www.cybereason.com Open in urlscan Pro
2606:4700::6811:84b4 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://meetings.cybereason.com/api/mailings/click/PMRGSZBCHI4TONZRG43CYITVOJWCEORCNB2HI4DTHIXS653XO4XGG6LCMVZGKYLTN5XC4Y3PNUXWE...
Effective URL:
https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Submission: On January 20 via manual (January 20th 2020, 9:34:31 am UTC) from NL

Summary HTTP 153 Redirects Links 76 Behaviour Indicators

Summary

This website contacted 40 IPs in 8 countries across 32 domains to perform 153 HTTP transactions. The main IP is 2606:4700::6811:84b4, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.cybereason.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 17th 2019. Valid for: a year.

This is the only time www.cybereason.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.227.123.4 34.227.123.4	14618 (AMAZON-AES) (AMAZON-AES)
88	2606:4700::68... 2606:4700::6811:84b4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	95.100.67.47 95.100.67.47	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE)
1	2606:2800:133... 2606:2800:133:7403:4a68:7eff:710b:1ddf	15133 (EDGECAST) (EDGECAST)
1	151.139.237.11 151.139.237.11	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:10:... 2606:4700:10::6814:6e27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.210.250.44 23.210.250.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.112.65 151.101.112.65	54113 (FASTLY) (FASTLY)
5	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	34.192.123.20 34.192.123.20	14618 (AMAZON-AES) (AMAZON-AES)
1	147.75.102.135 147.75.102.135	54825 (PACKET) (PACKET)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:f3cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
2	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1 2	2a00:1450:400... 2a00:1450:4001:81b::2004	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::75	15169 (GOOGLE) (GOOGLE)
1	147.75.102.203 147.75.102.203	54825 (PACKET) (PACKET)
1	70.42.32.127 70.42.32.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	64.202.112.63 64.202.112.63	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2606:4700::68... 2606:4700::6811:e6cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:70b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:43b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 9	34.252.172.232 34.252.172.232	16509 (AMAZON-02) (AMAZON-02)
1	147.75.102.231 147.75.102.231	54825 (PACKET) (PACKET)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1 1	2a00:1288:110... 2a00:1288:110:c305::a000	34010 (YAHOO-IRD) (YAHOO-IRD)
1	52.71.210.204 52.71.210.204	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
1	69.173.144.136 69.173.144.136	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	185.33.223.206 185.33.223.206	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	54.156.185.237 54.156.185.237	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:cccc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:f905	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:eb:... 2a02:26f0:eb:3b4::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
153	40

1 34.227.123.4 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-227-123-4.compute-1.amazonaws.com

meetings.cybereason.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

88 2606:4700::6811:84b4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.cybereason.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 95.100.67.47 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-67-47.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f66.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:7403:4a68:7eff:710b:1ddf (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.237.11 (Dallas, United States)

ASN33438 (HIGHWINDS2, US)

cdn.rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::6814:6e27 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-44.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.65 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

tag.marinsm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
staticxx.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.192.123.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-192-123-20.compute-1.amazonaws.com

t.sf14g.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.135 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress6

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f3cc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::75 (United States)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.203 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress3

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.63 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

amplifypixel.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e6cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:70b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:43b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 34.252.172.232 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-172-232.eu-west-1.compute.amazonaws.com

pixel-geo.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.231 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress10

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::a000 (United Kingdom) 1 redirects

ASN34010 (YAHOO-IRD, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.71.210.204 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-210-204.compute-1.amazonaws.com

pixel.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.136 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.223.206 (Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 301.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.156.185.237 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-185-237.compute-1.amazonaws.com

tracking.leadlander.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cccc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:f905 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:eb:3b4::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
89	cybereason.com 1 redirects meetings.cybereason.com www.cybereason.com	7 MB
11	typekit.net use.typekit.net p.typekit.net	178 KB
10	prfct.co 6 redirects pixel-geo.prfct.co pixel.prfct.co	4 KB
4	hubspot.com track.hubspot.com forms.hubspot.com	2 KB
4	facebook.net connect.facebook.net	202 KB
4	linkedin.com 2 redirects platform.linkedin.com px.ads.linkedin.com www.linkedin.com	57 KB
3	facebook.com www.facebook.com staticxx.facebook.com	361 B
3	twitter.com platform.twitter.com analytics.twitter.com	29 KB
3	doubleclick.net 2 redirects googleads.g.doubleclick.net cm.g.doubleclick.net stats.g.doubleclick.net	2 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	73 KB
3	outbrain.com amplify.outbrain.com tr.outbrain.com amplifypixel.outbrain.com	4 KB
3	addtoany.com static.addtoany.com	59 KB
3	cloudflare.com cdnjs.cloudflare.com	97 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	leadlander.com 1 redirects tracking.leadlander.com	644 B
2	adnxs.com 1 redirects secure.adnxs.com	2 KB
2	openx.net 1 redirects us-u.openx.net	491 B
2	google.de www.google.de	219 B
2	google.com 1 redirects www.google.com	312 B
2	gstatic.com fonts.gstatic.com	36 KB
2	hubspot.net cdn2.hubspot.net	217 KB
1	licdn.com snap.licdn.com	2 KB
1	hubapi.com api.hubapi.com	595 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	yahoo.com 1 redirects ads.yahoo.com	648 B
1	hs-analytics.net js.hs-analytics.net	25 KB
1	hsadspixel.net js.hsadspixel.net	2 KB
1	hsleadflows.net js.hsleadflows.net	61 KB
1	sf14g.com t.sf14g.com	37 KB
1	marinsm.com tag.marinsm.com	10 KB
1	rawgit.com cdn.rawgit.com	2 KB
1	googleadservices.com www.googleadservices.com	10 KB
153	32

	Domain	Requested by
88	www.cybereason.com	www.cybereason.com
10	use.typekit.net	www.cybereason.com use.typekit.net
9	pixel-geo.prfct.co	6 redirects www.cybereason.com
4	connect.facebook.net	www.cybereason.com connect.facebook.net
3	track.hubspot.com
3	static.addtoany.com	www.cybereason.com static.addtoany.com
3	cdnjs.cloudflare.com	www.cybereason.com
2	px.ads.linkedin.com	1 redirects
2	www.google-analytics.com	1 redirects www.cybereason.com
2	tracking.leadlander.com	1 redirects www.cybereason.com
2	secure.adnxs.com	1 redirects www.cybereason.com
2	us-u.openx.net	1 redirects www.cybereason.com
2	www.facebook.com	www.cybereason.com
2	www.google.de	www.cybereason.com
2	www.google.com	1 redirects www.cybereason.com
2	platform.twitter.com	www.cybereason.com platform.twitter.com
2	fonts.gstatic.com	www.cybereason.com
2	cdn2.hubspot.net	www.cybereason.com
1	www.linkedin.com	1 redirects
1	snap.licdn.com	js.hsadspixel.net
1	forms.hubspot.com	js.hsleadflows.net
1	stats.g.doubleclick.net	1 redirects
1	api.hubapi.com	js.hsadspixel.net
1	cm.g.doubleclick.net	1 redirects
1	pixel.rubiconproject.com	www.cybereason.com
1	pixel.prfct.co	www.cybereason.com
1	ads.yahoo.com	1 redirects
1	analytics.twitter.com	www.cybereason.com
1	staticxx.facebook.com	connect.facebook.net
1	vars.hotjar.com	static.hotjar.com
1	js.hs-analytics.net	www.cybereason.com
1	js.hsadspixel.net	www.cybereason.com
1	js.hsleadflows.net	www.cybereason.com
1	amplifypixel.outbrain.com	www.cybereason.com
1	tr.outbrain.com	www.cybereason.com
1	script.hotjar.com	static.hotjar.com
1	p.typekit.net	www.cybereason.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	static.hotjar.com	www.cybereason.com
1	t.sf14g.com	www.cybereason.com
1	tag.marinsm.com	www.cybereason.com
1	amplify.outbrain.com	www.cybereason.com
1	cdn.rawgit.com	www.cybereason.com
1	platform.linkedin.com	www.cybereason.com
1	www.googleadservices.com	www.cybereason.com
1	meetings.cybereason.com	1 redirects
153	46

This site contains links to these domains. Also see Links.

Domain
attack.mitre.org
www.fortinet.com
technical.nttsecurity.com
usa.visa.com
www.zdnet.com
keepass.info
github.com
www.cobaltstrike.com
medium.com
docs.microsoft.com
www.sneakymonkey.net
filezilla-project.org
www.openssh.com
openvpn.net
any.run
app.any.run
www.metasploit.com
blog.rapid7.com
www.joeware.net
www.fireeye.com
blogs.technet.microsoft.com
www.sans.org
malware-traffic-analysis.net
www.virustotal.com
www.addtoany.com
twitter.com
www.linkedin.com
www.youtube.com
www.facebook.com
www.instagram.com

Subject Issuer	Validity	Valid
www.cybereason.com CloudFlare Inc ECC CA-2	`2019-09-17` - `2020-09-16`	a year	crt.sh
*.typekit.net DigiCert SHA2 Secure Server CA	`2019-12-06` - `2021-12-10`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh
rawgit.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-03` - `2022-01-12`	2 years	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
ssl472428.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-10` - `2020-06-17`	6 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-03-14`	a year	crt.sh
g.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2019-09-23` - `2020-09-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-12-06` - `2020-03-05`	3 months	crt.sh
t.sf14g.com Go Daddy Secure Certificate Authority - G2	`2019-07-09` - `2020-09-07`	a year	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2019-12-05` - `2020-03-04`	3 months	crt.sh
hubspot.net CloudFlare Inc ECC CA-2	`2019-04-16` - `2020-04-16`	a year	crt.sh
*.google.com GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
platform.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-28` - `2020-09-01`	a year	crt.sh
www.google.com GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
www.google.de GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2019-12-05` - `2020-03-04`	3 months	crt.sh
ssl817706.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-13` - `2020-02-19`	6 months	crt.sh
ssl803643.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-06` - `2020-05-14`	6 months	crt.sh
ssl803670.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-06` - `2020-05-14`	6 months	crt.sh
*.prfct.co DigiCert SHA2 Secure Server CA	`2019-09-03` - `2021-10-27`	2 years	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2019-12-05` - `2020-03-04`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.leadlander.com Go Daddy Secure Certificate Authority - G2	`2019-07-09` - `2020-09-07`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-12-20` - `2020-03-13`	3 months	crt.sh
ssl817724.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-13` - `2020-02-19`	6 months	crt.sh
hubspot.com CloudFlare Inc ECC CA-2	`2019-12-04` - `2020-10-09`	10 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh

This page contains 5 frames:

Primary Page: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Frame ID: AB7046CC276E231DA30590145C527E99
Requests: 150 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.22.html
Frame ID: C0F13BFE1B0AD885BBC6D07DE0430E4F
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.4f8aea4342a4ada72cba2bdffcff6b4d.html?origin=https%3A%2F%2Fwww.cybereason.com
Frame ID: B3DEA43673E756AA4CA5DBE5A66F7154
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-b736908ce6b0e933fad3a2e45df61b38.html
Frame ID: 8799FB31B8EC2D14073EBC4BE1CF1BC4
Requests: 1 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=45
Frame ID: F5C4FD157434D4086D263AF60878A8AA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://meetings.cybereason.com/api/mailings/click/PMRGSZBCHI4TONZRG43CYITVOJWCEORCNB2HI4DTHIXS653XO4XGG6LCM... HTTP 302
https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-ancho... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

153
Requests

100 %
HTTPS

53 %
IPv6

32
Domains

46
Subdomains

40
IPs

8
Countries

8252 kB
Transfer

10826 kB
Size

11
Cookies

76 Outgoing links

These are links going to different origins than the main page.

URL: https://attack.mitre.org/software/S0266/
Title: TrickBot

Search URL Search Domain Scan URL

URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Title: LockerGoga

Search URL Search Domain Scan URL

URL: https://technical.nttsecurity.com/post/102fsp2/trickbot-variant-anchor-dns-communicating-over-dns
Title: Anchor_DNS

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/groups/G0037/
Title: FIN6

Search URL Search Domain Scan URL

URL: https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf
Title: is known to target POS systems

Search URL Search Domain Scan URL

URL: https://www.zdnet.com/article/cybercrime-group-fin6-evolves-from-pos-malware-to-ransomware/
Title: been linked to TrickBot infections

Search URL Search Domain Scan URL

URL: https://keepass.info/
Title: KeePass

Search URL Search Domain Scan URL

URL: https://github.com/rapid7/metasploit-framework/wiki/Meterpreter
Title: Meterpreter

Search URL Search Domain Scan URL

URL: https://github.com/EmpireProject/Empire
Title: PowerShell Empire

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/
Title: Cobalt Strike

Search URL Search Domain Scan URL

URL: https://medium.com/@chroniclesec/abusing-code-signing-for-profit-ef80a37b50f4
Title: the ever-growing trend of signed threats

Search URL Search Domain Scan URL

URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-trickbot-new-module-pwgrab.html
Title: core-parser.dll parses the TrickBot config files

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875546(v%3Dws.11)
Title: built-in Windows tool ESENTUTL

Search URL Search Domain Scan URL

URL: https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/
Title: Extensible Storage Engine (ESE) database format

Search URL Search Domain Scan URL

URL: https://github.com/wevans311082/PoshKPBrute
Title: PoshKPBrute

Search URL Search Domain Scan URL

URL: https://filezilla-project.org/
Title: Filezilla

Search URL Search Domain Scan URL

URL: https://www.openssh.com/
Title: OpenSSH

Search URL Search Domain Scan URL

URL: https://openvpn.net/
Title: OpenVPN

Search URL Search Domain Scan URL

URL: https://any.run/report/daf223b923f335c3de66cae8a091063361262669c8f9acaf59a352b1e0e07b8c/b92f9889-00f9-429d-97e4-fb149cfe66db
Title: similar

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/b92f9889-00f9-429d-97e4-fb149cfe66db/
Title: activity

Search URL Search Domain Scan URL

URL: https://www.metasploit.com/
Title: Metasploit

Search URL Search Domain Scan URL

URL: https://blog.rapid7.com/2015/03/25/stageless-meterpreter-payloads/
Title: metasploit

Search URL Search Domain Scan URL

URL: https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/Invoke-DACheck.ps1
Title: https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/Invoke-DACheck.ps1

Search URL Search Domain Scan URL

URL: https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/Initial-LAdminCheck.cna
Title: https://github.com/killswitch-GUI/CobaltStrike-ToolKit/blob/master/Initial-LAdminCheck.cna

Search URL Search Domain Scan URL

URL: http://www.joeware.net/freetools/tools/adfind/
Title: ADfind.exe

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Title: attacks related to FIN6

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/
Title: NTFS ADS

Search URL Search Domain Scan URL

URL: https://www.sans.org/reading-room/whitepapers/dns/detecting-dns-tunneling-34152
Title: DNS Tunneling

Search URL Search Domain Scan URL

URL: http://malware-traffic-analysis.net/2019/10/02/index.html
Title: C2 communication format as TrickBot

Search URL Search Domain Scan URL

URL: https://www.fortinet.com/blog/threat-research/new-trickbot-plugin-harvests-email-addresses-from-sql-servers-screenlocker-module-not-for-ransom.html
Title: SQL servers, screenlocker, and Mimikatz

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/ip-address/23.95.97.59/relations
Title: VirusTotal

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/search/signature%253A%2522Biller%2520FIN%2520Oy%2522/files
Title: search

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/search/signature%253A%252206%252027%2520E6%25203C%2520FA%252011%252017%252045%252084%252028%2520D3%252092%2520DF%2520AA%25208D%2520AE%2522/files
Title: search

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1192
Title: Spearphishing Link

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1204
Title: User Execution

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1053
Title: Scheduled Task

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1112
Title: Modify Registry

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1503
Title: Credentials from Web Browsers

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1012
Title: Query Registry

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1115
Title: Clipboard Data

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1048
Title: Exfiltration Over Alternative Protocol

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1132
Title: Data Encoding

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1176
Title: Browser Extensions

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1088
Title: Bypass User Account Control

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1116
Title: Code Signing

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1110
Title: Brute Force

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1082
Title: System Information Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1001
Title: Data Obfuscation

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1106
Title: Execution through API

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1055
Title: Process Injection

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1134
Title: Access Token Manipulation

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1145
Title: Private Keys

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1069
Title: Permission Groups Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1071
Title: Standard Application Layer Protocol

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1059
Title: Command-Line Interface

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1140
Title: Deobfuscate/Decode Files or Information

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1003
Title: Credential Dumping

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1087
Title: Account Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1105
Title: Remote File Copy

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1086
Title: PowerShell

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1482
Title: Domain Trust Discovery

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1065
Title: Uncommonly Used Port

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1085
Title: Rundll32

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1036
Title: Masquerading

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1043
Title: Commonly Used Port

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1064
Title: Scripting

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1096
Title: NTFS File Attributes

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1047
Title: Windows Management Instrumentation

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1129
Title: Execution through Module Load

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&title=Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware

Search URL Search Domain Scan URL

URL: https://twitter.com/cybereason
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cybereason
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCOm7AaB0HiNH4Phe66sK0Ew
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Cybereason/
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cybereason/?hl=en
Title:

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://meetings.cybereason.com/api/mailings/click/PMRGSZBCHI4TONZRG43CYITVOJWCEORCNB2HI4DTHIXS653XO4XGG6LCMVZGKYLTN5XC4Y3PNUXWE3DPM4XWI4TPOBYGS3THFVQW4Y3IN5ZC2ZTSN5WS2YJNORZGSY3LMJXXILLJNZTGKY3UNFXW4LLUN4WXI2DFFVSGS43DN53GK4TZFVXWMLLUNBSS2YLOMNUG64RNNVQWY53BOJSSELBCN5ZGOIR2EIZDENTGGY4DKYJNGM3TMMBNGQ3DMOJNHBQWIOBNGFTGEOBUGA2TSZJXMIZCELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHFQTQ5TZMR3EQ3DRM42WERBXPJYFE3TNL5FTK4SJIFLHA2KDHFXG4SLYGJMHA3TGMFZFKPJCPU====== HTTP 302
https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 128

https://pixel-geo.prfct.co/tagjs?a_id=71641&source=js_tag HTTP 302
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=71641&source=js_tag

Request Chain 134

https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_ZdpGhadUKyMM8g0qB

Request Chain 135

https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001073209&eid=pa_ZdpGhadUKyMM8g0qB&sigv=1&esig=2~4bc91d398b8b8112480a49dfe2981141f4b9d6e9 HTTP 302
https://pixel.prfct.co/cb?partnerId=yah&xid=E0&eid=pa_ZdpGhadUKyMM8g0qB

Request Chain 136

https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_ZdpGhadUKyMM8g0qB HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_ZdpGhadUKyMM8g0qB

Request Chain 137

https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_ZdpGhadUKyMM8g0qB

Request Chain 138

https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfWmRwR2hhZFVLeU1NOGcwcUI HTTP 302
https://pixel-geo.prfct.co/cb?partnerId=goo

Request Chain 140

https://secure.adnxs.com/seg?t=2&add=8257847 HTTP 302
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D8257847

Request Chain 141

https://tracking.leadlander.com/api/tracking?accountId=27717&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&referer=&fp=46b0604f6a632a0d294665c9ac64fb79 HTTP 302
https://tracking.leadlander.com/tracking.png

Request Chain 147

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=222922141&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&ul=en-us&de=UTF-8&dt=Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=93536958&gjid=444400933&cid=448807619.1579512855&tid=UA-56367941-1&_gid=1494979472.1579512855&_r=1&z=1821922106 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_gid=1494979472.1579512855&gjid=444400933&_v=j79&z=1821922106 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106&slf_rd=1&random=2226808947

Request Chain 151

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512854882 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D994281%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fblog%252Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware%26time%3D1579512854882%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512854882&liSync=true

153 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware Show response
www.cybereason.com/blog/
Redirect Chain

https://meetings.cybereason.com/api/mailings/click/PMRGSZBCHI4TONZRG43CYITVOJWCEORCNB2HI4DTHIXS653XO4XGG6LCMVZGKYLTN5XC4Y3PNUXWE3DPM4XWI4TPOBYGS3THFVQW4Y3IN5ZC2ZTSN5WS2YJNORZGSY3LMJXXILLJNZTGKY3UNF...
https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

146 KB
28 KB

228ms
33ms

Document
text/html

2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / HubSpot

Resource Hash

14a69475fe017279fb90a9b3b4baf21d46e28e9fe61fec7fad2cf15d548bd02f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=0

