www.bleepingcomputer.com Open in urlscan Pro
104.20.59.209  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

• https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
• https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 99

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369

Request Chain 100

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369

Request Chain 101

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369

Request Chain 102

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369

Request Chain 103

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369

Request Chain 104

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369

Request Chain 105

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369

Request Chain 106

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369

Request Chain 107

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369

Request Chain 108

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369

Request Chain 109

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369

Request Chain 110

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369

Request Chain 164

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 166

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 187

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625

Request Chain 188

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625

Request Chain 189

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625

Request Chain 324

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 384

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 386

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 387

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 392

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 393

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 394

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 399

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 400

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

423 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/	66 KB 14 KB	650ms 575ms	Document text/html	104.20.59.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.59.209 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1a4c46d5f708676c2ea4f9aa00699b4d797a68d2faeafc0f8b3473ab0a49ea07 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.bleepingcomputer.com :scheme https :path /news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Fri, 06 Mar 2020 16:40:09 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=da9af3f6ce0eec18229167e7999ff5b891583512808; expires=Sun, 05-Apr-20 16:40:08 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=c6fe1ef014a9bdbc56a696221b485ab4; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=7887; expires=Sun, 05-Apr-2020 16:40:09 GMT; Max-Age=2592000; path=/;Secure content-security-policy upgrade-insecure-requests; x-frame-options SAMEORIGIN cache-control no-cache, no-store, must-revalidate pragma no-cache expires 0 last-modified Fri, 06 Mar 2020 01:35:31 GMT vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 56fd844daab268ee-CDG content-encoding br
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	17ms 15ms	Stylesheet text/css	2a00:1450:4001:819::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dda7ea92135dcf21660d4d79391d303fc38f6a6524ae74bbe2986f1d2e990d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Fri, 06 Mar 2020 16:40:09 GMT server ESF date Fri, 06 Mar 2020 16:40:09 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 06 Mar 2020 16:40:09 GMT
GET H2	200	bootstrap.css www.bleepstatic.com/css/redesign/	111 KB 17 KB	129ms 64ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/bootstrap.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e7c74d95df84ef3a6be5c4fcde54fae313a04a9bd611059e6a97a23ff09f26f Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4637 cf-polished origSize=137522 status 200 cf-bgj minify last-modified Fri, 23 Sep 2016 14:33:06 GMT server cloudflare etag W/"2184297232" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd8451bdd1bd59-CDG expires Tue, 19 Nov 2019 07:03:01 GMT
GET H2	200	main.css www.bleepstatic.com/css/redesign/	51 KB 9 KB	109ms 44ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9e727b37a735a7983ea8bdad06a38b246261c239bb80b86cc0ff3663c910adb Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 2653163 cf-polished origSize=60842 status 200 cf-bgj minify last-modified Thu, 16 Aug 2018 15:28:40 GMT server cloudflare etag W/"4249134023" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd8451bdd8bd59-CDG expires Wed, 25 Dec 2019 03:50:37 GMT
GET H2	200	home.css www.bleepstatic.com/css/redesign/	12 KB 3 KB	135ms 70ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/home.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3498f138f5418bd58413e79e4c0969e618d6f2fee2d9d98c0f4e70a6cbd04ad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4637 cf-polished origSize=14998 status 200 cf-bgj minify last-modified Sat, 24 Mar 2018 16:18:00 GMT server cloudflare etag W/"2402535603" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd8451bdd5bd59-CDG expires Tue, 24 Dec 2019 11:34:37 GMT
