3dc23a50c4fdd6929d3f93e279bd
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
833837b11cdc53ccd1bf38e94fec85d423a69ca8eab3791dd282434006fe9089
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95c483d25f3a25069cb236935aa0cf2fae798d087078610b9634e052780f8ed7
9610ebfd292017e8d8ae7ab5ef26191e650e5be3135f41775a6ed9a6dc203dd9
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
9f0173ed05fe8618c76272aaae6711ae0fa7ece07de8522cb6b0159d22b691f5
9f7216d2f53a731d9749077c22e15cfb38bcdc40806511ccf736f440c7569d64
9fd49a60b770f517f719373a0297b43246efc3e39bcf6735a7f8a0449789f9f0
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a3903721b127ebb8858772e6a6ba13d11e8d280e671b5138028660ba168cda45
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a5279c6531a32a985181ed015e1a27a078018296ec37ebcf5651a6f5e1885b97
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a6a263a68b55f1629a4096b4fb6e81e2ba99c571185a5a6471c564fd7e334f84
a9c575c2bf9b9f836806dc58aa0866cb558806fc5ea1ef2f4250a8c0b1be7278
aa0fb12210395609982a73f34b179f54280417eb48f18497e9b6a964569c27a1
abcf473fe6c84884b5c5b5042486a82ece6097aa9534fd75914216faa0db6e71
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acbba0c9e3a02eff012468de2f60e83bb911869af8f7b165dec69af52791e976
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf
b1ca6c5a1c70b6fb3e0b31cbf89ff9ace0ce3216a5f9e2725d9d93f517e815f1
b308572903859e63435aa6a135410fe82aa85174683ff66d500dd0fba4d5d3bf
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bc40f55dc0399b99382412b3f312bd466bf2b0c3d1b227edc7bf2152ad7f43ab
bc651792c3eacad4ce85752b2d112d5cdc7d119b4455d20de2f77f07191efa21
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c8e456c702931234478001bef4424a5063d46be7b65fc032ba05eba7186e08c0
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd618f046c2bae673dc4a831bce22b29c1b3c16a118a74b102ccc6343eb3539b
ceb868b629bf55a5a9b7ccfa2c7d210177cf73f81ccdd5f388665524a11349fa
d1d326206efc842a8035a2d3a1d53aa66176de9d45039389d090c0ee72a39a48
d2f173c3e8fb35ee2ade37ef2238b67f3d58002efe8e4ab1d995f896e6462f17
d41399db4aaff4debebdea57ef41573593d7735c911e06e42391dff7cd00e667
d53579d075f3e05299f0e771827e8c701f75966ff410ecbd47265a037d75f289
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
d9976fd81899c7e209753b60183d3c5351a9443079f15403ce483b74a3fc662d
db0fb39e1dbd75f117c08ee1a6b8085b9f781ecec8eb14adc7dbc7a4fdb9dfba
db7dd0bb0667b3e81c8d551810cd3de813ef229d5440290a2ef7b783a534a1d9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd21acbddbfa634e9870ed1b19093b0eb7bbe8636d4de590e2aadb23ead5cb3e
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e57d7aa2aa173860f1ae7b0b56e8eb3bbe8e1fc20f857c6579d972cda7164e1b
e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9
f03b7388ad623970e5f9731591649158ae4c2e36e0197370f5d08a749faabbe2
f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702
f9fafbfcd768ec521736b7e23414e69d54e621f3591c5420ddedd3f6572b8c4e
fbc539b200ba348a60fe6e58cdd63ce5f968db1bab991c7aa6117559b3e9d0b9
fcea66becd77485eb760a9a65e38d47319f69b724ae046f9b246842a1daa6c18
fdfb717e6b71353401aa30798bee93e8bfbfba324bb5c5709780d93f4e5550bf
ff4bb445e800c0fcdccd031f09c550d6e628943d205bd4a70c5524b8499fe187

www.trendmicro.com Open in urlscan Pro 23.4.218.115 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

152 Requests

95 %HTTPS

47 %IPv6

39 Domains

60 Subdomains

54 IPs

6 Countries

1518 kBTransfer

5057 kBSize

29 Cookies

62 Outgoing links

Redirected requests

152 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.trendmicro.com Open in urlscan Pro
23.4.218.115 Public Scan

Screenshot
Live screenshot

Full Image

152
Requests

95 %
HTTPS

47 %
IPv6

39
Domains

60
Subdomains

54
IPs

6
Countries

1518 kB
Transfer

5057 kB
Size

29
Cookies

152 HTTP transactions
0 data transactions