Request headers

:method: GET
:authority: www.cybereason.com
:scheme: https
:path: /blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Mon, 20 Jan 2020 09:34:12 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=d6399e7c976956411ca486bedb200efc11579512852; expires=Wed, 19-Feb-20 09:34:12 GMT; path=/; domain=.www.cybereason.com; HttpOnly; SameSite=Lax __cfruid=faa9beffb2d6ffe680c170c4082047a1eb8c9bc6-1579512852; path=/; domain=.www.cybereason.com; HttpOnly; Secure; SameSite=None
cf-ray: 55800d1f9bb6d6e1-FRA
age: 111
cache-control: s-maxage=120,max-age=5
link: </hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css>; rel=preload; as=style, </hs/hsstatic/HubspotToolsMenu/static-1.56/js/index.js>; rel=preload; as=script, </hs/hsstatic/cos-i18n/static-1.10/bundles/project.js>; rel=preload; as=script, </_hcms/forms/v2.js>; rel=preload; as=script
strict-transport-security: max-age=0
vary: Accept-Encoding
cf-cache-status: HIT
access-control-allow-credentials: false
content-security-policy: upgrade-insecure-requests
edge-cache-tag: CT-23309573296,P-3354902,L-14460236224,L-17583002703,L-5467046824,CW-14462747638,CW-17578879074,CW-6216123918,E-5348736541,E-5350539849,E-5350675680,PGS-ALL,SW-0,SD-2,B-5272851739
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-hs-cache-config: BrowserCache-5s-EdgeCache-120s
x-hs-content-id: 23309573296
x-hs-hub-id: 3354902
x-powered-by: HubSpot
x-trace: 2B5BBD7A8426F0BC6396423BB4D2368AC78175A7285E029828369E4DD301
server: cloudflare
content-encoding: br
cf-h2-pushed: </hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css>,</hs/hsstatic/HubspotToolsMenu/static-1.56/js/index.js>,</hs/hsstatic/cos-i18n/static-1.10/bundles/project.js>,</_hcms/forms/v2.js>

Redirect headers

Server: nginx
Date: Mon, 20 Jan 2020 09:34:12 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 135
Connection: keep-alive
Location: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
X-Request-Id: 676d0f9422358f8705d043edb1c9cb15

GET
H2 200 combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/ 349 KB
44 KB 15ms
0ms Stylesheet
text/css 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0bdc83018935bbfed6f9249ac89616f20e5ea427ab41f0c147be054837e535

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 262
status: 200
content-type: text/css
x-amz-request-id: 1C63016B2A196E96
x-amz-id-2: oQbxP9B4Sb8LZqNmLmi212vr7n/FJO7/VW0iSX5w7zO+d3XzcCd2HAz3YPffVIQzIAtXPavmjas=
last-modified: Thu, 16 Jan 2020 19:55:09 GMT
server: cloudflare
etag: W/"d9c2c2ab97758c30ce49211db9ad00bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: jQ5dGL1khp1NDZtZRUV0sz.l5UhTTjnA
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 55800d1fcc2dd6e1-FRA

GET
H2 200 index.js Show response
www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.56/js/ 9 KB
3 KB 17ms
0ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs/hsstatic/HubspotToolsMenu/static-1.56/js/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 147498d5be9d1aeb765c07a2789d7379a690cbcd52abcc1cacdd0203bd8e009b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 b4346add631a498bf6cdbf88cbc5ff13.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 1174624
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Mon, 06 Jan 2020 18:30:12 GMT
server: cloudflare
etag: W/"162b4f467addf4ea5c010d1097fd9e14"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: St0U51eKUSNLxvhUwOEN3IuM2RIMZRGK
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C1
cf-ray: 55800d1fcc2fd6e1-FRA
x-amz-cf-id: iOkY5rzP1q351GJ0XGkvHce6OHU5OAj4fYQ3LnoEvr_J2-MBdvKQlA==

GET
H2 200 project.js Show response
www.cybereason.com/hs/hsstatic/cos-i18n/static-1.10/bundles/ 1 KB
831 B 15ms
0ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs/hsstatic/cos-i18n/static-1.10/bundles/project.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab449241b50123673e76dbcd70f869ae11d26920f0ce1670fdfd266308058179

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 b3e6aa6408d9b27acff39fa80612846a.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 5921375
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Wed, 13 Sep 2017 02:51:30 GMT
server: cloudflare
etag: W/"0011aaf4067b097bcbfd9dc99a4b94c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: p6iak7Gl9Xyg7crK_8XyTwctOBvKD1DL
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-cf-pop: IAD79-C2
cf-ray: 55800d1fcc32d6e1-FRA
x-amz-cf-id: lLi1CcBmx-Xi6FkLEYHd3WlIecrpOBbSH03-q6iXq3O7SpgZHkNKEw==

GET
H2 200 v2.js Show response
www.cybereason.com/_hcms/forms/ 420 KB
107 KB 20ms
0ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/_hcms/forms/v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca83bf6c4611e07ea8b93893694e16957cd66082de76afb1ee564fba6f055750

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 a97d638d4e395a6f27b927572cf3bfda.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 390
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Wed, 08 Jan 2020 02:12:01 GMT
server: cloudflare
etag: W/"01f4b8448e5b99e492b97afdd1268a74"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: gCHbnfLfRD6TgIiY4HAm19.GmuNmLHpw
cache-control: max-age=600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C2
cf-ray: 55800d1fcc34d6e1-FRA
x-amz-cf-id: fHkgNam-Ri2OJAuWyt9CL-SdtTkDEp5onWcODTesgJIlv6GkrhKHMQ==

GET
H2 200 jquery-1.11.2.js Show response
www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/ 94 KB
32 KB 31ms
30ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs/hsstatic/jquery-libs/static-1.4/jquery/jquery-1.11.2.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 acb5e0138f17ffe7929a4d64a50c4a24.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 5920789
x-cache: Hit from cloudfront
status: 200
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Thu, 08 Jan 2015 18:08:00 GMT
server: cloudflare
etag: W/"5790ead7ad3ba27397aedfa3d263b867"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-cf-pop: IAD79-C1
cf-ray: 55800d1fec73d6e1-FRA
x-amz-cf-id: 4M9snjgk68qsYmuXR1mQhGXvjuiT4GNKfjfK6rWLBXxkvsUIVrgGQQ==

GET
H2 200 vyv2ljd.js Show response
use.typekit.net/ 20 KB
8 KB 176ms
174ms Script
text/javascript 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/vyv2ljd.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-67-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

cd7908a80313043ae934d5f599a062460c50f94370cee5dc092e0cb9b8d123ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
access-control-allow-origin: *
date: Mon, 20 Jan 2020 09:34:12 GMT
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
status: 200
cache-control: public, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
content-length: 7640

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 25 KB
10 KB 34ms
33ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

6df13a928059e963f9cc854385b6bfb34c4e480a4367601db6a05f49d7451ca2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9846
x-xss-protection: 0
server: cafe
etag: 12565290078578033988
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 20 Jan 2020 09:34:12 GMT

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 181 KB
55 KB 27ms
7ms Script
text/javascript 2606:2800:133:7403:4a68:7eff:710b:1ddf
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:7403:4a68:7eff:710b:1ddf , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F0A) /
Resource Hash: 672d6213183ae0e2c831c1bb3d7ecae4ffced9b5fb06094d28f5be9dade35e13

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:12 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: ECST
Age: 282
X-Cache: HIT
X-CDN-Proto: HTTP1
X-Li-Pop: prod-vmi1
Content-Length: 55595
X-LI-UUID: T91yW1CO6xWAcbJq3ioAAA==
Last-Modified: Mon, 20 Jan 2020 09:29:30 GMT
Server: ECAcc (frc/8F0A)
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1
Expires: Mon, 20 Jan 2020 10:29:30 GMT

GET
H2 200 cybereason-custom.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/5350539849/1569776480490/Custom/page/web_page_basic/ 5 KB
2 KB 26ms
25ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/5350539849/1569776480490/Custom/page/web_page_basic/cybereason-custom.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: caa333db2175837df41125b50f0c0169c55f919427ee2c6992e2566948e9e518

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 2013
status: 200
content-type: application/javascript; charset=utf-8
x-amz-request-id: F2C3858ED0C4821B
x-amz-id-2: uFANtJt21qLbKxYPnLI6kb3sG8jXcXTKDVWlf3zc70cgCWUu4iMK0qJEX6qIWICZfJv68z2G5YU=
last-modified: Sun, 29 Sep 2019 17:01:21 GMT
server: cloudflare
etag: W/"5ef74fad1c1382e5acb9ca424910aae0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: QSLj7gaEL7IC2nt4kS1_hdFjsekt2ki6
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 55800d1fec75d6e1-FRA

GET
H2 200 readingTime.js Show response
cdn.rawgit.com/michael-lynch/reading-time/4255f585/src/ 7 KB
2 KB 82ms
31ms Script
application/javascript 151.139.237.11
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/michael-lynch/reading-time/4255f585/src/readingTime.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2, US),

Reverse DNS

Software

NetDNA-cache/2.2 /

Resource Hash

6872a6c9c2a917ceeb92fefd3ef73cee7402a56689e1dbddf743b0aaa9e654c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload, max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; preload, max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
rawgit-cache-status: MISS
x-robots-tag: none
server: NetDNA-cache/2.2
etag: W/"56c9e3f737fa6f093a52c954565840d65fba231a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315569000, immutable
cf-ray: 4725f7a6ba4b693e-CDG
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H2 200 slick.js Show response
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.1/ 87 KB
15 KB 16ms
15ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.1/slick.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9baa573e4378873b7ac81ccb1d954ce9bb2b1a933947ad3012263ddc604d8505

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 7094188
cf-ray: 55800d1fe8ca9ab0-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:26:46 GMT
server: cloudflare
etag: W/"5afd4ad6-15b7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sat, 09 Jan 2021 09:34:12 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
7 KB 15ms
14ms Stylesheet
text/css 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 7001697
cf-ray: 55800d1fe8c89ab0-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: W/"5afd4939-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Sat, 09 Jan 2021 09:34:12 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 LOGO-Web-Owl-Mono-Copy.png
www.cybereason.com/hs-fs/hubfs/ 4 KB
4 KB 33ms
32ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/LOGO-Web-Owl-Mono-Copy.png?width=306&name=LOGO-Web-Owl-Mono-Copy.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6561b2dd1e1b0f9b2f678dfd01a29e1174ec8ac628405a546e42b717a2d3388b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 ae3759c8dc48487a424a60bd577ad555.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 217631
cf-polished: origFmt=png, origSize=8547
edge-cache-tag: F-6694579067,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="LOGO-Web-Owl-Mono-Copy.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 4120
x-cache: Miss from cloudfront
last-modified: Mon, 03 Dec 2018 23:05:56 GMT
server: cloudflare
etag: "272c915f8898375baf0a61f20d6a437c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C2
accept-ranges: bytes
cf-ray: 55800d1fec77d6e1-FRA
x-amz-cf-id: yyXHpR6XBm5qIK351CvZMMktdsalbRbKJTPU9yRaphqvaphXsQhsTw==
cf-bgj: imgq:85

GET
H2 200 CR%20Logo%20copy.png
www.cybereason.com/hs-fs/hubfs/Cybereason%20Logos/ 2 KB
2 KB 26ms
25ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/Cybereason%20Logos/CR%20Logo%20copy.png?width=228&name=CR%20Logo%20copy.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4aeba3c62a91ed236d5acdc5ea52f5e051801379d306817ad8f4c850e550d2a

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 1756
cf-polished: origFmt=png, origSize=3695
edge-cache-tag: F-6696434934,FD-5166594488,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="CR%20Logo%20copy.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 1838
x-cache: Miss from cloudfront
last-modified: Tue, 04 Dec 2018 06:42:08 GMT
server: cloudflare
etag: "23310787edb9779a8e7eaeb7b306639b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C1
accept-ranges: bytes
cf-ray: 55800d1fec79d6e1-FRA
x-amz-cf-id: F3o02Uo0T26u7gLkb0T-eR8f61ovFx6pxWXd2E1AHtEgdAZtt9uznQ==
cf-bgj: imgq:85

GET
H2 200 cr-owl-logomobile.png
www.cybereason.com/hs-fs/hubfs/Cybereason%20Files/images/ 5 KB
6 KB 22ms
22ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/Cybereason%20Files/images/cr-owl-logomobile.png?width=220&name=cr-owl-logomobile.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a6e3510af52bd4c550e719eef6ae49cfd1ff4be530c8240b4c8233a2860747d

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d4b41c13595dcfd327649d8cdea72ce8.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 217630
cf-polished: origFmt=png, origSize=9128
edge-cache-tag: F-6598017767,FD-5348774744,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="cr-owl-logomobile.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 5558
x-cache: Miss from cloudfront
last-modified: Fri, 23 Nov 2018 19:10:03 GMT
server: cloudflare
etag: "766b51e70e55d99809346026aba1e8ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d202d24d6e1-FRA
x-amz-cf-id: U0WIHBGncZ_SxdGhXvnhbaICDFZOTvqePh0U7_KcOl8jboR_BDeuwg==
cf-bgj: imgq:85

GET
H2 200 cr-nav-platform-cta-sm.png
www.cybereason.com/hubfs/Award%20Logos/ 45 KB
45 KB 24ms
24ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Award%20Logos/cr-nav-platform-cta-sm.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d111c83d2520fd8d1ec059493162072af6e97b725aa4b56eb846f09a01f8e9c

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-19074217591,FD-5876486557,P-3354902,FLS-ALL
age: 2012
cf-polished: origFmt=png, origSize=49423
edge-cache-tag: F-19074217591,FD-5876486557,P-3354902,FLS-ALL
status: 200
content-length: 45704
content-disposition: inline; filename="cr-nav-platform-cta-sm.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 99CF5EB5330C54D4
x-amz-id-2: pxgujia/zvXePEhCCPbGT5wLYdQTRTn3LTSNYRfwtHtdODob/eOC5JET+DQYNmSsF30PyGC7UYw=
x-cache: Miss from cloudfront
last-modified: Wed, 23 Oct 2019 18:39:48 GMT
server: cloudflare
etag: "954ec251009f855ca41c27fb77257c50"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: mzDN6bdznDFNk4FUdOIJrHxzn9JFsv4o
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 55800d205dccd6e1-FRA
x-amz-cf-id: vTHw_7MYBmC9sXhNCGfTMzeFaOXX_jmgr1zOrQEwJFiwjmhXORSBXg==
cf-bgj: imgq:85

GET
H2 200 anchor-blog-anatomy.png
www.cybereason.com/hs-fs/hubfs/ 46 KB
47 KB 33ms
32ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/anchor-blog-anatomy.png?width=780&name=anchor-blog-anatomy.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36f7203c0c832c5e36c66e09bf20eeb89430e9cc9078c97b38f8407d6c820f9e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 8d6071bd169bbf5fd46638140132b1d1.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78735
cf-polished: origFmt=png, origSize=81305
edge-cache-tag: F-23409367170,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="anchor-blog-anatomy.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 47528
x-cache: Miss from cloudfront
last-modified: Thu, 02 Jan 2020 07:40:01 GMT
server: cloudflare
etag: "23e439c8ba056190e7642b92edf9854b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d205dd0d6e1-FRA
x-amz-cf-id: sY2b5AOsakUx_9kWqLz2WApxOXoHrEA-7SLU6jjLGKm5oP3QP6u-pw==
cf-bgj: imgq:85

GET
H2 200 image-143.png
www.cybereason.com/hubfs/ 99 KB
99 KB 23ms
23ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-143.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 440c629e1bacb85303803b6ef57dfe9afa276b67e66241914530d1c3f3077827

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315829779,P-3354902,FLS-ALL
age: 67251
cf-polished: origFmt=png, origSize=175662
edge-cache-tag: F-23315829779,P-3354902,FLS-ALL
status: 200
content-length: 101072
content-disposition: inline; filename="image-143.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 34CC6F0CF7ED47F4
x-amz-id-2: J2k0cZjhvB5nZHMYL9G6VuW9SSTn1FB9zevlbbh+f9YAyEWU1M+vTNxPqa3LRVNrToKWjE70qRY=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:59:43 GMT
server: cloudflare
etag: "d1a2e5377bc97bb526dc6a4dce517e65"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: uN6b0rTfn_Fd7b_mZDjnk27ev6kimsyY
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d208e40d6e1-FRA
x-amz-cf-id: Ha26kpkc3rnyoG8ESoeUqbq3a5Esy6M5mkwvSyZb3u5jPDvf8pt2fw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-136.png
www.cybereason.com/hubfs/ 69 KB
70 KB 24ms
24ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-136.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b475cc00ef033ea824ceba778321c00bf3cbfa950403127d463d7207772e9366

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315934115,P-3354902,FLS-ALL
age: 585608
cf-polished: origFmt=png, origSize=113591
edge-cache-tag: F-23315934115,P-3354902,FLS-ALL
status: 200
content-length: 71000
content-disposition: inline; filename="Dropping%20the%20Anchor-136.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 52BC4D326B17155B
x-amz-id-2: dyr2hUXtW4scuO6lQZra6amoaageQDfNYGcIFPvXoOB0r4h2SNn+OxvI6cVDcXnbn2Yibf4VWhw=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:07 GMT
server: cloudflare
etag: "2501bc54ca4df135557c2035d744c250"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: qC8wNGDWiXG.QT1FE5nOFYwrKA_RY2Ls
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
cf-ray: 55800d209e63d6e1-FRA
x-amz-cf-id: 9x5IzohEH7QPzccREhkP-nCRSNLf3YmHH7Z0daU64kCowTO11ms1yw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-150.png
www.cybereason.com/hubfs/ 5 KB
6 KB 27ms
27ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-150.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c93e7d4fb10f32f63025c49b09a6d2c90c53bc4773a2472fd0e523707e4acaa

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 79503619d600dbc1c9e04a650d3d7f3f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315501192,P-3354902,FLS-ALL
age: 67251
cf-polished: origFmt=png, origSize=15922
edge-cache-tag: F-23315501192,P-3354902,FLS-ALL
status: 200
content-length: 5168
content-disposition: inline; filename="Dropping%20the%20Anchor-150.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: ED96AD96AA534DC2
x-amz-id-2: kau4YOxf/ZsvBiSZd+rmEULH5v5vD9bOCqDx9UmE6tqQvkYNjqmvqNRU2BXFq4greD+hgQiEiks=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "d7187c3ed30b15227fef909ad46824ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: iCzHHX6NKBHIhz6Q6pHXORnw721BM3k3
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d20aea9d6e1-FRA
x-amz-cf-id: j9eg9-c6WTE2TPgXrVet5OgB-x6bnaIEF4JqEFYZRfpgNz9djvDplw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-152.png
www.cybereason.com/hubfs/ 46 KB
46 KB 20ms
20ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-152.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 918f76fc6b2e421a20ee564c3540a81bfb5c431a3986ae6fa6493d0e8672a926

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315530866,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=69961
edge-cache-tag: F-23315530866,P-3354902,FLS-ALL
status: 200
content-length: 46906
content-disposition: inline; filename="Dropping%20the%20Anchor-152.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: DC95D4CE79A6E29D
x-amz-id-2: 6iqRbUVSQND6UNbxsdWWlKOnWQr1XetXnoIC/A7suiO7FZAKeVzgUGVEidvKlP0YK5jWKDTa3Zw=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "b34d978879fbcdc482a2f48a3a0f67a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: v0fQq1aUDNUP2.9ueI43mSe4GEpkJwxs
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d20bed9d6e1-FRA
x-amz-cf-id: CNLYauIwNXa0cO6u6mm2x_kPEmqePeFU2da2cr1o3dZaOhNYDjReJQ==
cf-bgj: imgq:85

GET
H2 200 image-144.png
www.cybereason.com/hubfs/ 105 KB
106 KB 32ms
32ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-144.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 428112df40e37a63922a1c8ecb4d83a8ff61560769719c99970c24feed583920

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315829842,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=175414
edge-cache-tag: F-23315829842,P-3354902,FLS-ALL
status: 200
content-length: 107862
content-disposition: inline; filename="image-144.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: AF1E593033CC3356
x-amz-id-2: mxmD5UatOHI660qElsMnVQKdZDbgeuuoCeiYUSSkixgsnDtEeum+FPvSGR/nuMoH9tv43z+jmJo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:01:25 GMT
server: cloudflare
etag: "d4a49cba6b5794bb2e355a51e0c9d93f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: cNu3xa89SrOkYn.O9ZSVmd4g51RJSYTn
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d20df32d6e1-FRA
x-amz-cf-id: H2nAUVviEcC_MLde50IE7wSn00EKpvxC6qLjnlGOXBLaT686feGe1w==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-149.png
www.cybereason.com/hubfs/ 10 KB
11 KB 37ms
37ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-149.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16734c168bc0ee32e687e91926c323112816f3368bea70a4dd726fb138406176