GET H2	200	news.css www.bleepstatic.com/css/redesign/	27 KB 5 KB	109ms 44ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/news.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d44b93a0af159f0d547d7ec89e9227a5667ce1171bc630e6fbf79dae0e596e2d Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4637 cf-polished origSize=32905 status 200 cf-bgj minify last-modified Tue, 26 Nov 2019 02:56:16 GMT server cloudflare etag W/"400467278" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd8451bdd7bd59-CDG expires Mon, 27 Jan 2020 06:37:13 GMT
GET H2	200	jquery-1.11.1.min.js Show response www.bleepstatic.com/js/redesign/	94 KB 32 KB	122ms 57ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT last-modified Thu, 23 Apr 2015 12:36:44 GMT server cloudflare age 470616 etag W/"3647451394" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 56fd8451bdd9bd59-CDG access-control-allow-origin * expires Sun, 05 Apr 2020 05:56:33 GMT
GET H2	200	news.js Show response www.bleepstatic.com/js/redesign/	183 B 534 B	107ms 42ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/news.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4647 cf-polished origSize=247 status 200 cf-bgj minify last-modified Wed, 16 Dec 2015 15:41:46 GMT server cloudflare etag W/"4218930423" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd8451bddcbd59-CDG expires Tue, 19 Nov 2019 07:03:10 GMT
GET H2	200	connatix.renderer.infeed.min.js Show response cdn.connatix.com/min/	957 B 1 KB	3134ms 35ms	Script application/javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash aaf317c22311451ae20997bb97c3b79d3f8b51a5c6b2a1edbe5373137b6853c5 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:12 GMT via 1.1 varnish server Varnish age 0 x-cache HIT content-type application/javascript status 200 x-referer-host bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1583512812.277378,VS0,VE0 content-length 957 retry-after 0 x-served-by cache-hhn4046-HHN
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	3 KB 1 KB	50ms 48ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 472384 cf-polished origSize=3848 status 200 cf-bgj minify last-modified Thu, 07 Feb 2019 13:49:44 GMT server cloudflare etag W/"3981350888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd84524e6ebd59-CDG expires Sun, 05 Apr 2020 05:27:05 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	74 KB 28 KB	17ms 14ms	Script application/javascript	2a00:1450:4001:821::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a7816dead2b00df32b02c2bd1ef90796c8ad0889f584b4c28a438353615c0efe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br status 200 strict-transport-security max-age=31536000; includeSubDomains alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28477 x-xss-protection 0 last-modified Fri, 06 Mar 2020 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 06 Mar 2020 16:40:09 GMT
GET H2	200	logo.png www.bleepstatic.com/images/site/	1 KB 1 KB	37ms 35ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 153705 cf-polished origFmt=png, origSize=1882 status 200 content-disposition inline; filename="logo.webp" cf-bgj imgq:85 content-length 1152 last-modified Sat, 04 Mar 2017 04:12:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e6fbd59-CDG expires Fri, 03 Apr 2020 21:58:24 GMT
GET H2	200	brand Show response cse.google.com/coop/cse/ Redirect Chain https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en	3 KB 1 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:81d::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software pfe / Resource Hash 4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:13:31 GMT content-encoding gzip x-content-type-options nosniff server pfe age 1598 x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 content-disposition attachment; filename="f.txt" alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1181 x-xss-protection 0 expires Fri, 06 Mar 2020 16:43:31 GMT Redirect headers date Fri, 06 Mar 2020 16:40:09 GMT x-content-type-options nosniff server sffe location https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 266 x-xss-protection 0
GET H2	200	TrickBot-Logo.png www.bleepstatic.com/content/hl-images/2017/09/03/	67 KB 67 KB	59ms 57ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2017/09/03/TrickBot-Logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac9f4f14352d183dc476030e9ea1c46fb3db04d582d3e88f22a6c2ccc050a6f4 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 1990923 cf-polished origFmt=png, origSize=79304 status 200 content-disposition inline; filename="TrickBot-Logo.webp" cf-bgj imgq:85 content-length 68588 last-modified Sun, 03 Sep 2017 18:22:34 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e70bd59-CDG expires Fri, 13 Mar 2020 15:38:06 GMT
GET H2	200	malspam.jpg www.bleepstatic.com/images/news/malware/trickbot/coronavirus-spam/	53 KB 53 KB	53ms 51ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/trickbot/coronavirus-spam/malspam.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 92631e7797751c40870f5b43befb5ce943b6a251cc61ad91690480462cb83765 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 29085 cf-polished qual=85, origFmt=jpeg, origSize=105679 status 200 content-disposition inline; filename="malspam.webp" cf-bgj imgq:85 content-length 54054 last-modified Thu, 05 Mar 2020 18:52:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e72bd59-CDG expires Sun, 05 Apr 2020 08:35:24 GMT