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 1463b274b31e0310acc7c754b8b5a550.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596158,P-3354902,FLS-ALL
age: 67251
cf-polished: origFmt=png, origSize=31003
edge-cache-tag: F-23315596158,P-3354902,FLS-ALL
status: 200
content-length: 10268
content-disposition: inline; filename="Dropping%20the%20Anchor-149.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 1207E516785F6952
x-amz-id-2: hHK4FE5b9Vj3NdT38B/DIb1QHAtiwMrzGjyaEmx3de5yJl7Miahtll47PkrZQm5onvO8zcDkfXo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "d69cfd5f9dbed6b5180dc74d011505b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: rP4puzLpCu5cmLEIcA1ah5rKnj42mBq7
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d20df40d6e1-FRA
x-amz-cf-id: Ib4Ia2XbiDppGFR32pR2szyxNOYNwMrjGZP1g03yv95UD5PDUvqwEg==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-168.png
www.cybereason.com/hubfs/ 6 KB
7 KB 30ms
23ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-168.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14f5cf42c16a91c63325e3477ac1c4e41190bd8778aef6434d969ade5e308f50

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315907314,P-3354902,FLS-ALL
age: 585608
cf-polished: origFmt=png, origSize=19301
edge-cache-tag: F-23315907314,P-3354902,FLS-ALL
status: 200
content-length: 6398
content-disposition: inline; filename="Dropping%20the%20Anchor-168.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 4DDA6716F94E7EAE
x-amz-id-2: WrJuJ3hoaChd10b2rxhlRuM2zJMHQkSQQFLArCPaPrBzhAn+pvS7TlFxRriN04Fg3DkqvYuLbL4=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:12 GMT
server: cloudflare
etag: "849ceb3b1d0900121cc5dff6abe51c03"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: kyXZ2CoqTwrWTzg8K0X7aqICSY9wNR0P
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
cf-ray: 55800d21282bd6e1-FRA
x-amz-cf-id: 0Axj2qUxkYDr0Xd-gjO_gmNmYrpfY8UiOowLlDcuIrPz0edgmR5lDw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-118.png
www.cybereason.com/hubfs/ 10 KB
10 KB 62ms
50ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-118.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c01181de5b62daa4b0f6ba48c8d910037c20c82aa1b04f4b025974f3e12bc2b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596135,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=42415
edge-cache-tag: F-23315596135,P-3354902,FLS-ALL
status: 200
content-length: 10096
content-disposition: inline; filename="Dropping%20the%20Anchor-118.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 04E0508A0415F578
x-amz-id-2: dmzQCw9ivSML01aSGJrNLjHbPXb2NHwpKccwQcPnj19yWbTx9IUUdzmChSqk9KS7p1I7hzZLzKc=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:04 GMT
server: cloudflare
etag: "38ad5a43d274f2d223c1e1e1e67c9d78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: bng9FUMf80o0aiqBsoelFjxX5zRGO0nB
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d21385ad6e1-FRA
x-amz-cf-id: 6BDIzAi7QtHTT6a0Nh0T3YELs3LmpuZR_e_LkpcCeBYI1XV7IRUv9Q==
cf-bgj: imgq:85

GET
H2 200 image-145.png
www.cybereason.com/hs-fs/hubfs/ 15 KB
15 KB 68ms
57ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/image-145.png?width=501&name=image-145.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1aa1914bca9b17240b963ee00f3b71443af47b02e48acd879cbda2b56170a509

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 ca8d1424de70ce439236d37048e65f54.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 67249
cf-polished: origFmt=png, origSize=32082
edge-cache-tag: F-23315930517,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="image-145.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 15236
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 17:12:10 GMT
server: cloudflare
etag: "e8bb964c38bb161105d21a13de7e5e7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C2
accept-ranges: bytes
cf-ray: 55800d21385cd6e1-FRA
x-amz-cf-id: Ox5tKhxph93fshBj9QUepp8mt94xcEqv9n0gASbN4FDwbYOkY8SJ6w==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-144.png
www.cybereason.com/hubfs/ 117 KB
117 KB 43ms
32ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-144.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7edf93100596da3ba8a71d86d8e8435961e9de7367b95b85e4d578da8a1370a

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596152,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=344232
edge-cache-tag: F-23315596152,P-3354902,FLS-ALL
status: 200
content-length: 119316
content-disposition: inline; filename="Dropping%20the%20Anchor-144.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: F55E7504AB42162E
x-amz-id-2: Oi2q963FZvNIvK1NnrZWqNRypdTPpQQbTsauV/dC81iuZ/iFAjg+MDL0w5lE6qlIa5BY+So9bhM=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:08 GMT
server: cloudflare
etag: "55a2d42208be41fa12312b492c0484f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: P0s043OOeg3sY9EaerzjQseszvyeaUl.
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d21385ed6e1-FRA
x-amz-cf-id: uzMzcMgrbksW-qa39V16YU1T63DoKDs1V1JIlfuqyR2XuSxBD2N7rA==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-119.png
www.cybereason.com/hubfs/ 4 KB
4 KB 56ms
45ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-119.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57f22a27d44bbaf200c76b1f4a768df1279e316042515f58ed05b8649167004f

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596136,P-3354902,FLS-ALL
age: 335452
cf-polished: origFmt=png, origSize=11214
edge-cache-tag: F-23315596136,P-3354902,FLS-ALL
status: 200
content-length: 3832
content-disposition: inline; filename="Dropping%20the%20Anchor-119.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 180F27E9820DA494
x-amz-id-2: Q9GQF5slQ7uLa4DchGuqBYnQnCiY/hH3frvOf92hOAeqkBPkGLGcQD1W9o0dMnxVXdB+aZvQf2g=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:04 GMT
server: cloudflare
etag: "e8629aeecb75bc59d650662910f66354"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: FQQZhUH3q4yhvUMa1fjwRu6NIzHQtEgf
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 55800d213860d6e1-FRA
x-amz-cf-id: gnhSIqsPfLl-mS-7oDMRAFhqP6q6N39URSeQB9VizYgpoTthac4Arw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-135.png
www.cybereason.com/hubfs/ 122 KB
122 KB 46ms
35ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-135.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89a0cd8835ea7f1f1c79af55c4f53827ad275661b0bfe2ddb9db7a396acb4ef0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596148,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=404955
edge-cache-tag: F-23315596148,P-3354902,FLS-ALL
status: 200
content-length: 124454
content-disposition: inline; filename="Dropping%20the%20Anchor-135.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 95FEBF1B8E273B3D
x-amz-id-2: wikKT6hhd+2nkIdz7yUnP6eGA4Nwdx6yT3+hxCKFuUur6YziQPYKjGBtk1W8BXep7SnjyCU1qC4=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:07 GMT
server: cloudflare
etag: "2f5223706e9d1037711bb828a14b8c1a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: gl5zjWCPslIvgwUU3U2YtkYbIarzCCOK
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d213862d6e1-FRA
x-amz-cf-id: BA-T-Fmd1wEyhoFNt4ZQxfRyqHjxZHUALNnKxrMnJzGVSBrG5uzoQw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-128.png
www.cybereason.com/hubfs/ 92 KB
93 KB 60ms
49ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-128.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9541d638a28ec17900ea4eb27f0cf2911a4bb336e446ac4e438ed18e6305707

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 07318a09275049862b4535d73a930b7d.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315530854,P-3354902,FLS-ALL
age: 67249
cf-polished: origFmt=png, origSize=266054
edge-cache-tag: F-23315530854,P-3354902,FLS-ALL
status: 200
content-length: 94352
content-disposition: inline; filename="Dropping%20the%20Anchor-128.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 810BA6E109E56D6B
x-amz-id-2: 9MA+GFtY9Qdl4o4Ikb/Pzsj+fMfo+kW/g25PgFwIc2Pv461LDCAzJrs3JvyHV2mvxRKE5C23iuA=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:05 GMT
server: cloudflare
etag: "40de8145ce2a88e098dc48d970ef5430"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: QZmFAi_0Gvz2CWPhZ884NUZS5YnwGiFu
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213863d6e1-FRA
x-amz-cf-id: SYV3WALA_LDJ2aNjGsjVI1Kh_8HwKdQIMZ9zE1spHzQAII034qWyRw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-146.png
www.cybereason.com/hubfs/ 11 KB
12 KB 54ms
44ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-146.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62e1ec48f41ce0da6c56c81e660db7174584762d2797faebc5bdd8b50b95f690

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 420810dc8ca5cb74b64cae9e4b264cc9.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315530856,P-3354902,FLS-ALL
age: 67249
cf-polished: origFmt=png, origSize=38839
edge-cache-tag: F-23315530856,P-3354902,FLS-ALL
status: 200
content-length: 11344
content-disposition: inline; filename="Dropping%20the%20Anchor-146.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: BD4C5C9C6D533253
x-amz-id-2: M4U9+eLY6cQCQqLC0+M56zYE8ILP0I2jGBKSVmktStwBVVYtvKJE0OlvkUd8iPYcTdtoDP1Yi7Y=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "782fc24e3ecae800d568fcdcb6b6a427"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: DlyOILb5PTOCAQIZlV6S3Ze2zb8LOusa
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213865d6e1-FRA
x-amz-cf-id: kcdPnj8qBZYgEWHpUs93E3wi-QjuFP7srmMTMY87UbLSG6Tmqfr0_g==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-117.png
www.cybereason.com/hubfs/ 51 KB
52 KB 64ms
53ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-117.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e794c519dde544a7ce82e363dfae77b940d18c38ebb6f8cd1934f6ed87f7d1fa

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 b7e7cd319ec31b533acb1e9e4b737331.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596131,P-3354902,FLS-ALL
age: 67249
cf-polished: origFmt=png, origSize=77299
edge-cache-tag: F-23315596131,P-3354902,FLS-ALL
status: 200
content-length: 52544
content-disposition: inline; filename="Dropping%20the%20Anchor-117.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: EC36983349C50687
x-amz-id-2: NK8NpYyF409/T8USy5g6MMYO7dO04SB2V9fMyrKLdcyfoeknpL3vWPKFMOX90kiOzHJK2L9Aa/0=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:04 GMT
server: cloudflare
etag: "2e7759d83b4c685c771de1ab3afc9f10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: LgeaF33njOyFk.7HUp2bsRXzbbicIyBH
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213866d6e1-FRA
x-amz-cf-id: namaUbKcreUGrg3sAZgawIPNiPT7foNosPK-WBs37lIJmHQj4RrPCw==
cf-bgj: imgq:85

GET
H2 200 image-146.png
www.cybereason.com/hubfs/ 292 KB
292 KB 49ms
39ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-146.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a915dce7f93a61c579d94a179b82bf21d9f202ea0d59f176c615df3afa11500

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 edee3ff8f335740e0ea86cf9f62b5ae9.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23309569257,P-3354902,FLS-ALL
age: 67249
cf-polished: origFmt=png, origSize=558183
edge-cache-tag: F-23309569257,P-3354902,FLS-ALL
status: 200
content-length: 298576
content-disposition: inline; filename="image-146.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 0831BD27D9C30D52
x-amz-id-2: lyMArCT4/4ajQp73QH4oMdJ7tem5a5NifMracErjgUO8X7gVGvgKQ3bFUT1Pd04+CxV+BEv7i1A=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:05:26 GMT
server: cloudflare
etag: "6d4beb70a3632ab36f248b6db34d9655"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: QB4fI1aBw3G8gLs9eVpY_W6pFp1eAkMD
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d21386ad6e1-FRA
x-amz-cf-id: RPqkpwC8gNViWjlhK-fzN3_kAD0XXAoAG3WUFVgAeSUCiq6Xm7SmuQ==
cf-bgj: imgq:85

GET
H2 200 image-147.png
www.cybereason.com/hubfs/ 255 KB
255 KB 67ms
56ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-147.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 199ac0e3e15d54d99f9828c28d4f32b6919595926c5dee07e8bcb10215382cc5

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315945732,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=477858
edge-cache-tag: F-23315945732,P-3354902,FLS-ALL
status: 200
content-length: 260680
content-disposition: inline; filename="image-147.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 3CC377E90CC8F9BD
x-amz-id-2: keXSzTRdTgj5bYW2+KcNRMoXmCkqGtxAdpF1aat0hcGKs19sjd4SDJH6LOIwogwgJ4dqwCQnXRo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:06:04 GMT
server: cloudflare
etag: "d19011ed8411f801760f269f8a83d8be"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: UX8IqsZG4qZOVSq9t5S2njvGBBG3obNr
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d21386fd6e1-FRA
x-amz-cf-id: _qk0rzGB18ds18bDwkarNfg1dZPoetSrLfRo2QHnV6ZCpIesJtXzFQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-131.png
www.cybereason.com/hubfs/ 14 KB
15 KB 44ms
34ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-131.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 764f3bc000ae1ec04d320f7d642c0c709c0b9945e22c5c4e0997b89da5c6c2f8

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315501186,P-3354902,FLS-ALL
age: 573655
cf-polished: origFmt=png, origSize=33086
edge-cache-tag: F-23315501186,P-3354902,FLS-ALL
status: 200
content-length: 14668
content-disposition: inline; filename="Dropping%20the%20Anchor-131.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: E7A837CDF32392CB
x-amz-id-2: qH/b7sP3zjdsmikCuWGH/RvS8bmYZnTopGiV3U0gsxg7WAkyj4Fvph7S0ZFLm9l6h6Da/yTySHY=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:06 GMT
server: cloudflare
etag: "66277efeec9875b4b44bc766c685d459"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: wUUZ9qNMrbr5vHncLzfaOoPGx7jzeXtH
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 55800d213874d6e1-FRA
x-amz-cf-id: epl1EPKODmlN3zuRqlPZ94b2BPXOjqg5FFPGytcece7BaUcD6o368g==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-139.png
www.cybereason.com/hubfs/ 13 KB
14 KB 53ms
43ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-139.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c71ee652f3c95d29791f115bb0e3ae79882e7628f4b4c343d119ded1db2dcdd2

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d76fac2b5a2f460a1cbffb76189f59ef.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315934120,P-3354902,FLS-ALL
age: 67248
cf-polished: origFmt=png, origSize=31528
edge-cache-tag: F-23315934120,P-3354902,FLS-ALL
status: 200
content-length: 13654
content-disposition: inline; filename="Dropping%20the%20Anchor-139.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 682F500AECDF827C
x-amz-id-2: ECSo7QUCi91y9nOQvNl0keshpcptG6H/yEl1gKIsYydaHl5oWbNym7B5kzXlXdacFSg5zrqppJQ=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:07 GMT
server: cloudflare
etag: "3571953b5325e79f2c84831ac9d0062d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 2NSNIJYD97Cwmiso5xXAaq.5W_nrIL6v
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213876d6e1-FRA
x-amz-cf-id: kDcFkgFX9vAXZlxhWz4bCyV0NGiAuBUHXMRcwyyH14R6lAyRngs2xw==
cf-bgj: imgq:85

GET
H2 200 image-148.png
www.cybereason.com/hubfs/ 227 KB
228 KB 62ms
52ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-148.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d069db2940a36440e37c77efc2c69e24025be3a6d23576d854906d04c7a3269

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 821f1951140ddf83c7de719a44727403.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23309569431,P-3354902,FLS-ALL
age: 67248
cf-polished: origFmt=png, origSize=441007
edge-cache-tag: F-23309569431,P-3354902,FLS-ALL
status: 200
content-length: 232752
content-disposition: inline; filename="image-148.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: B65F6D085A884738
x-amz-id-2: ZT9FARppntfeEy2ZSD74qXaG5mx0iE2U+45Ovf9F6xqcyUgkC5saOOJ0cHUSZhesp7lMKdNmoYQ=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:09:17 GMT
server: cloudflare
etag: "90b58c62e3507dcd25872923d1d2fcda"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: cOF5HROw9Tg4X1G8SGEt3hozQYvbASY9
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213878d6e1-FRA
x-amz-cf-id: BU3pjKNCo-znNnLYHQ8_LwvS87gPYQavTCmGgGV6yvPZ7NCeqYs2SA==
cf-bgj: imgq:85

GET
H2 200 anchor-blog-injected.png
www.cybereason.com/hs-fs/hubfs/ 22 KB
23 KB 54ms
45ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/anchor-blog-injected.png?width=780&name=anchor-blog-injected.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0871f9beca255fae7cb220883a4afea87e056f7ec0be457ac571cc37b8f0ed

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 fb41e17254dfd781519e95cedd257827.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 573655
cf-polished: origFmt=png, origSize=36539
edge-cache-tag: F-23409510152,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="anchor-blog-injected.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 22868
x-cache: Miss from cloudfront
last-modified: Thu, 02 Jan 2020 07:40:00 GMT
server: cloudflare
etag: "23fd7d4eae880cd65217ae0754da004d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d21387bd6e1-FRA
x-amz-cf-id: oDFJI4FDja8PPp7yZAr51WGs8AX7XgyTGTIwsLLxuP-xNraF_BAQ5Q==
cf-bgj: imgq:85

GET
H2 200 anchor-blog-root-cause.png
www.cybereason.com/hs-fs/hubfs/ 25 KB
25 KB 57ms
48ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/anchor-blog-root-cause.png?width=634&name=anchor-blog-root-cause.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14b7f23c8d20b84191aefe2d24804938cdad99ad72b85002ab70b0982a613f70

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 3dcb635971b5d310e8941cdb963aff70.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78736
cf-polished: origFmt=png, origSize=48484
edge-cache-tag: F-23409469074,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="anchor-blog-root-cause.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 25586
x-cache: Miss from cloudfront
last-modified: Thu, 02 Jan 2020 07:40:00 GMT
server: cloudflare
etag: "678e71e6e796669c270b4692bea0b654"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d21387ed6e1-FRA
x-amz-cf-id: EAefZR80Wfif_exV0gSNcl-e8URC8qQO68NhQkt26Bxm8dnBZX3o0g==
cf-bgj: imgq:85

GET
H2 200 image-149.png
www.cybereason.com/hubfs/ 75 KB
76 KB 76ms
67ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-149.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d87485cf1848c8b47b527790aa2ae1384192a93df403b6bfe0108e5955e6f0d

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 79503619d600dbc1c9e04a650d3d7f3f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315865320,P-3354902,FLS-ALL
age: 67248
cf-polished: origFmt=png, origSize=169370
edge-cache-tag: F-23315865320,P-3354902,FLS-ALL
status: 200
content-length: 77140
content-disposition: inline; filename="image-149.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: E819A1BAC7FC2EB8
x-amz-id-2: Il87iCdYG89u8yXe+oNAc1xrgH2Yz5sdXE7rxRSwA588PEvNTiSwZF1ahfzJm+cmYpyCcL9XFb4=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:14:01 GMT
server: cloudflare
etag: "bd589966031ca17f4462c97d080a196f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: qaEzAKab.4TQal9xv.t3.U8aCB2e._EC
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213882d6e1-FRA
x-amz-cf-id: jmteziPsjox00TdqhjI0OKjQ3tFpeYvs-9hekxgXXAQhQN9IiNm9bw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-161.png
www.cybereason.com/hubfs/ 3 KB
3 KB 53ms
43ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-161.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1210d043e764980a84cb736945173829ccb1ff4f2161dc47cf9314799edcaf44

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315917984,P-3354902,FLS-ALL
age: 573655
cf-polished: origFmt=png, origSize=7677
edge-cache-tag: F-23315917984,P-3354902,FLS-ALL
status: 200
content-length: 2790
content-disposition: inline; filename="Dropping%20the%20Anchor-161.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: CD71C061537CC647
x-amz-id-2: BPxVVPpUxcVL3ZlLBxx8Z3NHH9JRdS/uWk6dgB5sIRZfQtYuCDNgCaQ1Fkvmc9XzRg4GPOclNAc=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:11 GMT
server: cloudflare
etag: "eb931bf0665cdf47a2ae1fca83440221"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: w6DfaHhjff_gtK6yLvP.kSF8Xq9a553m
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 55800d213883d6e1-FRA
x-amz-cf-id: KDARsyWXj-nh1T-UrbwR4d8BCuoy5-vBXBGRz5fnyF2NzM1Io62C_Q==
cf-bgj: imgq:85