GET H2	200	malicious-document.jpg www.bleepstatic.com/images/news/malware/trickbot/coronavirus-spam/	76 KB 76 KB	39ms 37ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/trickbot/coronavirus-spam/malicious-document.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c8ef11e1b2c4cd3d354e795a938ecb235918fc9f955bead18ec5988123b9cbde Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 29085 cf-polished qual=85, origFmt=jpeg, origSize=170550 status 200 content-disposition inline; filename="malicious-document.webp" cf-bgj imgq:85 content-length 77940 last-modified Thu, 05 Mar 2020 18:52:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e74bd59-CDG expires Sun, 05 Apr 2020 08:35:24 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	105 KB 38 KB	24ms 22ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5a0b050607d03061476a57618facae88282b14052416e63e7222fed31fc26a5d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 38519 x-xss-protection 0 server cafe etag 14959984671288578746 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 06 Mar 2020 16:40:09 GMT
GET H2	200	twitter.png www.bleepstatic.com/images/site/login/	282 B 675 B	49ms 47ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 146728 cf-polished origFmt=png, origSize=475 status 200 content-disposition inline; filename="twitter.webp" cf-bgj imgq:85 content-length 282 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e75bd59-CDG expires Fri, 03 Apr 2020 23:54:41 GMT
GET H2	200	bootstrap.js Show response www.bleepstatic.com/js/redesign/	44 KB 10 KB	66ms 64ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bootstrap.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4647 cf-polished origSize=65813 status 200 cf-bgj minify last-modified Thu, 23 Apr 2015 12:36:43 GMT server cloudflare etag W/"3930092018" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd84524e76bd59-CDG expires Tue, 24 Dec 2019 11:34:37 GMT
GET H2	200	blazy.min.js Show response www.bleepstatic.com/js/blazy/	5 KB 2 KB	34ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/blazy/blazy.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT last-modified Thu, 16 Aug 2018 21:06:19 GMT server cloudflare age 4647 etag W/"753357888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 56fd8451fe25bd59-CDG access-control-allow-origin * expires Wed, 16 Oct 2019 12:18:00 GMT
GET H2	200	bleep.js Show response www.bleepstatic.com/js/redesign/	3 KB 812 B	49ms 48ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bleep.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4647 cf-polished origSize=3600 status 200 cf-bgj minify last-modified Mon, 01 Oct 2018 12:47:57 GMT server cloudflare etag W/"2696894447" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd84524e78bd59-CDG expires Wed, 11 Dec 2019 01:44:46 GMT
GET H2	200	jquery.fancybox.js Show response www.bleepstatic.com/js/redesign/fancybox/	31 KB 9 KB	64ms 62ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4647 cf-polished origSize=48706 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"327140449" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd84524e79bd59-CDG expires Wed, 16 Oct 2019 12:18:22 GMT
GET H2	200	fixto.min.js Show response www.bleepstatic.com/js/fixto/	8 KB 3 KB	36ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/fixto/fixto.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Jun 2015 21:34:42 GMT server cloudflare age 4637 etag W/"1740214911" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 56fd84524e6dbd59-CDG access-control-allow-origin * expires Mon, 23 Dec 2019 21:16:36 GMT
GET H2	200	addthis_widget.js Show response s9.addthis.com/js/300/	349 KB 113 KB	100ms 46ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s9.addthis.com/js/300/addthis_widget.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Tue, 21 Jan 2020 20:57:37 GMT server nginx/1.15.8 etag "5e2765c1-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Fri, 06 Mar 2020 16:40:09 GMT x-host s9.addthis.com content-length 114924
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	440 KB 117 KB	37ms 35ms	Script application/javascript	2606:4700:20::681a:18b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 300fce706b3289b4b40fd335cecfd74e68bd341b86dbde387a75a336b7806254 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 50 status 200 x-guploader-uploadid AEnB2UrlnvzMibdatLAD4LCCPewWf2BGX_gRk5JGGQjnL_gAUv87_S3rp5b_zfYQE7EafVKoBV7H3xonwZdsDe9Wg-LyXJ9lRw x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Wed, 04 Mar 2020 15:18:20 GMT server cloudflare etag W/"c30dc417494ca5e2f2d0d2bf2057fe09" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=Ew1WnA==, md5=ww3EF0lMpeLy0NK/IFf+CQ== content-type application/javascript x-goog-generation 1583335100136907 cache-control public, max-age=1800 x-goog-stored-content-length 450531 cf-ray 56fd84523ab8c27c-FRA expires Fri, 06 Mar 2020 16:40:19 GMT
GET H/1.1	200 OK	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	328ms 24ms	Script application/javascript	178.79.175.86 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.79.175.86 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS nb-178-79-175-86.london.nodebalancer.linode.com Software nginx/1.12.2 / Resource Hash affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 06 Mar 2020 16:39:38 GMT Content-Encoding gzip Last-Modified Wed, 15 Jul 2015 00:00:00 GMT Server nginx/1.12.2 ETag "55a5a280-560" Content-Type application/javascript Cache-Control max-age=3600 Connection close Content-Length 1376 Expires Fri, 06 Mar 2020 17:39:38 GMT