GET
H2 200 anchor-blog-rundll.png
www.cybereason.com/hs-fs/hubfs/ 25 KB
25 KB 60ms
51ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/anchor-blog-rundll.png?width=780&name=anchor-blog-rundll.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f165f18bc46a735677d81ecd2d6c467d5f6433ea3b3a2173b559f4f923dd833e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 9acd372742573b89975d7dceea2dc950.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78736
cf-polished: origFmt=png, origSize=42125
edge-cache-tag: F-23409469093,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="anchor-blog-rundll.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 25194
x-cache: Miss from cloudfront
last-modified: Thu, 02 Jan 2020 07:40:01 GMT
server: cloudflare
etag: "9ebbc505ae374cb1e5eed0939c8aa0e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C2
accept-ranges: bytes
cf-ray: 55800d213889d6e1-FRA
x-amz-cf-id: eDIkSxmvx0f6PcF5iBFUR2jKBppNgj0WoanrBIihReMPl7YvcamUlA==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-142.png
www.cybereason.com/hubfs/ 16 KB
16 KB 74ms
64ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-142.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e33f3c897be63e437b0abcdd3ce9c6e33027e9d35cdbe13cfa47ab92f1c7cef7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 07318a09275049862b4535d73a930b7d.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315851682,P-3354902,FLS-ALL
age: 67248
cf-polished: origFmt=png, origSize=54810
edge-cache-tag: F-23315851682,P-3354902,FLS-ALL
status: 200
content-length: 15872
content-disposition: inline; filename="Dropping%20the%20Anchor-142.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 7072A850853F2C36
x-amz-id-2: PcFIWb0SSxQsy2Ahug/wVO7S3mvNKOKAhw/QdzcnxcyFrmYfaxOAWzU8J8jqkf1E9nMWIK3EJR0=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:08 GMT
server: cloudflare
etag: "c74e81c1dd5f22484f9dbe9375e7f7e7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: Zhcoa1TW09Dr.UexMickCkgP6x98gmSC
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d21388bd6e1-FRA
x-amz-cf-id: JYwVCuSmqou7iO-Q7pytlJup9jeh2ccgzZ04j0d1lVeRwmhTLSshGQ==
cf-bgj: imgq:85

GET
H2 200 image-150.png
www.cybereason.com/hs-fs/hubfs/ 28 KB
28 KB 73ms
63ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/image-150.png?width=521&name=image-150.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 798c2889cb75fae42481fa23b5c65aec754eccdd4f597f8d26425854a384366a

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 156336391961f724345f6534c674b6eb.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78736
cf-polished: origFmt=png, origSize=62840
edge-cache-tag: F-23315830369,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="image-150.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 28418
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 16:25:59 GMT
server: cloudflare
etag: "1364b1b284b5812d7bbf93ab71c28fbe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d21388dd6e1-FRA
x-amz-cf-id: QfWg77YeznmuS7NByP5uggC9-pRjQVY3ixIhhGev_UwvkqzRAyU-gQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-130.png
www.cybereason.com/hubfs/ 4 KB
5 KB 94ms
85ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-130.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18e336799cfccfdcd3ddb264f6da771dc96e4eec223175223674429d993433a3

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315501185,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=12301
edge-cache-tag: F-23315501185,P-3354902,FLS-ALL
status: 200
content-length: 4012
content-disposition: inline; filename="Dropping%20the%20Anchor-130.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: E0B1F9CC07AB9A1A
x-amz-id-2: lEg6ghTz1SEm4YTuqdFZKe/P7c0J2RtCTzUeP+YBRwpCq43r/m41zoyDWtvcV3JheVRJGRZqzTU=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:06 GMT
server: cloudflare
etag: "0351c8ae920658cbb9e76dede0247cc9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 8VLVy4OQ5qY5rK2IrL0tcxx4Wb8N1mY6
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d21388fd6e1-FRA
x-amz-cf-id: 1A-qAtLIlc7CsGwaoU1Hjys9HkM24kKLNCcXoVzUHEZ49_GTXEs7hw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-138.png
www.cybereason.com/hubfs/ 66 KB
66 KB 77ms
67ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-138.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b5c439fe05b516d689a934de8d30fb45ca72d056b509ad6a375c956a8e4daac

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315917965,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=104802
edge-cache-tag: F-23315917965,P-3354902,FLS-ALL
status: 200
content-length: 67448
content-disposition: inline; filename="Dropping%20the%20Anchor-138.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 3AF2F6C32292D241
x-amz-id-2: LHYQ6ehqsPiLdkrh8bHyQHx5aRFnJTYZ/ERpJ2pMN6yLEZBekzlIm8Z3Qd+P4gjzyWyOxfTEemA=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:07 GMT
server: cloudflare
etag: "6df087b86cfc52c90224dfc6b3865b4d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: aVjaExVwVaSMTldaY.Y_sNJD4U3bIK7Y
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d213890d6e1-FRA
x-amz-cf-id: l-SqlwAm_aeRn_dMqCAK2cvKwF72cPPq1FlXxQAC71DOzK9H1iZXyg==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-133.png
www.cybereason.com/hs-fs/hubfs/ 17 KB
17 KB 67ms
57ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/Dropping%20the%20Anchor-133.png?width=636&name=Dropping%20the%20Anchor-133.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61a205756a8354d8a86f36ac8f9a7fb364b8ed1d0ffaaac8be56d04ec90afa6b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 ba82151bf51e4c722c5305c983d8b71e.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78736
cf-polished: origFmt=png, origSize=22747
edge-cache-tag: F-23315917960,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="Dropping%20the%20Anchor-133.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 17378
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 17:12:10 GMT
server: cloudflare
etag: "e4c9e617cfd47d1bd8e6093d4ae9f92e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d213891d6e1-FRA
x-amz-cf-id: Y8TxvDr0CqyQIgPw1h69J4lvJdi8u-GIGMOFmHHuI45r8-2gIPw2yQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-141.png
www.cybereason.com/hubfs/ 2 KB
2 KB 77ms
68ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-141.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 922775e912a16f140b15ada5253a420ad1d57666a6b84077e03a5f4110c85cd7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 f99b5b46e77cfe9c3413f99dc8a4088c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315907293,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=5034
edge-cache-tag: F-23315907293,P-3354902,FLS-ALL
status: 200
content-length: 1588
content-disposition: inline; filename="Dropping%20the%20Anchor-141.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 6799422D8FE0D4EC
x-amz-id-2: VNU07a6Re8zLC4EnHsfGLytetQnb7DwxoksD1wkSkWkQII8uqa5DPyV14g5HzjoUIWuDLQN+q8Q=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:08 GMT
server: cloudflare
etag: "e689bb754d0ce021905a0ccb108b5328"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: ppyI7b0t2nbOTtwyDTparE0SQBTAv_oF
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d213895d6e1-FRA
x-amz-cf-id: MgTkLrM3Ry5OuauXfMYa9SddeWZAi5G4FWVRo_By9nO8XJdUqQI6Iw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-124.png
www.cybereason.com/hubfs/ 92 KB
92 KB 68ms
59ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-124.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 560001e399c4a3bce56f94544e12b4831c295b5d1ea0e5d419c137856f50135d

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 e7ce333c56f455a0dae7f1f5ea5d6086.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315643680,P-3354902,FLS-ALL
age: 67247
cf-polished: origFmt=png, origSize=231897
edge-cache-tag: F-23315643680,P-3354902,FLS-ALL
status: 200
content-length: 93936
content-disposition: inline; filename="Dropping%20the%20Anchor-124.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 6BB242479D66947D
x-amz-id-2: JMKa4Szn2ULELY3d6QMd99CKHB+Sr+OsxH3SEEvzadM6KVTKZWCUHRgBVv25tZPEswQDaPALaRo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:05 GMT
server: cloudflare
etag: "97f16069135a17f4c9b5ccf4927521db"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: d5Kaim1GPPhsA5mZdHDmmeBCOd5xhRbJ
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213897d6e1-FRA
x-amz-cf-id: oGm85xsBKhSvLg4FhhQGYf3KsSzS4J-plP4_PY385pZuE_IGwdRq3g==
cf-bgj: imgq:85

GET
H2 200 image-151.png
www.cybereason.com/hubfs/ 215 KB
216 KB 78ms
69ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-151.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10dd0a271e034a534e86710ff450a05f9426e5cbef84d8c8d353e9fec7988b57

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 79503619d600dbc1c9e04a650d3d7f3f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315931317,P-3354902,FLS-ALL
age: 67247
cf-polished: origFmt=png, origSize=482770
edge-cache-tag: F-23315931317,P-3354902,FLS-ALL
status: 200
content-length: 220136
content-disposition: inline; filename="image-151.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 7509DECE49769058
x-amz-id-2: GayoktrK5v6R/igUbRTFB32i3kpVuldMMcywcOmRAHalQIMwdk+u2rGycbxFafkzUdtDbQAvzbc=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:21:03 GMT
server: cloudflare
etag: "4b3a7a4fc4dd73a77f437f7932e07732"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: duI9W7ijNkkjhp1NA09EEgXxzWXgauRw
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d213899d6e1-FRA
x-amz-cf-id: M5nyBZxQNIo_jch-JugMpwHFDBaLU3BFOFLEp6kzU9SJsQ_Rn_ONFg==
cf-bgj: imgq:85

GET
H2 200 image-153.png
www.cybereason.com/hs-fs/hubfs/ 27 KB
27 KB 64ms
55ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/image-153.png?width=474&name=image-153.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a11e9e6d3c89dd9c18941ec59fb63c4c71c3e2f99205754ea7b930d720e7799d

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 148f45d892bd2198be5295012ed59888.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 78735
cf-polished: origFmt=png, origSize=49654
edge-cache-tag: F-23315865539,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="image-153.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 27158
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 17:12:10 GMT
server: cloudflare
etag: "b8b5547fb2a2fb73552780506a18421a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C1
accept-ranges: bytes
cf-ray: 55800d21389cd6e1-FRA
x-amz-cf-id: Vc-02LAODKHxr8HPLiFXJVTlnOsJjf0l4b3uphkzBDnBffsrCZzQjA==
cf-bgj: imgq:85

GET
H2 200 image-154.png
www.cybereason.com/hubfs/ 633 KB
635 KB 175ms
167ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-154.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44b1812a8c754f7577ea423bd42fd646ae1515b8a935cd2520671c50c8675ac7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315931450,P-3354902,FLS-ALL
age: 67247
cf-polished: origFmt=png, origSize=1044807
edge-cache-tag: F-23315931450,P-3354902,FLS-ALL
status: 200
content-length: 648570
content-disposition: inline; filename="image-154.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 28E6A36630620031
x-amz-id-2: tubHLQSPRT3IHSNd7xiF9W/dcPCVc0RxTOwcInJ8L58loWRW6gTqylf3DyT3BczY0tMPuheYFjo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:24:38 GMT
server: cloudflare
etag: "a6c6eab7ef67a7d17a22e7f4c3633cc6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 3179UZoL1KzXoH9JHu4gzqBi8ZiBvX4o
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d21389ed6e1-FRA
x-amz-cf-id: LOfLeYSDZxPntuvR98kfMuyX3N379diQmjY-Uj4qA8mPEGwOsAJB0A==
cf-bgj: imgq:85

GET
H2 200 image-155.png
www.cybereason.com/hubfs/ 264 KB
265 KB 161ms
152ms Image
image/png 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-155.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b2ea2f871ef2c9740005e5066579896a36adfb3a13c48676a072ab46c030a76

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 216b2e0a8a27f8fca1b540a1c4ea6922.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23316316922,P-3354902,FLS-ALL
age: 78737
cf-polished: origSize=340391, status=webp_bigger
edge-cache-tag: F-23316316922,P-3354902,FLS-ALL
status: 200
content-length: 270447
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: BC4B3957D3CD3790
x-amz-id-2: wjKPod+u2wrBuU9lHC3oT360jhpg3xn9hQJ8y7/r+JwpNknCvO8Om09K4V0tgImIlICViNvLOVI=
last-modified: Wed, 11 Dec 2019 01:25:18 GMT
server: cloudflare
etag: "6d91cc9665a3c08e321865d4b945ea7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: aGsmMsbb5Nqg4g7a31qlAMiCJVTFxa1d
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138a1d6e1-FRA
x-amz-cf-id: RgMBgUWvde_tXhsrmJJM4zebHaF5pMt9mej_zVdCc20WCMsTxEelnQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-148.png
www.cybereason.com/hubfs/ 63 KB
63 KB 94ms
85ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-148.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e519a869fc9b4e0f0464f67f6ffdb8c2fa0ad502c2509f9a94dc59522bea3a7c

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 91ba7c34719cd9c69e0357c149b94b90.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596157,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=130171
edge-cache-tag: F-23315596157,P-3354902,FLS-ALL
status: 200
content-length: 64140
content-disposition: inline; filename="Dropping%20the%20Anchor-148.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 8B6153EA12B514AA
x-amz-id-2: bRnNDEYt41Vw6ErbKrsdEMztS5cUafJTd3MLpF2OEnxfAiVo8Deyoay62XsOeNNj5aOMa9M1YIY=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "a52d4a56279fc96ac7e14d1bdc20b569"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: QFJULJ.gVMZhkhFctgioc3n1JLbhHj93
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138a3d6e1-FRA
x-amz-cf-id: WR2GTFYVJwqA089q5xwbtbNvFNfCmGtbZZH3tVzSNJTl7XWSa0khCg==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-134.png
www.cybereason.com/hubfs/ 9 KB
10 KB 75ms
66ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-134.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22dc09757e49b150433d84255dcacb04dff7e6976eb88d194a53c6792183bfb5

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315917961,P-3354902,FLS-ALL
age: 67246
cf-polished: origFmt=png, origSize=40337
edge-cache-tag: F-23315917961,P-3354902,FLS-ALL
status: 200
content-length: 9468
content-disposition: inline; filename="Dropping%20the%20Anchor-134.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: C29169A143DF29A9
x-amz-id-2: 6BGv9HM1Zphyo9diDDkg+GO0JKEvXyOMN1EO6Q1nuuOqxznp5DzDwQR4mTUCwmWFi77kbur4Hv8=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:06 GMT
server: cloudflare
etag: "2cd7efd0a44084de71dfd5a443362923"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: E77cHvNszUpBdp1kjeD1XpY7SHJ3Zf_i
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d2138a7d6e1-FRA
x-amz-cf-id: cfAAHRtFwPmKx8patehrmsX8dAgNBryao9i-0lGUGeVEr6gzUBv2OA==
cf-bgj: imgq:85

GET
H2 200 image-156.png
www.cybereason.com/hubfs/ 46 KB
46 KB 79ms
71ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-156.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6a1417e09eeea9c83affb5ac3accc92f44b37569b78e15e959c1d06c1edbaa3

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315931587,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=101925
edge-cache-tag: F-23315931587,P-3354902,FLS-ALL
status: 200
content-length: 46978
content-disposition: inline; filename="image-156.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: A3057DAB43E55C67
x-amz-id-2: FqMS2DdsYKrUE7CjAwY/QLAdqjNvFCIm0zYqxDDWnlZkfnWh2Zzd604rldgnQOKKKoZbhXNVKSs=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:28:09 GMT
server: cloudflare
etag: "91716594522e03bbbe4fde12b0ecddc9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: NyIVIAeO0cz_Zs30aMoCSnxVIcHrQY7N
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138a8d6e1-FRA
x-amz-cf-id: ZBitVgul1IXLJ1B3kbjPW3DdB_JzcrEylacU2y9aJZqmghdcEOLHMg==
cf-bgj: imgq:85

GET
H2 200 image-157.png
www.cybereason.com/hubfs/ 119 KB
119 KB 74ms
65ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-157.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b787edbadba36b6415e7e55e9fae5132e154d83c103d478384a434650bca71c9

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 efed2d5ffeb697060f4a3aa73bdf068f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23316317065,P-3354902,FLS-ALL
age: 67246
cf-polished: origFmt=png, origSize=278256
edge-cache-tag: F-23316317065,P-3354902,FLS-ALL
status: 200
content-length: 121416
content-disposition: inline; filename="image-157.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 64DE36D043310269
x-amz-id-2: lzlAgQgSNr+qaUtvFnLkp2nGs+jqUV4Zfd//MRJo8zsj/eUM40xv9E3UEqlL7IFiznOUL1FXI14=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:28:35 GMT
server: cloudflare
etag: "c0a8f5b2af92edc5c5ee62d7c0bdc91c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: vY3oFf98X7TUfWVw.U4YSxvku48akMDU
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d2138aad6e1-FRA
x-amz-cf-id: 9Owg1lTbOJ-0MV6veUvD_zYhGuJAjF7wTT79h9AYqM9fT76VvbbiWg==
cf-bgj: imgq:85

GET
H2 200 image-158.png
www.cybereason.com/hubfs/ 138 KB
139 KB 54ms
46ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/image-158.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33ae66f4883ae8da4084a5196a48b3e313f21cf33abae20e3274ef2ea824bd4e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315830822,P-3354902,FLS-ALL
age: 78736
cf-polished: origFmt=png, origSize=200838
edge-cache-tag: F-23315830822,P-3354902,FLS-ALL
status: 200
content-length: 141674
content-disposition: inline; filename="image-158.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 545EA5B3F8EA71C8
x-amz-id-2: nyhoThLOMokALNWU7Yk+hJNpcPMSAtVmEPbx9WBkQyFX/9J/bBg85fw7BNOnG0+QuNVh/ypT8CU=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 01:30:37 GMT
server: cloudflare
etag: "0997251a1cffc8a1c6d6dc5508557af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: lH7U9EuWdW1OAxB109iJdp3VfPy_zwL2
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138abd6e1-FRA
x-amz-cf-id: MGU_cVmymItBdR_xwP5M9cyRod-AnqY5FeJJWRxHMEAtBFrE885UOQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-127.png
www.cybereason.com/hubfs/ 34 KB
34 KB 68ms
60ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-127.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33e5e9998115684c5bc0230530df912330f32a8e777405a6536a37dca9e6741f

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 e5b747ffd1713cb17ddd7d55234a3301.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596145,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=54609
edge-cache-tag: F-23315596145,P-3354902,FLS-ALL
status: 200
content-length: 34390
content-disposition: inline; filename="Dropping%20the%20Anchor-127.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 147633AA725270F1
x-amz-id-2: swIib7iDxrFmgtNW/eKiQLOfHTtJ4c2EZEljxqEr+ogM+Pwqs3egc8G0qPX/ExxRwZs+cN3gsTY=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:05 GMT
server: cloudflare
etag: "89ceee3cf57f738ada67616aeeb68147"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: iwBHq0eM3Nwfdb4FG6umzPVQndplUKWO
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138acd6e1-FRA
x-amz-cf-id: 4Gc9d9sxXPJDzbS-paKz5Oc3FVBl-WeEWYe1-zI4_IoKFPWGiu25Ww==
cf-bgj: imgq:85

GET
H2 200 image-159.png
www.cybereason.com/hs-fs/hubfs/ 53 KB
53 KB 55ms
47ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/image-159.png?width=705&name=image-159.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cc0c0e98b47965020aefcb3c7331f8196e1da5bef9a129eb7b79d9679758313

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d4b41c13595dcfd327649d8cdea72ce8.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 573655
cf-polished: origFmt=png, origSize=94841
edge-cache-tag: F-23316317217,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="image-159.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 54170
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 16:25:59 GMT
server: cloudflare
etag: "b612a081218ef0883580c674f74e8b47"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d2138add6e1-FRA
x-amz-cf-id: UhME-pEi3kNa1GcWp-04ZrXHE_hFMKNpWfPzs8X1YSFlCf6_GqGg8g==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-147.png
www.cybereason.com/hubfs/ 4 KB
4 KB 74ms
66ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-147.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73ee936a71d2b070f90474f19aeb537873164d4e9db2dc11c26df4ad33eee0d7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 0f820adb6671fcc6033a9aa95ec8e0fb.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315596154,P-3354902,FLS-ALL
age: 67245
cf-polished: origFmt=png, origSize=16852
edge-cache-tag: F-23315596154,P-3354902,FLS-ALL
status: 200
content-length: 3796
content-disposition: inline; filename="Dropping%20the%20Anchor-147.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: EFFB42BBD42BC31E
x-amz-id-2: YQuvwMFznlfNZIxlXylqxecjzFaD4+Gl7Cnyfei6GHDDpP8ra8wnSRNPlgJtZENOshc00x5PQLo=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:09 GMT
server: cloudflare
etag: "bb38be2ab09c015cb377855dd0a0ca0f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: fDfZzIGhgLX.0z_KTv6_Lq.cqeT7PEDU
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d2138b0d6e1-FRA
x-amz-cf-id: JxNmLTcKUzlf4qsguU4KDF5hFO3suxcxURq6h7I980Px_igp7vXQqA==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-132.png
www.cybereason.com/hubfs/ 14 KB
15 KB 63ms
56ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-132.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e8fe397d798b2a4e99332da31b0aad26c806ab97337a6775c756b909553a4f0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23309314835,P-3354902,FLS-ALL
age: 573655
cf-polished: origFmt=png, origSize=48155
edge-cache-tag: F-23309314835,P-3354902,FLS-ALL
status: 200
content-length: 14598
content-disposition: inline; filename="Dropping%20the%20Anchor-132.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: E60410B21FF97130
x-amz-id-2: 8kAWQCUMEGaH53ksKzgGWPpfaz1BovclZw2Rf/oO65U/etThdc3dVjjzDcbtNm9GIIwQBCwKhGQ=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:06 GMT
server: cloudflare
etag: "8de0a1e582ccd3ef2deecbda53652afd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: E2Zs6w9rfkb2OWRhjWSY_kK3Bm2ds7Xe
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
cf-ray: 55800d2138b4d6e1-FRA
x-amz-cf-id: WRqYQXYhc2hLG6fy5khvfqM1POAqBU22Jj-9JPSUeALNV5dzCUmIIw==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-121.png
www.cybereason.com/hs-fs/hubfs/ 8 KB
9 KB 92ms
84ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/Dropping%20the%20Anchor-121.png?width=447&name=Dropping%20the%20Anchor-121.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8e21943966ef208ab8905e7439caccb19e1a7daaac3fd35cb81e913ae4b1743