GET H2	200	login_bg.png www.bleepstatic.com/images/site/	126 B 415 B	61ms 61ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 154844 cf-polished origFmt=png, origSize=187 status 200 content-disposition inline; filename="login_bg.webp" cf-bgj imgq:85 content-length 126 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84524e7abd59-CDG expires Fri, 03 Apr 2020 21:39:25 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 719583 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 3080990 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	nav_bg.png www.bleepstatic.com/images/site/	72 B 235 B	51ms 50ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/nav_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 150268 cf-polished origFmt=png, origSize=83 status 200 content-disposition inline; filename="nav_bg.webp" cf-bgj imgq:85 content-length 72 last-modified Sat, 04 Mar 2017 07:57:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84525e89bd59-CDG expires Fri, 03 Apr 2020 22:55:41 GMT
GET H2	200	20x20-printer.png www.bleepstatic.com/images/site/	422 B 590 B	37ms 36ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/20x20-printer.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 153660 cf-polished origFmt=png, origSize=824 status 200 content-disposition inline; filename="20x20-printer.webp" cf-bgj imgq:85 content-length 422 last-modified Sat, 03 Oct 2015 03:18:32 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84527eabbd59-CDG expires Fri, 03 Apr 2020 21:59:09 GMT
GET H2	200	calendar.png www.bleepstatic.com/images/site/	86 B 477 B	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/calendar.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 153091 cf-polished origFmt=png, origSize=129 status 200 content-disposition inline; filename="calendar.webp" cf-bgj imgq:85 content-length 86 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84527eacbd59-CDG expires Fri, 03 Apr 2020 22:08:38 GMT
GET H2	200	clock.png www.bleepstatic.com/images/site/	252 B 641 B	51ms 51ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/clock.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 153702 cf-polished origFmt=png, origSize=1316 status 200 content-disposition inline; filename="clock.webp" cf-bgj imgq:85 content-length 252 last-modified Fri, 29 May 2015 07:08:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84527eb0bd59-CDG expires Fri, 03 Apr 2020 21:58:27 GMT
GET H2	200	comment-light.png www.bleepstatic.com/images/site/	96 B 264 B	41ms 40ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comment-light.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 752739 cf-polished origFmt=png, origSize=1034 status 200 content-disposition inline; filename="comment-light.webp" cf-bgj imgq:85 content-length 96 last-modified Fri, 29 May 2015 07:08:28 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84527eb1bd59-CDG expires Fri, 27 Mar 2020 23:34:30 GMT
GET H2	200	32x32-printer.png www.bleepstatic.com/images/site/	256 B 533 B	41ms 40ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/32x32-printer.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 151457 cf-polished origFmt=png, origSize=618 status 200 content-disposition inline; filename="32x32-printer.webp" cf-bgj imgq:85 content-length 256 last-modified Fri, 02 Oct 2015 21:57:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84527eb2bd59-CDG expires Fri, 03 Apr 2020 22:35:52 GMT
GET H2	200	21beb902b545b086a90ec39f1df36b94.jpg www.bleepstatic.com/author/photos/	7 KB 8 KB	38ms 38ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19e1dbba639ba68ceb71cdada9621e11d0aec6edba410971f1937d6cc4935b32 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 4503 cf-polished origSize=7617, status=webp_bigger status 200 cf-bgj imgq:85 content-length 7581 last-modified Mon, 26 Oct 2015 17:15:33 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84528eb3bd59-CDG expires Wed, 18 Dec 2019 21:16:38 GMT
GET H2	200	h4-bg.png www.bleepstatic.com/images/site/	38 B 178 B	35ms 35ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/h4-bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 146387 cf-polished origFmt=png, origSize=72 status 200 content-disposition inline; filename="h4-bg.webp" cf-bgj imgq:85 content-length 38 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84528eb6bd59-CDG expires Sat, 04 Apr 2020 00:00:22 GMT
GET H2	200	news_email_icon.png www.bleepstatic.com/images/site/	126 B 448 B	38ms 38ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_email_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a Request headers Referer https://www.bleepstatic.com/css/redesign/home.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 747786 cf-polished origFmt=png, origSize=1105 status 200 content-disposition inline; filename="news_email_icon.webp" cf-bgj imgq:85 content-length 126 last-modified Fri, 29 May 2015 07:10:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84528eb7bd59-CDG expires Sat, 28 Mar 2020 00:57:02 GMT