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 c242c974a465288488c7876cabca7752.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 67245
cf-polished: origFmt=png, origSize=24931
edge-cache-tag: F-23315530850,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="Dropping%20the%20Anchor-121.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 8368
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:05 GMT
server: cloudflare
etag: "d461fe8adc3a76b148eb8458d118803f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C2
accept-ranges: bytes
cf-ray: 55800d2138b6d6e1-FRA
x-amz-cf-id: 1DcdImRL1ECr2GGV7LAHJVjGm_nk-ARJKkD8ueeUNcjAtMVkdRYReQ==
cf-bgj: imgq:85

GET
H2 200 image-160.png
www.cybereason.com/hs-fs/hubfs/ 17 KB
17 KB 56ms
49ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hs-fs/hubfs/image-160.png?width=487&name=image-160.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 173e887c2a8c9a8df7ce1ff784e1dffe6089239df9c82207c36a352454404ea5

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 335452
cf-polished: origFmt=png, origSize=33506
edge-cache-tag: F-23315866054,P-3354902,FLS-ALL
status: 200
content-disposition: inline; filename="image-160.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-length: 17384
x-cache: Miss from cloudfront
last-modified: Wed, 01 Jan 2020 16:26:04 GMT
server: cloudflare
etag: "ca23bc2da8237f177b3b18a9de8c9ea9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
x-amz-cf-pop: IAD89-C3
accept-ranges: bytes
cf-ray: 55800d2138bbd6e1-FRA
x-amz-cf-id: nihviZlLSO_-P-7VrNMXuaIHfSv4h4ViV76LdvoEuMv41y16I4C2NQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-120.png
www.cybereason.com/hubfs/ 18 KB
19 KB 66ms
58ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-120.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd8fc30068f5b417cc2293a9910eb11036285affab5681aa2b92a472f4b13f0a

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315934101,P-3354902,FLS-ALL
age: 78737
cf-polished: origFmt=png, origSize=70064
edge-cache-tag: F-23315934101,P-3354902,FLS-ALL
status: 200
content-length: 18844
content-disposition: inline; filename="Dropping%20the%20Anchor-120.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 5574D542C5BAF8CA
x-amz-id-2: Tvei97anXfife1SKH+QZKbW70eX9xUocE9RQ9AwBgb73P4bSi2S/NsnohsjqXRFQO7DY8ufqE80=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:04 GMT
server: cloudflare
etag: "4ea39d5f93a11caa60637f86da9309b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: kK.CIDm2cxMYXKU_qtWSscVtHlVfYxak
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138bdd6e1-FRA
x-amz-cf-id: bQbGjL7UDWcTxY9EEuHvmyWmIJmJzpN5cV2zWs9Jam4U6chvx_uIMQ==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-163.png
www.cybereason.com/hubfs/ 25 KB
25 KB 61ms
53ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-163.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 809ecdb25b0c622568945db5ddc3f620c91f6a3c52fc6e252eb9c3ba484b2559

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 616f617776e843142ab5d87231cb3526.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315643699,P-3354902,FLS-ALL
age: 67245
cf-polished: origFmt=png, origSize=91027
edge-cache-tag: F-23315643699,P-3354902,FLS-ALL
status: 200
content-length: 25340
content-disposition: inline; filename="Dropping%20the%20Anchor-163.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: CB03642BEEE023C2
x-amz-id-2: 96+VJy6CgEfAESs1SnIMkORHMEYFpX6x1B8LSz3bLEucH0DVXZhhEvxwN7ziJmF/pFjEQzveZHA=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:11 GMT
server: cloudflare
etag: "74476f2e0ccc8dd81fc58418bb2cc3a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: dRcjm6mutOghSih_cSn.tQ_Y3l8IUSBg
x-amz-cf-pop: FRA54
accept-ranges: bytes
cf-ray: 55800d2138bed6e1-FRA
x-amz-cf-id: Wzfl5f76NoMna9agSxrFzadmUTMv9og3lr4QSJjA0Xt_bs3Pu2pw_Q==
cf-bgj: imgq:85

GET
H2 200 Dropping%20the%20Anchor-137.png
www.cybereason.com/hubfs/ 31 KB
31 KB 164ms
156ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Dropping%20the%20Anchor-137.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77368a6af3446eaa4e4cdd554611969b0658f7e328057dd7182983675ff3b15e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23315353965,P-3354902,FLS-ALL
age: 78736
cf-polished: origFmt=png, origSize=133971
edge-cache-tag: F-23315353965,P-3354902,FLS-ALL
status: 200
content-length: 31448
content-disposition: inline; filename="Dropping%20the%20Anchor-137.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: ADA3AF7592A312FB
x-amz-id-2: NhrBZ4WYlDgL/9f8t2u1H/PzvO9v8Xmrb+6c4fgWiGMGJ86rNhu86PqSiSKrhLo0ULg5rsDcCGk=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 00:31:07 GMT
server: cloudflare
etag: "bd0ba33009a8e1a53c990ff7fc1fa9cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: I0m2uDsNncPiUc8jhJ1HL_kf29MfT_no
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
cf-ray: 55800d2138bfd6e1-FRA
x-amz-cf-id: KWpUnPc51N4Ppx9RXCCJ4VjL4KieBhwn6gbae_LvJsiMa-1y7W1GbQ==
cf-bgj: imgq:85

GET
H2 200 soc-blue-fb.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 2 KB
1 KB 54ms
46ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-blue-fb.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b71a982dad86829660cef46a0467ecf81c34576eece4b297126a552902ef543c

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665926,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665926,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 6A1EFF1253A805E0
x-amz-id-2: tB7PFoy0X+DeRETN1vvXUwSsmTuNQYogXxrUzCY5jTS5nKrvCwWxLpvEgfitCRhibUNjj4JkbEI=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"6a18b1cc988c1076e049cda4cbcd4153"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: kKljKdFH3buDh02hr4JKseZqGd9UNmJC
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138c0d6e1-FRA
x-amz-cf-id: _hzClq_pfp6g1YZVxrLZTDhqX9A7KpYKTViRV5DHPvz0AehOumbWlQ==

GET
H2 200 soc-blue-tw.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 4 KB
2 KB 57ms
50ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-blue-tw.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 496f753f7e96c1427cf6e11d9c5f822a5f1f46b3c54b7429df9a195fa8362884

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d5fb859c39a16d7f218b4c7fb1528ad6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665934,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665934,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 9C383BD3996F0C82
x-amz-id-2: 5v3JZ8BTWe2lPdefbwtwHlDvGWU2vKDtVaQgw9EUKEsMG49MVPN/Eq4rcAghiL2vMx7hmFdof2w=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"0b57c6649a05d662ec7f30d40940f833"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: D3IpbdW8RRnzDTspH4xTHYjY3Gw9XB_2
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138c4d6e1-FRA
x-amz-cf-id: -NG48criaFhwLkxI0JE7oaQHdfi01WxPUgV3bqVHY-QsNPec4XSA4w==

GET
H2 200 soc-blue-li.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 6 KB
3 KB 100ms
93ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-blue-li.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d52338fe73e62ffcfa568e9ea399ef0c88783883327b794eace9faa78febf8

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665927,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665927,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 139E2075DA5C2293
x-amz-id-2: u9oG8qk7U5poea8FkeHKwbY1TGo0sRbXM+ESAG68PBtXUHQAEy94W7FWSuXo4NkNDp2SsbE1O7w=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"5e6c5282d1c524efcf53ed15f3d5bfcf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 4hkpKyRa8xBg1y3U4IHwCZVBen9AnWpx
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138c5d6e1-FRA
x-amz-cf-id: 8gXUFrhiVZq0Hu6YC9bEeyI_EJPZkoCD2zXBgusmqHkafshxou8yiQ==

GET
H2 200 soc-blue-all.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 2 KB
2 KB 62ms
55ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-blue-all.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ebbf16975e8957d1e3b765a49226e95711b30af5852c253906c2f171325949b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d3039ad83798b26ecb9f9f1e666afe27.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665923,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665923,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 79626A5FDBB05DC0
x-amz-id-2: ob/GXonAdvHc7pxjoJQBLcnN9Inr/R2EO1NUnOiS2Jel2SdquoleHPeUAqZDKzshHZjpxTlYfKM=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"9243f0c4bf7f108e60528f8e0d1c316a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 9BhyX.B86mcN2azKUAqRU6M3GLg60M66
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138c8d6e1-FRA
x-amz-cf-id: imQwHyVWqQ1fGs4RLdtQA6r6bitCZ7kArA--h9VYeozosm3cRD33FA==

GET
H2 200 back-to-blog.svg
www.cybereason.com/hubfs/ 1 KB
1 KB 78ms
71ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/back-to-blog.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2432844517e2dd99a05c54b57aac9aac78553489b6111ace7c3d97b826af19ec

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470517914,P-3354902,FLS-ALL
age: 387071
edge-cache-tag: F-5470517914,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 29C40EB7116FDC8C
x-amz-id-2: RKEN/LTbblN9idRKBSTeVXiAXxrAhMx9I4m4YQo5uIlleHsYbnvtY95OMJ3G/qnmDLyvdpR0QLs=
last-modified: Fri, 08 Dec 2017 21:03:59 GMT
server: cloudflare
etag: W/"f8eec92543191f23fee7ab47394dc947"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: AQqdyWUpAjHHjtN7KvPODBFXJFuM5V8s
x-amz-cf-pop: FRA2-C2
cf-ray: 55800d2138ccd6e1-FRA
x-amz-cf-id: 2Lj9XVmGjGu3JqWnyOxEurivjMmX8zMnG-MQ39dRHkTlkyuuLApscg==

GET
H2 200 soc-white-fb.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 2 KB
1 KB 258ms
251ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-white-fb.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a14dbbe7e5a2fea61d3eb0edcbc959c9df66f8ab1322051606283f281aacfcd

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665944,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665944,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 7B905A5B82186E4D
x-amz-id-2: SJKvmGNiR8Ty7RzMgq3w2HS6vLd4q2uz1HjLfoSiknvtfaZTwHrSjnr3nQWez8czAA1BBeMHljo=
last-modified: Fri, 08 Dec 2017 19:35:36 GMT
server: cloudflare
etag: W/"1d582ee7bb25c7a6fc7b946555b8e478"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: tpnNG87aH3sAGfdAeTJSBOroimuwndS9
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138ced6e1-FRA
x-amz-cf-id: _K-RJW5bIEpDVb0goDXiL7YyFk-8mLHP4lUsPfLDeBQr-uffUjrMPQ==

GET
H2 200 soc-white-tw.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 4 KB
2 KB 72ms
65ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-white-tw.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b45cb384c0bce67cbfe97ffb78913fe0049922279f9985c7c78c2553e6988927

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665943,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665943,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: DDC56329451DFB44
x-amz-id-2: dRCOOiTIgl6vYJOouKbhOAO0uTXeus9em0VOW7f6VI/WREsWyqeI1ENsdbDkCt+4DHJdjsnK4c8=
last-modified: Fri, 08 Dec 2017 19:35:36 GMT
server: cloudflare
etag: W/"998facdb4f84c51899272e3021b751e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: nwFU80z_knQh7GRSx9F5nf48ASw8sdVq
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138d0d6e1-FRA
x-amz-cf-id: 0e_AJBsgKJ2a80EB7MnUwTv_fbRXymAaeosUU0Ge7fSLVJLPMY_frQ==

GET
H2 200 soc-white-li.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 6 KB
2 KB 91ms
84ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-white-li.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07a58803f40da69055153491ec078aba127d5b185dd7ddcae8edde6a9b06aea3

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 35c75b7f0ca8c787d67c8ebd22bc7fc3.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665930,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665930,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 26954E8A363BFC60
x-amz-id-2: fiuxpEJVEJCwzjy9efSqIbBzaR0R11Eniap4FUAvR8/gfBjZ74da4CD8WBcTNfZDyf8ZeX7RekM=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"2fa039ec598ada32d8e622ce06981caa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 7hgNjqSN.6ho4JIlDB6L.aHVmXaB2ZmL
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138d1d6e1-FRA
x-amz-cf-id: 5FSXMM5lmxBn2Rsi5sr6v4TWwjSgsXGwSSVzs5TWqsSKjON2hsEWQA==

GET
H2 200 soc-white-all.svg
www.cybereason.com/hubfs/Cybereason%20Images/ 2 KB
2 KB 64ms
58ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Cybereason%20Images/soc-white-all.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f874c0c598ebed0993d62f73526322c043050b8c24084b84fa3c2e9a934d147

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 7ed7afde326861e358c3c83359e99895.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470665929,FD-5168280605,P-3354902,FLS-ALL
age: 925302
edge-cache-tag: F-5470665929,FD-5168280605,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: CA036175A80872E9
x-amz-id-2: j/HUuh5SMmaKvCn17kWfthlCtuW58WUe8WZGaamLcYSkds+VYXkvRlVa1CiLt/VHM7heWCASe9Y=
last-modified: Fri, 08 Dec 2017 19:35:35 GMT
server: cloudflare
etag: W/"25ff6de7c679184558c3a70f7f916f52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 3LvZOqxpk.RltNKX324YWadLNCD9kfRc
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138d4d6e1-FRA
x-amz-cf-id: AwMvblVbCniFzoq9QcyOcp7ewiq_mUXZ0mo86Jch7Wc9Ve5JysVmpQ==

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 79 KB
26 KB 27ms
20ms Script
application/javascript 2606:4700:10::6814:6e27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:6e27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

132c8e6ec790b8c46b76b90e6e09f8d30af5aba933948ad2718ac04523eef007

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: e5s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 87925
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
last-modified: Wed, 11 Dec 2019 09:16:11 GMT
server: cloudflare
etag: W/"13d57-5996a14685594"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=172800
cf-ray: 55800d213c9f63e3-FRA
cf-bgj: minify

GET
H2 200 cr-logo.svg
www.cybereason.com/hubfs/ 7 KB
3 KB 73ms
67ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/cr-logo.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 173db45379b49d9271f8638f9f80936b5e74671a2bbb8376e394090ae9db931e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c5.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21223925924,P-3354902,FLS-ALL
age: 2012
edge-cache-tag: F-21223925924,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: B9852A802F6921C4
x-amz-id-2: EbokLt1NT3eTvxkzzkQwhqmxN1+kzAL8/KV3dMsaPvFzivOazWOTqYuoAt6zGKJeI2NEV2Qe+tY=
last-modified: Thu, 14 Nov 2019 17:13:14 GMT
server: cloudflare
etag: W/"adecc79934699dcf241e9b6f8f8b280b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: B.7LxTlHESzhX6SLvf9EJR3NJ0vLM7Ei
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138d6d6e1-FRA
x-amz-cf-id: Bscfc2k87AxwZrK-vVOH29kGZQdzTpxfaSqmQZbHtXqX4tx9tuYoew==

GET
H2 200 twitter.svg
www.cybereason.com/hubfs/social-icons/ 792 B
845 B 91ms
84ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/social-icons/twitter.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0005cf2627e9e54179f90c78bbf355fccafb3907c4ae9e699bc09c4a57d75bf6

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 8e04f5d6c745b231c10fce7c2aa9c70f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21232815295,FD-5415380040,P-3354902,FLS-ALL
age: 1756
edge-cache-tag: F-21232815295,FD-5415380040,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 271E2E60DCB62DE6
x-amz-id-2: gHiiZWkF4X8/4VBempeeXpVgES5yfOhIE5K4WjhOR2gxs2qZsHsOaTRmpXJebNjK87SAihWFncc=
last-modified: Thu, 14 Nov 2019 17:24:01 GMT
server: cloudflare
etag: W/"14debb189e620cc0a3c4ea84a614b8d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: IMkvHwxtEDDIUOZjgxuxmMpUX.nX82Sy
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138d8d6e1-FRA
x-amz-cf-id: jrMjODu3AZZXk_lOdW82rsAdmZr8hRjbKLKwApWIHqoCo8MbdSBF2g==

GET
H2 200 linkedin.svg
www.cybereason.com/hubfs/social-icons/ 529 B
805 B 71ms
65ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/social-icons/linkedin.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fc1bd4c0666cad8d8af42cf8f26c59bc5535b3d907b4db560c7db627e1e5253

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d5fb859c39a16d7f218b4c7fb1528ad6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21232480017,FD-5415380040,P-3354902,FLS-ALL
age: 1756
edge-cache-tag: F-21232480017,FD-5415380040,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: B25590D16E6D57E7
x-amz-id-2: Yysjy9jm0eZZwnFTeXb3/l5ZUs1NDVxO52Hcow855pkOxSekf+07wyOFBBXhH/rZW3QvUC9Zbbc=
last-modified: Thu, 14 Nov 2019 17:24:01 GMT
server: cloudflare
etag: W/"847da66019040cba5b0aed254309f083"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: b893YG7fG7.uXMP.wuBYwG7bD7IigLB0
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138dbd6e1-FRA
x-amz-cf-id: 47qGqXorWti_uQI06S-uPshXvuK6jWr4QeNQKZ9QFUv5JyopfdkIdg==

GET
H2 200 youtube.svg
www.cybereason.com/hubfs/social-icons/ 729 B
837 B 72ms
66ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/social-icons/youtube.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 312c7a4e3e547301e162c0bf3a7788cf8d52caf2668fbafc01351c9185b97ce4

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21232480018,FD-5415380040,P-3354902,FLS-ALL
age: 1756
edge-cache-tag: F-21232480018,FD-5415380040,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: 17CD4000B350DA93
x-amz-id-2: jot6WeG/mO+uYffq5Rzjg1+uLYNTdYw40hyotDOp3AEuPmnyFgaGXOYdOlrNOFxTyWnKIpIU0V8=
last-modified: Thu, 14 Nov 2019 17:24:01 GMT
server: cloudflare
etag: W/"8c8a5ac2ddb60a58a59c7236297f35e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: FRY7VN7QoyOabw.AAGUdC1vw3qSDmi_m
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138ded6e1-FRA
x-amz-cf-id: IYPkOWARk6rWTqjtkz4HLWMw7BdvUjjJHwuCJjxx4RI7s5UZ9Zp7Fw==

GET
H2 200 facebook.svg
www.cybereason.com/hubfs/social-icons/ 433 B
751 B 74ms
68ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/social-icons/facebook.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b329852f8f537591d001152e26a1b598ef4e4466fa10d859135843c307d5344e

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21224264479,FD-5415380040,P-3354902,FLS-ALL
age: 1756
edge-cache-tag: F-21224264479,FD-5415380040,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: B2257372163CBA21
x-amz-id-2: qVA4DACvAXq0Sj4JyR7qfB1xGeq4b9lQcnRUecHOfVFjaxLLhFQACIvy7j7pZwH2sxaCzr+o1pw=
last-modified: Thu, 14 Nov 2019 17:24:01 GMT
server: cloudflare
etag: W/"e97d7b693699cf2ee748031bf4de38f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: C89llISjlQVo62IUPVtqXB4yDzHnmHiT
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138dfd6e1-FRA
x-amz-cf-id: d7H1FxRzrJJ4EbD5VNAOgzul6InqOPuBb2g0ilKOB3LejadurzdIQQ==

GET
H2 200 instagram.svg
www.cybereason.com/hubfs/social-icons/ 2 KB
1 KB 69ms
63ms Image
image/svg+xml 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/social-icons/instagram.svg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 008a6b447b38fe87dac9127b3e47c83f89df61e8ac7285a7e86051ee89e99af9

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 25c6baf0a31a5ef699c1e219b25ce7b9.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21223960139,FD-5415380040,P-3354902,FLS-ALL
age: 1756
edge-cache-tag: F-21223960139,FD-5415380040,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
content-encoding: br
x-amz-request-id: C2175FD47740E975
x-amz-id-2: uOgfL/9Nrnki/jz1GoExwSa1+I0npDSTRp0EzYlo4DsTBRVi3qWurFhsX71g6CaxFfH7nElHF+A=
last-modified: Thu, 14 Nov 2019 17:24:01 GMT
server: cloudflare
etag: W/"a1012cd27290947d9af72c0ea4236beb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: q2McvAidvV50PdQS5eg2kQ60XsPr41Is
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d2138e3d6e1-FRA
x-amz-cf-id: TQdogitqvhJFXp0eKmHJumwPl81qQ2L8cBWY0MggzjLldnzKU-__ZQ==