GET H2	200	news_footer_icon.png www.bleepstatic.com/images/site/	110 B 229 B	33ms 32ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_footer_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 153091 cf-polished origFmt=png, origSize=186 status 200 content-disposition inline; filename="news_footer_icon.webp" cf-bgj imgq:85 content-length 110 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd84528eb8bd59-CDG expires Fri, 03 Apr 2020 22:08:38 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 134331 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 134850 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	cmp.js Show response quantcast.mgr.consensu.org/	225 KB 61 KB	9ms 8ms	Script text/javascript	2600:9000:21f3:9800:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/cmp.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:9800:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 68a6c91fc7525fa5e2d4186dcb795dfc9fd83b756e76fc64bd002de2c1fb47e9 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:37:00 GMT content-encoding gzip last-modified Thu, 27 Feb 2020 19:40:29 GMT server AmazonS3 age 1021 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-meta-qc-ineu True x-amz-cf-pop FRA2-C2 x-amz-cf-id NrHNuqxSUp27rgcVW00FC3IbN37g8QlvaiM10TE4WfgfRkGEoqhT6A== via 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 171 B	16ms 16ms	Script application/javascript	2a00:1450:4001:818::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 171 B	15ms 15ms	Script application/javascript	2a00:1450:4001:817::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/	222 KB 83 KB	29ms 29ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 984b50b44ade35d903bbfa50129e85a46a2247060ae69b55e7e595fd1f7dadde Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 84919 x-xss-protection 0 server cafe etag 15562713877717077162 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Fri, 06 Mar 2020 16:40:09 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20200303/r20190131/ Frame 570A	0 0	6ms 5ms	Document text/html	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20200303/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20200303/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * vary Accept-Encoding date Wed, 04 Mar 2020 00:56:44 GMT expires Wed, 18 Mar 2020 00:56:44 GMT content-type text/html; charset=UTF-8 etag 10348540741379653356 x-content-type-options nosniff content-encoding gzip server cafe content-length 4494 x-xss-protection 0 cache-control public, max-age=1209600 age 229405 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H/1.1	200 OK	cookie Show response d.pub.network/	36 B 472 B	584ms 222ms	XHR text/plain	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/cookie Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 151df54928a1ae69df9cd78adcbe8c1b4249af02fa7614efc95278238781f0b5 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:10 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	44 KB 14 KB	14ms 14ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eefbbaa6f5283c2d2d9e5653f3190fcfae84ed32bb74f7850dc0efd3b5cacd01 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "448 / 638 of 1000 / last-modified: 1583428060" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14592 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:09 GMT
GET H/1.1	200 OK	gallery.js Show response freestar-io.videoplayerhub.com/	100 KB 26 KB	1098ms 36ms	Script application/javascript	13.225.87.105 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://freestar-io.videoplayerhub.com/gallery.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.87.105 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-105.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash de1f8951b7801ad3b6d686af593fafd83d936526937260986932d8eaacdb2d0e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id iWuHtUJgXKWX_IH6Sf_VxHpxCV_BHk4n Content-Encoding gzip Last-Modified Thu, 05 Mar 2020 20:45:54 GMT Server AmazonS3 Age 103 Date Fri, 06 Mar 2020 16:39:12 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C2 Connection keep-alive X-Amz-Cf-Id ajXJmo4qQmPb7vYOVqrX2X1uarOQg6YYjMCHBUe_V7xsjHdG7IM6Tw==
GET H2	200	prebid-analytics-3.6.2.js Show response a.pub.network/core/	350 KB 106 KB	144ms 143ms	Script text/html	2606:4700:20::681a:18b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/core/prebid-analytics-3.6.2.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bfc61f56cf987bfbf5e1c86e6746d24c7dcd6ad98806dfca9d63c6110810582 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status BYPASS status 200 x-guploader-uploadid AEnB2UrS3ySfuYAobPzTyTRKt4a1DQf8TFMs0CKs36Fte92FDIYdS2bqb1DFGqbJdFTKCZNHsY1CD5nBgPzOw15Gu4wIIss0yA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 3 x-goog-stored-content-encoding identity last-modified Fri, 28 Feb 2020 20:11:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ== content-type text/html x-goog-generation 1582920668771105 cache-control private x-goog-stored-content-length 358240 cf-ray 56fd8453cf71c27c-FRA expires Sat, 06 Mar 2021 16:40:09 GMT
GET H/1.1	200 OK	location Show response d.pub.network/	51 B 498 B	728ms 118ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/location Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 6358c6ea8da1fcf2fc88c991a803c1a5f63b13247d7c546f1e3365ce17ec484d Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:10 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	292x176_Coronavirus_COVID-19.jpg www.bleepstatic.com/content/hl-images/2020/02/27/thumb/	7 KB 7 KB	37ms 37ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/02/27/thumb/292x176_Coronavirus_COVID-19.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dad55761e95546f44feb6f6c99c363dcd7974d69854d25ad3842acddd82a53c8 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 40379 cf-polished qual=85, origFmt=jpeg, origSize=7543 status 200 content-disposition inline; filename="292x176_Coronavirus_COVID-19.webp" cf-bgj imgq:85 content-length 7020 last-modified Thu, 27 Feb 2020 19:51:47 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd8453f8b1bd59-CDG expires Sun, 05 Apr 2020 05:27:10 GMT