GET
H2 200 module_6216123918.min.js Show response
www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1537797472057/ 611 B
631 B 35ms
34ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/module_assets/1537797472057/module_6216123918.min.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2832d2ff340e31dfb8300ecaf6967737af72f2c8981c895443abc7c6eaeb6993

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 391
status: 200
content-type: application/javascript; charset=utf-8
x-amz-request-id: A5D92A5ED432BCA4
x-amz-id-2: SkGIJxoy+xjbKK10O9kYbJG3MTe6BI4r/3Wtyyf/76OIE2wM1RQzRCzVaOqpQi7iyDi0uXJ+fsI=
last-modified: Mon, 24 Sep 2018 13:57:53 GMT
server: cloudflare
etag: W/"ca4367b687b17634cfcc1f04939ca9ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: LVTFd33H8mC6aV4tWUEgRObV0FIQuz30
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 55800d201cf2d6e1-FRA

GET
H2 200 3354902.js Show response
www.cybereason.com/hs/scriptloader/ 1 KB
579 B 109ms
103ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51d484ea340d3443bf875889a10126272a6f1bc5d0b3817e45897db189a0a14b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: br
cf-cache-status: HIT
age: 1756
cf-polished: origSize=1636
status: 200
cf-bgj: minify
server: cloudflare
x-trace: 2BB484679C23A7FE7FD3B178085438D33B2ED805E6000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=60
access-control-allow-credentials: false
cf-ray: 55800d2138e4d6e1-FRA
expires: Mon, 20 Jan 2020 09:05:56 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 6 KB
3 KB 93ms
31ms Script
application/x-javascript 23.210.250.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-44.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8bd397636ecd49c36d687ad591807ea5ee621b1e11888657827902a5003fc4bb

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Jan 2020 07:28:40 GMT
Server: AkamaiNetStorage
ETag: "522e4451790939ca385c10f4b474de63:1578382119.826889"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2617
Expires: Mon, 20 Jan 2020 09:54:12 GMT

GET
H/1.1 200
OK 58e26bc626b13471520000d9.js Show response
tag.marinsm.com/serve/ 38 KB
10 KB 218ms
151ms Script
text/javascript 151.101.112.65
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.marinsm.com/serve/58e26bc626b13471520000d9.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.65 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cowboy /

Resource Hash

154991194443aaeb774be577ea462c94fb6375d3926af0e00b6896581000a593

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:12 GMT
Via: 1.1 vegur, 1.1 varnish
X-Content-Type-Options: nosniff
Age: 0
X-Cache: MISS
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 9671
X-Served-By: cache-hhn4041-HHN
Server: Cowboy
X-Timer: S1579512853.742878,VS0,VE132
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=1800
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 11ms
5ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: FERWPf3ztg24dwsVrL4DdgiY4+TVxEUDcHZ71W7yxqCINDmP2XvRfedGt5wN8x1teV2KCaem7ErYuJUhYkJg2w==
x-fb-trip-id: 1850256238
date: Mon, 20 Jan 2020 09:34:12 GMT, Mon, 20 Jan 2020 09:34:12 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sf14g.js Show response
t.sf14g.com/ 37 KB
37 KB 348ms
102ms Script
application/javascript 34.192.123.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sf14g.com/sf14g.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.192.123.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-192-123-20.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
last-modified: Tue, 16 Oct 2018 18:33:02 GMT
server: Kestrel
etag: "1d4657eab9c909b"
strict-transport-security: max-age=2592000
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 37787

GET
H2 200 hotjar-704918.js Show response
static.hotjar.com/c/ 6 KB
3 KB 64ms
20ms Script
application/javascript 147.75.102.135
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-704918.js?sv=6

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.135 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress6

Software

Resource Hash

e1faf24d298d90e4232535a1c09e874049601290a25f62d16c270ad65e960cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjar
age: 246
status: 200
access-control-max-age: 600
section-io-cache: Hit
content-length: 2215
x-cache-hit: 1
x-frame-options: SAMEORIGIN
etag: W/1b26bef0a6473a250da4355e44fd9ef6
vary: Accept-Encoding
section-io-origin-status: 304
access-control-allow-origin: *
cache-control: max-age=60
section-io-origin-time-seconds: 0.090
accept-ranges: bytes
section-io-id: 51de9d974f65b3ea69223cb83520e556

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/ 2 KB
1 KB 21ms
16ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/934771702/?random=1579512852641&cv=9&fst=1579512852641&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&tiba=Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd7d6e2c9512769909e715261bdac948654139377cc994055d37b5762eee8229

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1071
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 l
use.typekit.net/af/343335/00000000000000003b9b0ad0/27/ 16 KB
16 KB 55ms
54ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/343335/00000000000000003b9b0ad0/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "eedb93b5a9ba82f97df21a2548066c304a8baad8"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 16112

GET
H2 200 l
use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/ 16 KB
16 KB 25ms
24ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4b34d2/00000000000000003b9b0acf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "2d91046573f0e4458e7737f18f00bb9c13388e11"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 16252

GET
H2 200 l
use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/ 15 KB
15 KB 27ms
26ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cb6232/00000000000000003b9b0ad8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "865da7d2ecc4da3cb6bd5574f01738cfc5c8bb11"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 15448

GET
H2 200 l
use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/ 16 KB
16 KB 36ms
35ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/abc1c3/00000000000000003b9b0ac9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "8c3ee2b4e977df4e0f73e1b985c24fba9611fc49"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 16652

GET
H2 200 l
use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/ 17 KB
17 KB 37ms
36ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/62203f/00000000000000003b9b0ac8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "7b5be73a29b093f7ae3c099f5a521c9274f6db28"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 17148

GET
H2 200 l
use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/ 16 KB
16 KB 47ms
47ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/19a2f0/00000000000000003b9b0ac7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "b9e1ecdf0fe601a7e9dfc362b400290203e7b31c"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 16456

GET
H2 200 l
use.typekit.net/af/cfbead/0000000000000000000146b3/27/ 23 KB
23 KB 48ms
48ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/cfbead/0000000000000000000146b3/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "122498e3424e674610da39fb441d661549879239"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 23248

GET
H2 200 l
use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/ 15 KB
15 KB 52ms
51ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f50d41/00000000000000003b9b2c84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/vyv2ljd.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "13c2813ff67959226aaa4eccfcdd1399bd756b8d"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 15336

GET
H2 200 milan-degraeve-0ztvUdH5b-A-unsplash.jpg
www.cybereason.com/hubfs/ 3 MB
3 MB 50ms
50ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/milan-degraeve-0ztvUdH5b-A-unsplash.jpg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7aaaef607fd666b5201c90c274524a44686d6e7f18f8b80937395decd4573509

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 511c8b6c7e903efca023a504d527516b.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-23340752029,P-3354902,FLS-ALL
age: 260
cf-polished: qual=85, origFmt=jpeg, origSize=4089739
edge-cache-tag: F-23340752029,P-3354902,FLS-ALL
status: 200
content-length: 2918784
content-disposition: inline; filename="milan-degraeve-0ztvUdH5b-A-unsplash.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 20BE2A3752CAA100
x-amz-id-2: fbV9lxE17pjJbJW0JxKU3ySrt3P8lRmU2XgmpUG/39pRA1sEGZSlCGRFEWBthMYYzCHia5O5CL0=
x-cache: Miss from cloudfront
last-modified: Wed, 11 Dec 2019 10:29:01 GMT
server: cloudflare
etag: "8503c912009a9af5d7be5e956eaedcb8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: G_tMfk17jG.cbKD2rxoT2bUZ.Yi3iaiI
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 55800d2148e9d6e1-FRA
x-amz-cf-id: bImj45TB8m7qOtnpaJQjxeDeewGP9qdxLwX-tF2oiqTBSskk2lxJRQ==
cf-bgj: imgq:85

GET
H2 200 CR_Owl_Web_Mono@3x.png
www.cybereason.com/hubfs/ 8 KB
8 KB 53ms
53ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/CR_Owl_Web_Mono@3x.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2cbf6e27293c523afe11d21dad446397ed4ad9c7da2a537cdd986ff3b1b4cbef

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-9105202110,P-3354902,FLS-ALL
age: 260
cf-polished: origFmt=png, origSize=33164
edge-cache-tag: F-9105202110,P-3354902,FLS-ALL
status: 200
content-length: 7772
content-disposition: inline; filename="CR_Owl_Web_Mono@3x.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 0D9AA273951CF1C9
x-amz-id-2: cPstwtiXELNbon7Dzjp9IAemwjqioaqK4moqvfjzMQBTIxLCXrp2ESxQ0ZmAor2CttVw3aPblNQ=
x-cache: Miss from cloudfront
last-modified: Wed, 24 Apr 2019 17:39:57 GMT
server: cloudflare
etag: "b659bda1fc8f2df36acf622c9d9331c5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: iyRnBn_O0GUZbIH3l_mSf75s_.btUs_c
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 55800d2148ead6e1-FRA
x-amz-cf-id: s0n53y1IxtNksVsRtDKzHvWlbBC3_kHHWxgEdbcf4mSEjLDbhJlsrg==
cf-bgj: imgq:85

GET
H2 200 featured-overlay.png
cdn2.hubspot.net/hubfs/3354902/Blog%20Feature%20Images/ 165 KB
166 KB 27ms
12ms Image
image/png 2606:4700::6811:f3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn2.hubspot.net/hubfs/3354902/Blog%20Feature%20Images/featured-overlay.png?t=1513647154353
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bea2f9a81ff3f3fbbf2ec0a87e55d9f3ac4f0175c2c8be4db3aef9ac3d5a4f4

Request headers

Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d78b645a0212e56f1a04609bf83554e4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5462123206,FD-5339435640,P-3354902,FLS-ALL
age: 390
cf-polished: status=not_needed
edge-cache-tag: F-5462123206,FD-5339435640,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-type: image/png
content-length: 169104
x-amz-id-2: M1OKdywcW13PwszYMydfg9nEwTgRtHD+X3dw0n/xqijgYEon/PqEsjKt1XLbbypn0f3OLfbpN9Y=
last-modified: Mon, 04 Dec 2017 21:20:34 GMT
server: cloudflare
etag: "d0df19a6304235f7db891e67ceec2f0e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 6D5E9DA7EEDB2860
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: Hc5Bj7HcwoRhwKWqkaF4P6ee537gYNei
x-amz-cf-pop: BRU50-C1
accept-ranges: bytes
cf-ray: 55800d215d08d6c1-FRA
x-amz-cf-id: wfOQrSwgzKUrFzIpd40E63ESiZtOazTBqVsjDpo863wbnSgWEa0aAw==
cf-bgj: imgq:85

GET
H2 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 75 KB
76 KB 14ms
14ms Font
application/octet-stream 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
cf-cache-status: HIT
age: 7007079
cf-ray: 55800d2158abc2e5-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 77160
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: "5afd4939-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
expires: Sat, 09 Jan 2021 09:34:12 GMT
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 DINNextLTPro-MediumCond.woff
cdn2.hubspot.net/hubfs/3354902/Cybereason%20Files/fonts/ 50 KB
51 KB 36ms
18ms Font
application/font-woff 2606:4700::6811:f3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Files/fonts/DINNextLTPro-MediumCond.woff
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b293e4c10e7df359f78a8c4f0b5106f2bfa3d8b6de7e43441724849c3734d38

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 d3039ad83798b26ecb9f9f1e666afe27.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5348526345,P-3354902,FLS-ALL
age: 2120
edge-cache-tag: F-5348526345,P-3354902,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-encoding: gzip
content-type: application/font-woff
x-amz-request-id: 742B6CBDB22E4151
x-amz-id-2: 5NyQZMhFKfr/uxCgf76TCb1K6xG2J32l0dUwCSNhis3bgTporoE6PoMhTD4zSAiO39SFEbhSUuA=
last-modified: Sun, 08 Oct 2017 14:12:38 GMT
server: cloudflare
etag: W/"169de8bbeb4aa5db5f87b95f2ab95714"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: sGlGR.53wqPoExj8Omwf.6WtxL86SIC7
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-cf-pop: FRA6-C1
cf-ray: 55800d217fa5dffb-FRA
x-amz-cf-id: FXizOrRIGIRm9Ulpjojox8xSUNofugxSrnQcGBZ8QffNLHHLIejmSQ==

GET
H2 200 -F63fjptAgt5VM-kVkqdyU8n1i8q0g.ttf
fonts.gstatic.com/s/ibmplexmono/v5/ 36 KB
18 KB 7ms
6ms Font
font/ttf 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexmono/v5/-F63fjptAgt5VM-kVkqdyU8n1i8q0g.ttf

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

128cfa4458d1c804e935930664e96ff59b16139513d6492b6ee031916862246e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Thu, 16 Jan 2020 19:52:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308494
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18109
x-xss-protection: 0
last-modified: Tue, 16 Jul 2019 02:44:46 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Jan 2021 19:52:38 GMT

GET
H2 200 recommended-bg.jpg
www.cybereason.com/hubfs/ 33 KB
33 KB 26ms
26ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/recommended-bg.jpg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 290413fe1d21f4efc20f033f39acc3161043941087be7058a9412b9b4ef3630d

Request headers

Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5470760609,P-3354902,FLS-ALL
age: 5332
cf-polished: qual=85, origFmt=jpeg, origSize=108319
edge-cache-tag: F-5470760609,P-3354902,FLS-ALL
status: 200
content-length: 33348
content-disposition: inline; filename="recommended-bg.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 96276F6B923D4BB1
x-amz-id-2: a/FOTgIaygHl7THVHLiuhgM1CS9aGZfuJIOJ5oW07FVZ8lkohRCdbfImZy719d8q8NZ5UV3rN8c=
x-cache: Miss from cloudfront
last-modified: Fri, 08 Dec 2017 20:45:02 GMT
server: cloudflare
etag: "1c033d413cd83761f8b3dec27b6f6c0a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: ehpqu3LaIuFE1n7KlwvrlDoqjLDDhj8O
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 55800d224baad6e1-FRA
x-amz-cf-id: mny7r1JCNohB34s6derBm1_K-mPLeyiY_tE2txYVgfxH-CmLcEn8-Q==
cf-bgj: imgq:85

GET
H2 200 shutterstock_268212047.jpg
www.cybereason.com/hubfs/Blog%20Feature%20Images/ 107 KB
107 KB 23ms
23ms Image
image/jpeg 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Blog%20Feature%20Images/shutterstock_268212047.jpg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0eef96a783ea9affa188920d63f858a9b11260d5c07de0b9efaaa4c52f1b5c

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 befe3b8553d90339ecf78e5d7cefa60b.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5364596400,P-3354902,FLS-ALL
age: 260
cf-polished: degrade=85, origSize=195270, status=webp_bigger
edge-cache-tag: F-5364596400,P-3354902,FLS-ALL
status: 200
content-length: 109248
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 29910A47AD509BC7
x-amz-id-2: HW4WAOU2aWjybTbjor+8Szuk6sj063AdEL+U4Y6myuYsAkZdlZQAh0OnsvnxbLlSz5vdfDyoX3s=
last-modified: Sun, 08 Oct 2017 14:14:09 GMT
server: cloudflare
etag: "821f99fa753b6f0a5b5d9bc193f951c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 0d99ubutmJsiUCJ3TFNn3OCu6ugOlULO
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
cf-ray: 55800d224badd6e1-FRA
x-amz-cf-id: p3Hjug9VUoylqVC2NKr5rlukZIYI27vE1r9yW5v5zUkGV-sZ5XOUAw==
cf-bgj: imgq:85

GET
H2 200 shutterstock_2354342501-1000x391.jpg
www.cybereason.com/hubfs/Blog%20Feature%20Images/ 83 KB
84 KB 27ms
27ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Blog%20Feature%20Images/shutterstock_2354342501-1000x391.jpg
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 036289144185974d4f0da03dec24a03be3d024bf76c2b05ddf9bff98c3336e71

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-5364597155,P-3354902,FLS-ALL
age: 87691
cf-polished: qual=85, origFmt=jpeg, origSize=101692
edge-cache-tag: F-5364597155,P-3354902,FLS-ALL
status: 200
content-length: 85488
content-disposition: inline; filename="shutterstock_2354342501-1000x391.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: CADE9F2B88964333
x-amz-id-2: FTtOMb/uMHCp3UVPQAU8xDrC0JYrwgO2rkYMz64AZfG5CPZtXJ4LKMoKx8jPcHg3vvvEjDYElRM=
x-cache: Miss from cloudfront
last-modified: Sun, 08 Oct 2017 14:14:41 GMT
server: cloudflare
etag: "a6c85cd9eac31540b551bfe24b5183ad"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 1.Lk7fHNPHKiopilze36Hs_8YeTRi_1m
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
cf-ray: 55800d224bb0d6e1-FRA
x-amz-cf-id: pKzOBvcOl40r3NTjf5I_fKSQYOmkxIiKSiz3TptFGxsNush5jU3R_A==
cf-bgj: imgq:85

GET
H2 200 Grain_Tile_Dark.png
www.cybereason.com/hubfs/ 7 KB
7 KB 20ms
20ms Image
image/webp 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cybereason.com/hubfs/Grain_Tile_Dark.png
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4f000998ffedd1b881ece5a8926dc23c48d61f74dc34442868abecdfa6f1448

Request headers

Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-16974973067,P-3354902,FLS-ALL
age: 1450
cf-polished: origFmt=png, origSize=16003
edge-cache-tag: F-16974973067,P-3354902,FLS-ALL
status: 200
content-length: 7036
content-disposition: inline; filename="Grain_Tile_Dark.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: E0AF3608D34B2FF5
x-amz-id-2: Bu6Pne31QmoiHB2Q7uRdmI5eta3vAClTC3+Vh+XEeLxXq0U4AeseboB4BvaK0JNKQgEGc404e4I=
x-cache: Miss from cloudfront
last-modified: Thu, 03 Oct 2019 17:36:35 GMT
server: cloudflare
etag: "c5ee0107e11d9d838d662a8261425170"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: 269IDt1Xei8U_OkLKHjLzS4X79AtA3SH
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 55800d224bb2d6e1-FRA
x-amz-cf-id: 7zCdM5SAWJmkiE_QSSuzV2wOpPXNzorItVgMQmmFq_sMob88ZWp6og==
cf-bgj: imgq:85

GET
H2 200 l
use.typekit.net/af/f2e356/00000000000000003b9b0ef5/27/ 35 KB
35 KB 26ms
26ms Font
application/font-woff2 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/f2e356/00000000000000003b9b0ef5/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 9af256cb88b39b1a3b6e36b50a7d7f3215db54331371bb53ed698450672ddcc8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
server: nginx
access-control-allow-origin: *
etag: "a0f0ee5943ccfb765480534c9add4201dba5a006"
content-type: application/font-woff2
status: 200
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 35932

GET
H2 200 cybereason-arrow.woff2
www.cybereason.com/hubfs/Fonts/ 2 KB
3 KB 21ms
20ms Font
application/font-woff2 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/hubfs/Fonts/cybereason-arrow.woff2
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcaf54bc46707931d5bcfd93e5b1ac50a518dabb1748fb5155353b392f11c2f8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
via: 1.1 8e04f5d6c745b231c10fce7c2aa9c70f.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-20974772751,FD-5167100825,P-3354902,FLS-ALL
age: 655
edge-cache-tag: F-20974772751,FD-5167100825,P-3354902,FLS-ALL
status: 200
content-length: 2200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 52
x-amz-request-id: 7AA65B772FFDB9FB
x-amz-id-2: oRrsvZtc+qntzAnupOeXWbSyaEJBo0wWMORVoXqoLNRceNlaTWSicQJISIA6hWpRZ1hMuniiTzI=
last-modified: Tue, 12 Nov 2019 18:05:03 GMT
server: cloudflare
etag: "28fb154fbabe25f37ef8bd98ec057a51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: nxxFbRZiJ0l5.6jBTiMaZGgmevb8x6Rg
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
cf-ray: 55800d224bb5d6e1-FRA
x-amz-cf-id: ejYCVDdKCsgWR6scMPzU5-_k31LolU8cLNc9YVoHTmy6D8w_UWILUg==

GET
H2 200 -F6qfjptAgt5VM-kVkqdyU8n3twJwlBFhw.ttf
fonts.gstatic.com/s/ibmplexmono/v5/ 37 KB
18 KB 7ms
7ms Font
font/ttf 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexmono/v5/-F6qfjptAgt5VM-kVkqdyU8n3twJwlBFhw.ttf