GET H2	200	292x176_PowerShell.jpg www.bleepstatic.com/content/hl-images/2020/03/04/thumb/	3 KB 3 KB	39ms 39ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/03/04/thumb/292x176_PowerShell.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8384097a64dbcc972196b7f26686a54a076ababa1496c0a2342890f3b03a7c42 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:09 GMT cf-cache-status HIT age 40379 cf-polished qual=85, origFmt=jpeg, origSize=4533 status 200 content-disposition inline; filename="292x176_PowerShell.webp" cf-bgj imgq:85 content-length 2968 last-modified Wed, 04 Mar 2020 18:43:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd8453f8b6bd59-CDG expires Sun, 05 Apr 2020 05:27:10 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:821::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 2879 date Fri, 06 Mar 2020 15:52:10 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 18174 expires Fri, 06 Mar 2020 17:52:10 GMT
GET H2	200	jquery.fancybox.css www.bleepstatic.com/js/redesign/fancybox/	4 KB 1 KB	41ms 41ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4637 cf-polished origSize=4895 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"9108074" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd845408e5bd59-CDG expires Tue, 19 Nov 2019 07:02:56 GMT
GET H2	200	font-awesome.css www.bleepstatic.com/css/redesign/	22 KB 5 KB	38ms 38ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/font-awesome.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding br cf-cache-status HIT age 4637 cf-polished origSize=26776 status 200 cf-bgj minify last-modified Tue, 03 May 2016 04:39:29 GMT server cloudflare etag W/"1700274315" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 56fd845408e8bd59-CDG expires Wed, 11 Dec 2019 01:44:49 GMT
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	75ms 27ms	Script application/x-javascript	23.210.250.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-250-213.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id DD7864003C5CA047 etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=51720 accept-ranges bytes content-length 948 x-amz-id-2 QZsv8He4gCAWkZyfO692XnPUzTy0s9bUu/LN+U2M09eNsTLXpPT9nNZ8h6o4U/DJ/GnpJJB2B54=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/	2 KB 855 B	573ms 572ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:10 GMT content-encoding gzip etag -1659864586--gzip vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=58, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 678
GET H2	200	cmp-3pc-check.html static.quantcast.mgr.consensu.org/v30/ Frame 2577	0 0	11ms 10ms	Document text/html	2600:9000:21f3:c600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v30/cmp-3pc-check.html Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:c600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority static.quantcast.mgr.consensu.org :scheme https :path /v30/cmp-3pc-check.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 content-type text/html content-length 645 last-modified Thu, 27 Feb 2020 19:40:24 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 date Fri, 06 Mar 2020 16:36:58 GMT etag "55b98270d639ef0c34781d9f03cce91f" x-cache Hit from cloudfront via 1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id SXaSgMxvlse6Rynx_VqqpNXyguhyg-HrpFOdXk-lnlnSyEk8Z7aDKQ== age 532
GET H2	200	pubads_impl_2020022701.js Show response securepubads.g.doubleclick.net/gpt/	164 KB 60 KB	328ms 30ms	Script text/javascript	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software sffe / Resource Hash dfc3f558d7ab9659f6fc3a1c61fa7c5c6c905adecd8bff069652254c13f84b9b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 27 Feb 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 61148 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:09 GMT
GET H2	200	fontawesome-webfont.woff www.bleepstatic.com/fonts/	64 KB 64 KB	1367ms 38ms	Font application/octet-stream	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1 Request headers Referer https://www.bleepstatic.com/css/redesign/font-awesome.css Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:11 GMT cf-cache-status HIT last-modified Thu, 23 Apr 2015 09:36:00 GMT server cloudflare age 4639 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/octet-stream status 200 accept-ranges bytes cf-ray 56fd845ccef9cd87-CDG access-control-allow-origin * content-length 65452
GET H2	200	collect www.google-analytics.com/r/	35 B 102 B	14ms 14ms	Image image/gif	2a00:1450:4001:821::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1343790522&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ul=en-us&de=UTF-8&dt=TrickBot%20Malware%20Targets%20Italy%20in%20Fake%20WHO%20Coronavirus%20Emails&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=757386095&gjid=1124419196&cid=1226119744.1583512810&tid=UA-91740-1&_gid=1145646512.1583512810&_r=1&gtm=2ou2q2&z=525582687 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:09 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	cmpui-popup.js Show response static.quantcast.mgr.consensu.org/v30/	230 KB 61 KB	18ms 17ms	Script text/javascript	2600:9000:21f3:c600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v30/cmpui-popup.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:c600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash f7cc37747a8501579139a8046b73b731490a0586435eff0e4ec37649cf72ce24 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:39:01 GMT content-encoding gzip last-modified Thu, 27 Feb 2020 19:40:24 GMT server AmazonS3 age 668 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-cf-pop FRA2-C2 x-amz-cf-id E2OaX1PNz9Mo_MnUAiAelWpBJ3KGsCGWAkxXpHMpRHkhYy8aKaV8gA== via 1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront)
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 455 B	320ms 24ms	Image image/x-icon	172.217.16.166 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.166 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s11-in-f166.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:03:42 GMT content-encoding gzip x-content-type-options nosniff age 2188 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes expires Sat, 07 Mar 2020 16:03:42 GMT
GET H2	200	vendorlist.json Show response vendorlist.consensu.org/	94 KB 18 KB	9ms 9ms	XHR application/json	2600:9000:21f3:8800:1:af78:4c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vendorlist.consensu.org/vendorlist.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:8800:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash affa28efb0c6bb6f9bb296d2e171e38589f3534b5d39081577bbc0eb2cd7a0cc Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 16:10:23 GMT content-encoding gzip vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 88187 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 16:00:51 GMT server AmazonS3 access-control-max-age 604800 access-control-allow-methods GET x-amz-version-id DyrgjbRDAghMTxFkQurmcg61gsOgXbVC via 1.1 999a435eb37a050d3de26fe63534c416.cloudfront.net (CloudFront) cache-control max-age=604800 x-amz-cf-pop FRA2-C2 content-type application/json; charset=utf-8 x-amz-cf-id dZQoVGGEwKi3J-pTOJJC_GDWmVkWuHoLyLSG1E7mxryUOzJLtJqCvg==
GET H2	404	CookieAccess Show response api.quantcast.mgr.consensu.org/	30 B 598 B	185ms 125ms	XHR application/json	143.204.101.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.quantcast.mgr.consensu.org/CookieAccess Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.111 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-101-111.fra50.r.cloudfront.net Software / Resource Hash 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:09 GMT content-encoding gzip x-amz-cf-pop FRA50-C1 x-amzn-requestid cbfcb19b-d418-4b44-9af9-0de503a790d1 x-cache Error from cloudfront status 404 x-amz-apigw-id I-h0jEt2IAMF2hA= content-length 50 access-control-allow-origin https://www.bleepingcomputer.com x-amzn-trace-id Root=1-5e627ce9-1f7df41deb9f696d888fd375;Sampled=0 vary Origin access-control-allow-methods GET, POST content-type application/json via 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront) cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Content-Type x-amz-cf-id 6fqR0mMaQu1ez90NMkcwzLxUhyKmhXpMJkJSIGYE58BXzefMmosjqw==
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	apstag.js Show response c.amazon-adsystem.com/aax2/	87 KB 25 KB	95ms 50ms	Script application/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aax2/apstag.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 05 Mar 2020 22:00:54 GMT content-encoding gzip server Server age 67155 etag 1dcfbf3986ee8b9c3abbc67eb808ab43 x-cache Hit from cloudfront content-type application/javascript status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA2-C1 accept-ranges bytes x-amz-cf-id ojjlWqCTOkRC7tcJGdyI9qW2jsRpPKPoPPMmh8PosDrFeckiSf_AZQ== via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront)
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/	130 KB 28 KB	311ms 21ms	Script text/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 47c84fe94ec105047c0602c72a7e71ef361f9cc4c536045da444ec0b6e2870c7 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 06 Mar 2020 16:40:10 GMT Content-Encoding gzip Age 3349 X-Cache HIT Connection keep-alive Content-Length 27829 x-amz-id-2 Lpc5b00TZdatAw8ZosJR8M8/bZGSmIvzDrKHJES/4k9qMXnkV8HofIknOg5FfQaC85Nrycfv4R8= X-Served-By cache-hhn4076-HHN Last-Modified Fri, 06 Mar 2020 15:40:08 GMT Server AmazonS3 X-Timer S1583512810.334912,VS0,VE0 ETag "1616b0b9a708dc6fbf4f2b68852c9f19" x-amz-request-id 7E1E0AF1DB39FC50 Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 299
GET H/1.1	200 OK	v2 Show response d.pub.network/floors/	1 KB 2 KB	209ms 144ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/floors/v2?key=535desktop Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 7e3ba0af0ec241d6983b87e6d71d0edb095e8adb6d370fb41083955a811b68d0 Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:10 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	aps_csm.js Show response c.amazon-adsystem.com/bao-csm/aps-comm/	6 KB 3 KB	67ms 23ms	XHR application/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 08:29:53 GMT content-encoding gzip vary Origin age 29418 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 08:28:46 GMT server AmazonS3 access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript via 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA2-C1 x-amz-cf-id gpSTvTL1PFMTiYPVN0Ghr8EKMaq3ndYUBzPJ-jrP53b-osEGfV-JzQ==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 375 B	72ms 72ms	XHR text/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&pid=4TYk6lSEJEGjz&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:10 GMT via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id maSiD6K6Pq6-k33_DkEhg0SVksaX1Y35Thw-E1oI1Xii3TAGdDx91w==