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b66955d2f6a8fab43675c6a02f74f5d3914d07121b12396bc9308dbb00d78fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/hs-fs/hub/3354902/hub_generated/template_assets/1579204508621/combined-css-d9c2c2ab97758c30ce49211db9ad00bc.css
Origin: https://www.cybereason.com

Response headers

date: Wed, 08 Jan 2020 20:29:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 997478
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18509
x-xss-protection: 0
last-modified: Tue, 16 Jul 2019 03:39:51 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Jan 2021 20:29:34 GMT

GET
H2 200 p.gif
p.typekit.net/ 35 B
201 B 26ms
25ms Image
image/gif 95.100.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=vyv2ljd&ht=tk&h=www.cybereason.com&f=32224.32226.32227.32228.32230.32231.10875.32265&a=657783&js=1.19.2&app=typekit&e=js&_=1579512852890
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.67.47 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-67-47.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
last-modified: Thu, 07 Feb 2019 19:30:27 GMT
server: nginx
access-control-allow-origin: *
etag: "5c5c8753-23"
content-type: image/gif
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 35
expires: Fri, 16 Aug 2019 08:20:58 GMT

GET
H2 200 0caba5f8-036c-4fa7-83d6-166a0180e075 Show response
www.cybereason.com/_hcms/forms/embed/v3/form/3354902/ 19 KB
4 KB 144ms
144ms Script
application/javascript 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cybereason.com/_hcms/forms/embed/v3/form/3354902/0caba5f8-036c-4fa7-83d6-166a0180e075?callback=hs_reqwest_0&hutk=

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1083136679b1a0fcc48f504f17b2986fceed9bef2bec55ed8ebb01adae9bca0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
server: cloudflare
x-trace: 2B33F2E6339BDD4338FF31F3CC38FDE15BCB50610D000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
content-disposition: attachment; filename=no-rfd.txt
cf-ray: 55800d22cd28d6e1-FRA

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cc0f8400d713f4d28b248d08bc390c68d5c03c139973b539dc1bc78ea005b70b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: gh9LI/bU0RFmYraCZKpAKQ==
status: 200
date: Mon, 20 Jan 2020 09:34:12 GMT, Mon, 20 Jan 2020 09:34:12 GMT
expires: Mon, 20 Jan 2020 09:34:17 GMT
alt-svc: h3-24=":443"; ma=3600
content-length: 1779
x-fb-debug: aGZBoXwEYlX0GMC5x1MfhxHlJG6DNNMuuqfFOwKSQwbzYIh/NM8TvsF+9t2ztbmS1O9CZWtOT0wBRDfVCghP0g==
x-fb-trip-id: 1850256238
x-fb-content-md5: 44650727a9b8968fa5f4ba3bb0690cf8
etag: "5501e72414411bafaf6397614c2eb3b9"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 widgets.js Show response
platform.twitter.com/ 95 KB
28 KB 22ms
22ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4dced00354b099d831f860145bbd0149f99889d4c45632e4d9e849f008123866

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:12 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 28838
x-served-by: cache-iad2147-IAD, cache-fra19128-FRA
last-modified: Thu, 09 Jan 2020 22:50:12 GMT
etag: "09356930f7674f04e767f5b1203faeb7+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 /
www.google.com/pagead/1p-user-list/934771702/ 42 B
122 B 18ms
18ms Image
image/gif 2a00:1450:4001:81b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/934771702/?random=1579512852641&cv=9&fst=1579510800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&tiba=Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware&fmt=3&is_vtc=1&random=3622348681&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/934771702/ 42 B
110 B 21ms
21ms Image
image/gif 2001:4860:4802:32::75
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/934771702/?random=1579512852641&cv=9&fst=1579510800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&tiba=Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware&fmt=3&is_vtc=1&random=3622348681&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::75 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 116645602292181 Show response
connect.facebook.net/signals/config/ 447 KB
113 KB 56ms
56ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/116645602292181?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2d0b8b695591b12e644193cb057434de9bf6671ccaadd3626a2052dc967cb558

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: yo/x5pYztg+cRIJ/N0FUSaAIzdimT8H6pAfaSaMmXRK12VvC6O0Rhux1x1wEgednyH7qTvwt4n2T5ruBfwBdZg==
x-fb-trip-id: 1850256238
date: Mon, 20 Jan 2020 09:34:13 GMT, Mon, 20 Jan 2020 09:34:13 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sm.22.html
static.addtoany.com/menu/ Frame C0F1 0
0 11ms
11ms Document
text/html 2606:4700:10::6814:6e27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.22.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:6e27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: static.addtoany.com
:scheme: https
:path: /menu/sm.22.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Response headers

status: 200
date: Mon, 20 Jan 2020 09:34:13 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d998faf27ead946137f4ed05aab63d4301579512852; expires=Wed, 19-Feb-20 09:34:12 GMT; path=/; domain=.addtoany.com; HttpOnly; SameSite=Lax; Secure
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
last-modified: Thu, 03 Oct 2019 06:59:00 GMT
etag: W/"70f-593fc1ec1791b"
cache-control: max-age=315360000, immutable
vary: Accept-Encoding
via: e5s
cf-cache-status: HIT
age: 284106
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 55800d233ef363e3-FRA
content-encoding: br

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 modules.4fbc6fa978838a77e880.js Show response
script.hotjar.com/ 400 KB
70 KB 311ms
18ms Script
application/javascript 147.75.102.203
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.4fbc6fa978838a77e880.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.203 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress3
Software: /
Resource Hash: 755ae062fc4da1ccb582f2d2e153deaea69a05c1e5dd2b63b0e797b855608d86

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
content-encoding: br
content-type: application/javascript
age: 420558
status: 200
section-io-cache: Hit
content-length: 71279
last-modified: Wed, 15 Jan 2020 12:41:59 GMT
etag: "5992c1cb7b334dbab6fc9ed168473e45"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.025
accept-ranges: bytes
section-io-id: a54587fb3d457a012ade0e1529611df0

GET
H/1.1 200
OK pixel
tr.outbrain.com/ 43 B
333 B 1643ms
91ms Image
image/gif 70.42.32.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.outbrain.com/pixel?marketerId=0027b8e5e3241bf8cc1be75fc37da5a0b4&obApiVersion=1.1&obtpVersion=1.1.8&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&optOut=false&bust=02331385346342203

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:14 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: image/gif;
Cache-Control: no-cache
Connection: close
X-TraceId: 143aa780d4c25609060bf31d3456173b
Content-Length: 60

GET
H/1.1 200
OK pixel
amplifypixel.outbrain.com/ 43 B
314 B 1400ms
95ms Image
image/gif 64.202.112.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://amplifypixel.outbrain.com/pixel?mid=0027b8e5e3241bf8cc1be75fc37da5a0b4&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&bust=0055941844488149206

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

64.202.112.63 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:14 GMT
Cache-Control: no-cache
X-TraceId: 3b6c41d04a4e4fce3cada3622b9a057f
content-encoding: gzip
Content-Length: 60
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: image/gif;

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 377 KB
61 KB 222ms
207ms Script
application/javascript 2606:4700::6811:e6cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:e6cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c5a31a53e3e123afe01e4dec98dde98f51de7de015c7da73e584eb715cfa78f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
via: 1.1 d19e64e406af1f88f7f96d9dcb2393ca.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: IAD89-C2
x-cache: Hit from cloudfront
status: 200
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Tue, 07 Jan 2020 02:49:41 GMT
server: cloudflare
etag: W/"e452f9072a07de0a5d1e02dc8e285dcb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: QLO51.v0Ug9OhPrmu9foVzlV6j2GTDS9
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 55800d23abbcdff3-FRA
x-amz-cf-id: hPJVxiLFP5dn-HMlr5Th4qn30aBoOTkJvCNhU-EnjmHFKxHy1UlTMg==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 4 KB
2 KB 26ms
10ms Script
application/javascript 2606:4700::6811:70b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:70b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d998e1c989da89276b479d0ab823fb7090fa39e25fdc4856c9034e8af92caa0c

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
via: 1.1 bc60bbe1d8a8b7017a4f9b63ff273dec.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 2
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: gzip
x-amz-version-id: o3e7t_ng9I6UO2yJ9PBoEsHFkU9lFHC8
last-modified: Mon, 13 Jan 2020 04:57:54 GMT
server: cloudflare
etag: W/"5df15688eed67be6535dfec7cf8fe9e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=600
x-amz-cf-pop: IAD89-C2
cf-ray: 55800d23acb2dfd3-FRA
x-amz-cf-id: TSbwE2RAn_kNRbR4va-2fnaib6yXUWyRvV36oqe6zsEBWtBPv1RCzg==

GET
H2 200 3354902.js Show response
js.hs-analytics.net/analytics/1579510800000/ 75 KB
25 KB 654ms
654ms Script
text/javascript 2606:4700::6811:43b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1579510800000/3354902.js
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/hs/scriptloader/3354902.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:43b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99c81656d35fe0430d483bd3401206654ac4b6c8dfe7c4e230bce50dd0e8a98b

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: A1B9135D28BA64B5
status: 200
content-type: text/javascript
x-amz-id-2: 5j6B9vP5XT95A8mYTrk91SnScLXvn60FmT2pQbCKrhzD4TTaS43/jftOo0OzHjK0E4k0ZFj+PEI=
last-modified: Thu, 02 Jan 2020 14:47:50 GMT
server: cloudflare
etag: W/"65c5f458915f5e3f69d6cd40b4c7ee2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 55800d239c1e9748-FRA
expires: Mon, 20 Jan 2020 09:39:13 GMT

GET
H2 200 icons.29.svg.js Show response
static.addtoany.com/menu/svg/ 78 KB
33 KB 18ms
18ms Script
application/javascript 2606:4700:10::6814:6e27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons.29.svg.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:6e27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
via: e5s
x-content-type-options: nosniff
cf-cache-status: HIT
age: 15471989
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
last-modified: Mon, 31 Dec 2018 23:29:11 GMT
server: cloudflare
etag: W/"13937-57e59c7b88bd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000, immutable
cf-ray: 55800d23af6e63e3-FRA
cf-bgj: minify

GET
H/1.1

200
OK

tagjs Show response
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/tagjs?a_id=71641&source=js_tag
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=71641&source=js_tag

107 B
436 B

38ms
38ms

Script
text/javascript

34.252.172.232
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=71641&source=js_tag
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.172.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-172-232.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 793fc397fef7e49522e43e020655cf3647b690848c0a2da1669912083a7f1680

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 107
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Location: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=71641&source=js_tag
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 all.js Show response
connect.facebook.net/en_GB/ 190 KB
57 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/all.js?hash=dc37d454f2497ee5f693bdbd4194dc99&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b7ee4066f357a2608fda7f55106299bd585f26efdf78256360ae45fb085454ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Origin: https://www.cybereason.com

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: ZtxfWRAmtJOAeU3OGOEXaw==
status: 200
date: Mon, 20 Jan 2020 09:34:13 GMT, Mon, 20 Jan 2020 09:34:13 GMT
expires: Tue, 19 Jan 2021 07:54:13 GMT
alt-svc: h3-24=":443"; ma=3600
content-length: 57710
x-fb-debug: CEw49j2Nb83I2rAz2xSS8tIPfGayrGSLMSKekZOY3MesS09sXAbtyp74t0xSYBnzL2PlTjucVfxtoFXGnC2YUQ==
x-fb-trip-id: 1850256238
x-fb-content-md5: 599b6b931192c32047929557c738c5d4
etag: "adc2da659bd8e61185604e98c5f7f3ca"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 widget_iframe.4f8aea4342a4ada72cba2bdffcff6b4d.html
platform.twitter.com/widgets/ Frame B3DE 0
0 23ms
22ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.4f8aea4342a4ada72cba2bdffcff6b4d.html?origin=https%3A%2F%2Fwww.cybereason.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/widget_iframe.4f8aea4342a4ada72cba2bdffcff6b4d.html?origin=https%3A%2F%2Fwww.cybereason.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Response headers

status: 200
last-modified: Thu, 09 Jan 2020 22:38:16 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "4b563298f37eb3ef2a2f8897be83c714+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Mon, 20 Jan 2020 09:34:13 GMT
x-served-by: cache-iad2141-IAD, cache-fra19128-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 5825

GET
H2 200 box-b736908ce6b0e933fad3a2e45df61b38.html
vars.hotjar.com/ Frame 8799 0
0 1076ms
24ms Document
text/html 147.75.102.231
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-b736908ce6b0e933fad3a2e45df61b38.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-704918.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.231 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress10
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-b736908ce6b0e933fad3a2e45df61b38.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Response headers

status: 200
date: Mon, 20 Jan 2020 09:34:14 GMT
content-type: text/html
content-length: 808
last-modified: Tue, 07 Jan 2020 11:16:39 GMT
etag: "ed7551919779fd07dbfe6d776c643379"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.026
age: 1079223
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 6e4450c39640feafd613e195a5782d7b

GET
H2 200 /
www.facebook.com/tr/ 44 B
260 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=116645602292181&ev=PageView&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&rl=&if=false&ts=1579512853157&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1579512853156.714414668&it=1579512852980&coo=false&rqm=GET

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT, Mon, 20 Jan 2020 09:34:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Mon, 20 Jan 2020 09:34:13 GMT

GET
H2 200 xd_arbiter.php
staticxx.facebook.com/connect/ Frame F5C4 0
0 7ms
6ms Document
text/html 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://staticxx.facebook.com/connect/xd_arbiter.php?version=45

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/all.js?hash=dc37d454f2497ee5f693bdbd4194dc99&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: staticxx.facebook.com
:scheme: https
:path: /connect/xd_arbiter.php?version=45
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
accept-encoding: gzip, deflate, br
cookie: fr=0kBbdFR6sLhGMRvyY..BeJXQV...1.0.BeJXQV.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Response headers

status: 200
content-encoding: br
content-type: text/html; charset=utf-8
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expires: Sat, 16 Jan 2021 18:01:42 GMT
cache-control: public,max-age=31536000,immutable
x-fb-debug: 0oFKLtkd+ivaMECukJtu9RDR0V7TAZSBVBu6Yo0DCcqceKxipKpEFyoS7OQ/8/b6IaqeMVJQu2U0Cmz0YzBumA==
content-length: 12406
x-fb-trip-id: 1850256238
date: Mon, 20 Jan 2020 09:34:13 GMT Mon, 20 Jan 2020 09:34:13 GMT
alt-svc: h3-24=":443"; ma=3600

GET
H2

200

adsct
analytics.twitter.com/i/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=twtr
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_ZdpGhadUKyMM8g0qB

43 B
290 B

133ms
133ms

Image
image/gif

104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_ZdpGhadUKyMM8g0qB

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Mon, 20 Jan 2020 09:34:13 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 87cf0312e6acae89e3fed8b53d0dd83d
x-transaction: 0020f0be003bedf5
expires: Tue, 31 Mar 1981 05:00:00 GMT

Redirect headers

Location: https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_ZdpGhadUKyMM8g0qB
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=yah
https://ads.yahoo.com/cms/v1?nwid=10001073209&eid=pa_ZdpGhadUKyMM8g0qB&sigv=1&esig=2~4bc91d398b8b8112480a49dfe2981141f4b9d6e9
https://pixel.prfct.co/cb?partnerId=yah&xid=E0&eid=pa_ZdpGhadUKyMM8g0qB

43 B
460 B

421ms
102ms

Image
image/gif

52.71.210.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.prfct.co/cb?partnerId=yah&xid=E0&eid=pa_ZdpGhadUKyMM8g0qB
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.210.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-210-204.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Date: Mon, 20 Jan 2020 09:34:13 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
P3P: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Location: https://pixel.prfct.co/cb?partnerId=yah&xid=E0&eid=pa_ZdpGhadUKyMM8g0qB
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=opx
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_ZdpGhadUKyMM8g0qB
https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_ZdpGhadUKyMM8g0qB

43 B
183 B

25ms
24ms

Image
image/gif

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_ZdpGhadUKyMM8g0qB
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.174.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:13 GMT
via: 1.1 google
server: OXGW/16.174.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 20 Jan 2020 09:34:13 GMT
via: 1.1 google
server: OXGW/16.174.0
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_ZdpGhadUKyMM8g0qB
p3p: CP="CUR ADM OUR NOR STA NID"
status: 302
alt-svc: clear
content-length: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=rbcn
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_ZdpGhadUKyMM8g0qB

0
239 B

364ms
30ms

Image
image/gif

69.173.144.136
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_ZdpGhadUKyMM8g0qB
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.136 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: image/gif
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_ZdpGhadUKyMM8g0qB
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=goo
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfWmRwR2hhZFVLeU1NOGcwcUI
https://pixel-geo.prfct.co/cb?partnerId=goo

43 B
365 B

36ms
36ms

Image
image/gif

34.252.172.232
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.172.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-172-232.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:13 GMT
server: HTTP server (unknown)
location: https://pixel-geo.prfct.co/cb?partnerId=goo
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 240
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
pixel-geo.prfct.co/seg/ 43 B
365 B 424ms
350ms Image
image/gif 34.252.172.232
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/seg/?add=8257847&source=js_tag&a_id=71641
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.172.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-172-232.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?t=2&add=8257847
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D8257847

43 B
1 KB

19ms
18ms

Image
image/gif

185.33.223.206
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D8257847

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.206 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

301.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 20 Jan 2020 09:34:16 GMT
AN-X-Request-Uuid: 4ff2a312-6914-4c56-91ad-1e9d7dbddb6f
Content-Type: image/gif
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.210.217.115; 185.210.217.115; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.13:80
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 20 Jan 2020 09:34:16 GMT
AN-X-Request-Uuid: 15f9c318-023c-442a-b69c-26d81013913f
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
Location: https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D8257847
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.210.217.115; 185.210.217.115; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.56:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

tracking.png
tracking.leadlander.com/
Redirect Chain

https://tracking.leadlander.com/api/tracking?accountId=27717&page=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&referer=...
https://tracking.leadlander.com/tracking.png

68 B
347 B

109ms
109ms

Image
image/png

54.156.185.237
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tracking.leadlander.com/tracking.png

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.156.185.237 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-156-185-237.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:13 GMT
Last-Modified: Wed, 26 Sep 2018 16:48:51 GMT
Server: Kestrel
ETag: "1d455b8cd761bc4"
Strict-Transport-Security: max-age=2592000
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Location: /tracking.png
Date: Mon, 20 Jan 2020 09:34:13 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=2592000

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=116645602292181&ev=Microdata&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&rl=&if=false&ts=1579512853660&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware%22%2C%22meta%3Adescription%22%3A%22Cybereason%20Nocturnus%20detected%20a%20series%20of%20targeted%20attacks%20against%20high-profile%20targets%20that%20uses%20a%20new%20variant%20of%20Anchor_DNS%20and%20a%20new%20malware%20dubbed%20Anchor.%22%7D&cd[OpenGraph]=%7B%22og%3Adescription%22%3A%22Cybereason%20Nocturnus%20detected%20a%20series%20of%20targeted%20attacks%20against%20high-profile%20targets%20that%20uses%20a%20new%20variant%20of%20Anchor_DNS%20and%20a%20new%20malware%20dubbed%20Anchor.%22%2C%22og%3Atitle%22%3A%22Dropping%20Anchor%3A%20From%20a%20TrickBot%20Infection%20to%20the%20Discovery%20of%20the%20Anchor%20Malware%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fhubfs%2Fmilan-degraeve-0ztvUdH5b-A-unsplash.jpg%23keepProtocol%22%2C%22og%3Aimage%3Aalt%22%3A%22milan-degraeve-0ztvUdH5b-A-unsplash%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware%22%2C%22og%3Atype%22%3A%22article%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.15&r=stable&ec=1&o=30&fbp=fb.1.1579512853156.714414668&it=1579512852980&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:13 GMT, Mon, 20 Jan 2020 09:34:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Mon, 20 Jan 2020 09:34:13 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6959
date: Mon, 20 Jan 2020 07:38:15 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 20 Jan 2020 09:38:15 GMT

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/ 23 B
595 B 131ms
112ms XHR
application/json 2606:4700::6811:cccc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/json?portalId=3354902

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f621a831fe6b7b75cd96e10eb4c80311fff6a3948e4905d12a22032d5ec59b48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:14 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 23
server: cloudflare
x-trace: 2BD52823984E0A4F8A217F7BD40920A3C15908FAA2000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybereason.com
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 55800d2e2f0f643d-FRA
access-control-allow-headers: *

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
104 B 37ms
37ms Image
image/gif 2606:4700::6810:f905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=0caba5f8-036c-4fa7-83d6-166a0180e075&fci=70c1b854-372c-41da-a67f-5974b4f0ea1b&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=643011938&v=1.1&a=3354902&pi=23309573296&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&cpi=23309573296&cgi=5272851739&lpi=23309573296&lvi=23309573296&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&t=Dropping+Anchor%3A+From+a+TrickBot+Infection+to+the+Discovery+of+the+Anchor+Malware&cts=1579512854727&vi=b53989b210b195d94e1f32fe7251fb73&nc=true&u=85683782.b53989b210b195d94e1f32fe7251fb73.1579512854724.1579512854724.1579512854724.1&b=85683782.1.1579512854724&pt=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 55800d2e1e6bc2e5-FRA
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
232 B 25ms
25ms Image
image/gif 2606:4700::6810:f905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=643011938&v=1.1&a=3354902&pi=23309573296&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&cpi=23309573296&cgi=5272851739&lpi=23309573296&lvi=23309573296&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&t=Dropping+Anchor%3A+From+a+TrickBot+Infection+to+the+Discovery+of+the+Anchor+Malware&cts=1579512854728&vi=b53989b210b195d94e1f32fe7251fb73&nc=true&u=85683782.b53989b210b195d94e1f32fe7251fb73.1579512854724.1579512854724.1579512854724.1&b=85683782.1.1579512854724&pt=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 55800d2e1e6ec2e5-FRA
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=222922141&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anch...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_gid=1494979472.1579512855&gjid=444400933&_v=j79&z=1821922106
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106&slf_rd=1&random=2226808947

42 B
109 B

18ms
17ms

Image
image/gif

2001:4860:4802:32::75
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106&slf_rd=1&random=2226808947

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::75 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:14 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 20 Jan 2020 09:34:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-56367941-1&cid=448807619.1579512855&jid=93536958&_v=j79&z=1821922106&slf_rd=1&random=2226808947
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
1 KB 120ms
119ms XHR
application/json 2606:4700::6810:f905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=3354902&utk=b53989b210b195d94e1f32fe7251fb73&__hstc=85683782.b53989b210b195d94e1f32fe7251fb73.1579512854724.1579512854724.1579512854724.1&__hssc=85683782.1.1579512854724&contentId=23309573296&currentUrl=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d11fbe2073d34155218d7a70eead316ab8ee6d6c526656c27b26a23deda67609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Origin: https://www.cybereason.com

Response headers

date: Mon, 20 Jan 2020 09:34:14 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-ray: 55800d2e3c46dfbb-FRA
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.cybereason.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 22ms
10ms Script
application/x-javascript 2a02:26f0:eb:3b4::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:eb:3b4::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Mon, 20 Jan 2020 09:34:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=55074
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
104 B 31ms
31ms Image
image/gif 2606:4700::6810:f905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=a325ca4c-77be-436f-b080-20ec8bd3654a&lfi=152417&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=643011938&v=1.1&a=3354902&pi=23309573296&ct=blog-post&ccu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&cpi=23309573296&cgi=5272851739&lpi=23309573296&lvi=23309573296&lvc=en&pu=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&t=Dropping+Anchor%3A+From+a+TrickBot+Infection+to+the+Discovery+of+the+Anchor+Malware&cts=1579512854874&vi=b53989b210b195d94e1f32fe7251fb73&nc=true&u=85683782.b53989b210b195d94e1f32fe7251fb73.1579512854724.1579512854724.1579512854724.1&b=85683782.1.1579512854724&pt=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 55800d2ef9a1c2e5-FRA
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D994281%26url%3Dhttps%253A%252F%252Fwww.cybereason.com%252Fblog%252Fdropping-ancho...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512...

0
57 B

165ms
165ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512854882&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Mon, 20 Jan 2020 09:34:15 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: c940wpKO6xVgGGmZkSsAAA==

Redirect headers

date: Mon, 20 Jan 2020 09:34:15 GMT
x-content-type-options: nosniff
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-li-uuid: WVxPuJKO6xUQfSZanCsAAA==
server: Play
pragma: no-cache
x-li-pop: prod-tln1
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=994281&url=https%3A%2F%2Fwww.cybereason.com%2Fblog%2Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware&time=1579512854882&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 perf Show response
www.cybereason.com/_hcms/ 2 B
379 B 135ms
135ms XHR
text/plain 2606:4700::6811:84b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cybereason.com/_hcms/perf
Requested by: Host: www.cybereason.com
URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:84b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
Origin: https://www.cybereason.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-type: application/json

Response headers

cf-ray: 55800d409b0ad6e1-FRA
date: Mon, 20 Jan 2020 09:34:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-trace: 2B5CE3F87032AA17DFF1D98D37456D1288C1A3929B000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
content-length: 2

Verdicts & Comments Add Verdict or Comment

143 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.twitter.com/	1970-01-20 00:16:24	Name: personalization_id Value: "v1_VkezAOFE1V4OKcn9UF8XzQ=="
.addtoany.com/	1970-01-19 06:46:39	Name: uvc Value: 1
.cybereason.com/	1970-01-19 06:45:14	Name: __hssc Value: 85683782.1.1579512854724
.cybereason.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.facebook.com/	1970-01-19 08:54:48	Name: fr Value: 0kBbdFR6sLhGMRvyY..BeJXQV...1.0.BeJXQV.
.cybereason.com/	1970-01-19 16:06:48	Name: hubspotutk Value: b53989b210b195d94e1f32fe7251fb73
.cybereason.com/	1970-01-19 15:17:51	Name: _hjid Value: 220cf41a-abe6-4434-bf5f-55d493cedffa
.cybereason.com/	1970-01-19 08:54:48	Name: _fbp Value: fb.1.1579512853156.714414668
.cybereason.com/	1970-01-19 16:06:48	Name: __hstc Value: 85683782.b53989b210b195d94e1f32fe7251fb73.1579512854724.1579512854724.1579512854724.1
.www.cybereason.com/	1969-12-31 23:59:59	Name: __cfruid Value: faa9beffb2d6ffe680c170c4082047a1eb8c9bc6-1579512852
.www.cybereason.com/	1970-01-19 07:28:24	Name: __cfduid Value: d6399e7c976956411ca486bedb200efc11579512852

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware(Line 161) Message: Read time success

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.yahoo.com
amplify.outbrain.com
amplifypixel.outbrain.com
analytics.twitter.com
api.hubapi.com
cdn.rawgit.com
cdn2.hubspot.net
cdnjs.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
fonts.gstatic.com
forms.hubspot.com
googleads.g.doubleclick.net
js.hs-analytics.net
js.hsadspixel.net
js.hsleadflows.net
meetings.cybereason.com
p.typekit.net
pixel-geo.prfct.co
pixel.prfct.co
pixel.rubiconproject.com
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.addtoany.com
static.hotjar.com
staticxx.facebook.com
stats.g.doubleclick.net
t.sf14g.com
tag.marinsm.com
tr.outbrain.com
track.hubspot.com
tracking.leadlander.com
us-u.openx.net
use.typekit.net
vars.hotjar.com
www.cybereason.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.linkedin.com
104.244.42.195
147.75.102.135
147.75.102.203
147.75.102.231
151.101.112.65
151.101.12.157
151.139.237.11
172.217.22.66
185.33.223.206
2001:4860:4802:32::75
23.210.250.44
2606:2800:133:7403:4a68:7eff:710b:1ddf
2606:4700:10::6814:6e27
2606:4700::6810:f905
2606:4700::6811:4004
2606:4700::6811:4104
2606:4700::6811:43b0
2606:4700::6811:70b0
2606:4700::6811:84b4
2606:4700::6811:cccc
2606:4700::6811:e6cc
2606:4700::6811:f3cc
2a00:1288:110:c305::a000
2a00:1450:4001:800::2002
2a00:1450:4001:81a::200e
2a00:1450:4001:81b::2004
2a00:1450:4001:81d::2003
2a00:1450:400c:c06::9c
2a02:26f0:eb:3b4::25ea
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
34.192.123.20
34.227.123.4
34.252.172.232
34.95.120.147
52.71.210.204
54.156.185.237
64.202.112.63
69.173.144.136
70.42.32.127
95.100.67.47
0005cf2627e9e54179f90c78bbf355fccafb3907c4ae9e699bc09c4a57d75bf6
008a6b447b38fe87dac9127b3e47c83f89df61e8ac7285a7e86051ee89e99af9
036289144185974d4f0da03dec24a03be3d024bf76c2b05ddf9bff98c3336e71
07a58803f40da69055153491ec078aba127d5b185dd7ddcae8edde6a9b06aea3
0a14dbbe7e5a2fea61d3eb0edcbc959c9df66f8ab1322051606283f281aacfcd
0c01181de5b62daa4b0f6ba48c8d910037c20c82aa1b04f4b025974f3e12bc2b
0d069db2940a36440e37c77efc2c69e24025be3a6d23576d854906d04c7a3269
0d111c83d2520fd8d1ec059493162072af6e97b725aa4b56eb846f09a01f8e9c
0e8fe397d798b2a4e99332da31b0aad26c806ab97337a6775c756b909553a4f0
1083136679b1a0fcc48f504f17b2986fceed9bef2bec55ed8ebb01adae9bca0c
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10dd0a271e034a534e86710ff450a05f9426e5cbef84d8c8d353e9fec7988b57
1210d043e764980a84cb736945173829ccb1ff4f2161dc47cf9314799edcaf44
128cfa4458d1c804e935930664e96ff59b16139513d6492b6ee031916862246e
132c8e6ec790b8c46b76b90e6e09f8d30af5aba933948ad2718ac04523eef007
147498d5be9d1aeb765c07a2789d7379a690cbcd52abcc1cacdd0203bd8e009b
14a69475fe017279fb90a9b3b4baf21d46e28e9fe61fec7fad2cf15d548bd02f
14b7f23c8d20b84191aefe2d24804938cdad99ad72b85002ab70b0982a613f70
14f5cf42c16a91c63325e3477ac1c4e41190bd8778aef6434d969ade5e308f50
154991194443aaeb774be577ea462c94fb6375d3926af0e00b6896581000a593
16734c168bc0ee32e687e91926c323112816f3368bea70a4dd726fb138406176
173db45379b49d9271f8638f9f80936b5e74671a2bbb8376e394090ae9db931e
173e887c2a8c9a8df7ce1ff784e1dffe6089239df9c82207c36a352454404ea5
18e336799cfccfdcd3ddb264f6da771dc96e4eec223175223674429d993433a3
199ac0e3e15d54d99f9828c28d4f32b6919595926c5dee07e8bcb10215382cc5
1a6e3510af52bd4c550e719eef6ae49cfd1ff4be530c8240b4c8233a2860747d
1aa1914bca9b17240b963ee00f3b71443af47b02e48acd879cbda2b56170a509
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1f0871f9beca255fae7cb220883a4afea87e056f7ec0be457ac571cc37b8f0ed
22dc09757e49b150433d84255dcacb04dff7e6976eb88d194a53c6792183bfb5
2432844517e2dd99a05c54b57aac9aac78553489b6111ace7c3d97b826af19ec
2832d2ff340e31dfb8300ecaf6967737af72f2c8981c895443abc7c6eaeb6993
290413fe1d21f4efc20f033f39acc3161043941087be7058a9412b9b4ef3630d
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b5c439fe05b516d689a934de8d30fb45ca72d056b509ad6a375c956a8e4daac
2c5a31a53e3e123afe01e4dec98dde98f51de7de015c7da73e584eb715cfa78f
2c93e7d4fb10f32f63025c49b09a6d2c90c53bc4773a2472fd0e523707e4acaa
2cbf6e27293c523afe11d21dad446397ed4ad9c7da2a537cdd986ff3b1b4cbef
2d0b8b695591b12e644193cb057434de9bf6671ccaadd3626a2052dc967cb558
2e96bf761583273e370136ed0b934a38ad1e08b386accb37277252b37b9c9961
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
312c7a4e3e547301e162c0bf3a7788cf8d52caf2668fbafc01351c9185b97ce4
33ae66f4883ae8da4084a5196a48b3e313f21cf33abae20e3274ef2ea824bd4e
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
33e5e9998115684c5bc0230530df912330f32a8e777405a6536a37dca9e6741f
359197d1e7ab63fe678db88914f31f1f9f6a37bd182e0de565fc7a68302a1f50
365a7ca6f52df29efedfdac2e08a9d0f03e4e2122dd9a49803bf8dacd58480fc
36f7203c0c832c5e36c66e09bf20eeb89430e9cc9078c97b38f8407d6c820f9e
3b0bdc83018935bbfed6f9249ac89616f20e5ea427ab41f0c147be054837e535
3b0eef96a783ea9affa188920d63f858a9b11260d5c07de0b9efaaa4c52f1b5c
3cc0c0e98b47965020aefcb3c7331f8196e1da5bef9a129eb7b79d9679758313
3fc1bd4c0666cad8d8af42cf8f26c59bc5535b3d907b4db560c7db627e1e5253
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
428112df40e37a63922a1c8ecb4d83a8ff61560769719c99970c24feed583920
440c629e1bacb85303803b6ef57dfe9afa276b67e66241914530d1c3f3077827
44b1812a8c754f7577ea423bd42fd646ae1515b8a935cd2520671c50c8675ac7
496f753f7e96c1427cf6e11d9c5f822a5f1f46b3c54b7429df9a195fa8362884
4b293e4c10e7df359f78a8c4f0b5106f2bfa3d8b6de7e43441724849c3734d38
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4dced00354b099d831f860145bbd0149f99889d4c45632e4d9e849f008123866
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
51d484ea340d3443bf875889a10126272a6f1bc5d0b3817e45897db189a0a14b
560001e399c4a3bce56f94544e12b4831c295b5d1ea0e5d419c137856f50135d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57f22a27d44bbaf200c76b1f4a768df1279e316042515f58ed05b8649167004f
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5ebbf16975e8957d1e3b765a49226e95711b30af5852c253906c2f171325949b
61a205756a8354d8a86f36ac8f9a7fb364b8ed1d0ffaaac8be56d04ec90afa6b
62e1ec48f41ce0da6c56c81e660db7174584762d2797faebc5bdd8b50b95f690
6561b2dd1e1b0f9b2f678dfd01a29e1174ec8ac628405a546e42b717a2d3388b
66b4fac9494bbeda177f4637fa3e7423fc8ef54b11a6875e68cdf3e472293b2a
672d6213183ae0e2c831c1bb3d7ecae4ffced9b5fb06094d28f5be9dade35e13
6872a6c9c2a917ceeb92fefd3ef73cee7402a56689e1dbddf743b0aaa9e654c8
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6b2ea2f871ef2c9740005e5066579896a36adfb3a13c48676a072ab46c030a76
6b66955d2f6a8fab43675c6a02f74f5d3914d07121b12396bc9308dbb00d78fe
6bea2f9a81ff3f3fbbf2ec0a87e55d9f3ac4f0175c2c8be4db3aef9ac3d5a4f4
6df13a928059e963f9cc854385b6bfb34c4e480a4367601db6a05f49d7451ca2
6f874c0c598ebed0993d62f73526322c043050b8c24084b84fa3c2e9a934d147
70d52338fe73e62ffcfa568e9ea399ef0c88783883327b794eace9faa78febf8
7219936e6e56b9932b2f1dd06cfff09b655a729bb17d0aa6d757e14184512384
73ee936a71d2b070f90474f19aeb537873164d4e9db2dc11c26df4ad33eee0d7
755ae062fc4da1ccb582f2d2e153deaea69a05c1e5dd2b63b0e797b855608d86
764f3bc000ae1ec04d320f7d642c0c709c0b9945e22c5c4e0997b89da5c6c2f8
765097740b7490e6ab6a2d8624199ab7b147e8c6cec064b6cce257750fdb1985
77368a6af3446eaa4e4cdd554611969b0658f7e328057dd7182983675ff3b15e
793fc397fef7e49522e43e020655cf3647b690848c0a2da1669912083a7f1680
798c2889cb75fae42481fa23b5c65aec754eccdd4f597f8d26425854a384366a
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7aaaef607fd666b5201c90c274524a44686d6e7f18f8b80937395decd4573509
809ecdb25b0c622568945db5ddc3f620c91f6a3c52fc6e252eb9c3ba484b2559
86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd
89a0cd8835ea7f1f1c79af55c4f53827ad275661b0bfe2ddb9db7a396acb4ef0
8a915dce7f93a61c579d94a179b82bf21d9f202ea0d59f176c615df3afa11500
8bd397636ecd49c36d687ad591807ea5ee621b1e11888657827902a5003fc4bb
918f76fc6b2e421a20ee564c3540a81bfb5c431a3986ae6fa6493d0e8672a926
922775e912a16f140b15ada5253a420ad1d57666a6b84077e03a5f4110c85cd7
9607506688417bb09b8d6c29362c2fe29bc1b047b793cccddfce876d927fa57b
97829f8a6f2a471117ed06d0b06a81d543b091a262192369c531380779148c5c
99c81656d35fe0430d483bd3401206654ac4b6c8dfe7c4e230bce50dd0e8a98b
9af256cb88b39b1a3b6e36b50a7d7f3215db54331371bb53ed698450672ddcc8
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9baa573e4378873b7ac81ccb1d954ce9bb2b1a933947ad3012263ddc604d8505
9d87485cf1848c8b47b527790aa2ae1384192a93df403b6bfe0108e5955e6f0d
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a11e9e6d3c89dd9c18941ec59fb63c4c71c3e2f99205754ea7b930d720e7799d
a4aeba3c62a91ed236d5acdc5ea52f5e051801379d306817ad8f4c850e550d2a
a9541d638a28ec17900ea4eb27f0cf2911a4bb336e446ac4e438ed18e6305707
ab449241b50123673e76dbcd70f869ae11d26920f0ce1670fdfd266308058179
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b329852f8f537591d001152e26a1b598ef4e4466fa10d859135843c307d5344e
b45cb384c0bce67cbfe97ffb78913fe0049922279f9985c7c78c2553e6988927
b475cc00ef033ea824ceba778321c00bf3cbfa950403127d463d7207772e9366
b71a982dad86829660cef46a0467ecf81c34576eece4b297126a552902ef543c
b787edbadba36b6415e7e55e9fae5132e154d83c103d478384a434650bca71c9
b7edf93100596da3ba8a71d86d8e8435961e9de7367b95b85e4d578da8a1370a
b7ee4066f357a2608fda7f55106299bd585f26efdf78256360ae45fb085454ce
b8e21943966ef208ab8905e7439caccb19e1a7daaac3fd35cb81e913ae4b1743
bcaf54bc46707931d5bcfd93e5b1ac50a518dabb1748fb5155353b392f11c2f8
bd7d6e2c9512769909e715261bdac948654139377cc994055d37b5762eee8229
c4f000998ffedd1b881ece5a8926dc23c48d61f74dc34442868abecdfa6f1448
c71ee652f3c95d29791f115bb0e3ae79882e7628f4b4c343d119ded1db2dcdd2
ca83bf6c4611e07ea8b93893694e16957cd66082de76afb1ee564fba6f055750
caa333db2175837df41125b50f0c0169c55f919427ee2c6992e2566948e9e518
cc0f8400d713f4d28b248d08bc390c68d5c03c139973b539dc1bc78ea005b70b
cd7908a80313043ae934d5f599a062460c50f94370cee5dc092e0cb9b8d123ef
d11fbe2073d34155218d7a70eead316ab8ee6d6c526656c27b26a23deda67609
d998e1c989da89276b479d0ab823fb7090fa39e25fdc4856c9034e8af92caa0c
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e1faf24d298d90e4232535a1c09e874049601290a25f62d16c270ad65e960cf7
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
e33f3c897be63e437b0abcdd3ce9c6e33027e9d35cdbe13cfa47ab92f1c7cef7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e519a869fc9b4e0f0464f67f6ffdb8c2fa0ad502c2509f9a94dc59522bea3a7c
e6a1417e09eeea9c83affb5ac3accc92f44b37569b78e15e959c1d06c1edbaa3
e794c519dde544a7ce82e363dfae77b940d18c38ebb6f8cd1934f6ed87f7d1fa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f165f18bc46a735677d81ecd2d6c467d5f6433ea3b3a2173b559f4f923dd833e
f621a831fe6b7b75cd96e10eb4c80311fff6a3948e4905d12a22032d5ec59b48
fd8fc30068f5b417cc2293a9910eb11036285affab5681aa2b92a472f4b13f0a

www.cybereason.com Open in urlscan Pro 2606:4700::6811:84b4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

153 Requests

100 %HTTPS

53 %IPv6

32 Domains

46 Subdomains

40 IPs

8 Countries

8252 kBTransfer

10826 kBSize

11 Cookies

76 Outgoing links

Page URL History

Redirected requests

153 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cybereason.com Open in urlscan Pro
2606:4700::6811:84b4 Public Scan

Screenshot
Live screenshot

Full Image

153
Requests

100 %
HTTPS

53 %
IPv6

32
Domains

46
Subdomains

40
IPs

8
Countries

8252 kB
Transfer

10826 kB
Size

11
Cookies

153 HTTP transactions
1 data transactions