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	50ms 49ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Fri, 06 Mar 2020 16:40:10 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame F861	0 0	57ms 57ms	Document text/html	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1583458531&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1583512809489&bpp=5&bdt=334&fdt=211&idt=211&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4302537627570&frm=20&pv=2&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&ga_fc=0&iag=0&icsg=43980509159424&dssz=49&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=1625500716952767&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=731 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1583458531&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1583512809489&bpp=5&bdt=334&fdt=211&idt=211&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4302537627570&frm=20&pv=2&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&ga_fc=0&iag=0&icsg=43980509159424&dssz=49&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=1625500716952767&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=731 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Fri, 06 Mar 2020 16:40:10 GMT server cafe content-length 34 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Fri, 06-Mar-2020 16:55:10 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 expires Fri, 06 Mar 2020 16:40:10 GMT cache-control private
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 27 KB	27ms 27ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 88b230f7cc8dcdf4ac2d71c5537f063d2be6b51ecf10df6ba04bb53a0062b9f2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:10 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1583324508270956" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 27646 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:10 GMT
GET H2	200	/ Show response audit.quantcast.mgr.consensu.org/	80 B 487 B	70ms 23ms	XHR text/html	13.225.87.14 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit.quantcast.mgr.consensu.org/?log=;1583512810224;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F;;;;;p,off,false,,1,en,30,192,true,false,false;displayConsentUi:mandatory,;GDPR-jcbv2kpqs419wcmw9d1l Requested by Host: static.quantcast.mgr.consensu.org URL: https://static.quantcast.mgr.consensu.org/v30/cmpui-popup.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.87.14 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-14.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 01:26:29 GMT via 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront) vary Origin age 54822 x-cache Hit from cloudfront status 200 content-length 80 last-modified Mon, 11 Jun 2018 22:07:34 GMT server AmazonS3 etag "0614149d8033903db5de46d6c184bbfd" access-control-max-age 3000 access-control-allow-methods GET content-type text/html access-control-allow-origin * x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id fnbRGdbEDScBZgorrDZLoNfYZMvi73JWQrN9RY70lADfFFUp-Ekdlg==
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202003031018/	93 KB 32 KB	25ms 24ms	Script application/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 34292167addf295f8e1093dec6d1ddf48ae031d650a9f5acb3a90d93bad7fcd5 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 06 Mar 2020 16:40:10 GMT Content-Encoding gzip Age 790 X-Cache HIT Connection keep-alive Content-Length 32456 x-amz-id-2 ehnxwwbeVzcvkj+dGkHhWvvywH7S1hk16pw6f0dfe8gLwhXeddSZJnyvNuMU2ectymc1kZinVpw= X-Served-By cache-hhn4076-HHN Last-Modified Tue, 03 Mar 2020 17:14:30 GMT Server AmazonS3 X-Timer S1583512810.379857,VS0,VE0 ETag "2ebe2ea98fa0289a72ff54e73a9b6815" x-amz-request-id 62424DDA193BFE28 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 719
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202003031018/	32 KB 12 KB	52ms 22ms	Script application/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202003031018/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 31f25dee720c1cc57694de1ed117f8a5b34c0899c453223cde12bbcab7518416 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 06 Mar 2020 16:40:10 GMT Content-Encoding gzip Age 808 X-Cache HIT Connection keep-alive Content-Length 12024 x-amz-id-2 hr8NxJRprQtCnyFahIDqpA6AOVWh2M/onyZtFhTqe/wCRzl6dTNpaGE+RyfKXEWhQeNJENTcwNU= X-Served-By cache-hhn4076-HHN Last-Modified Tue, 03 Mar 2020 17:14:32 GMT Server AmazonS3 X-Timer S1583512810.409811,VS0,VE0 ETag "5d9f45421c8ea9e676a2a26194dd41f9" x-amz-request-id FE2941541E66B3E6 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 2273
GET H2	200	48.008759e9efe1c1b693dd.js Show response s7.addthis.com/static/	281 B 486 B	28ms 28ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-119" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Fri, 06 Mar 2020 16:40:10 GMT x-host s7.addthis.com timing-allow-origin * content-length 246
GET H2	200	/ Show response graph.facebook.com/	309 B 419 B	62ms 50ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_79uf0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash fde9de89d80815b46e7ddea6fba724320dd804260bcecdfad1212c4b26be968c Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload content-encoding br x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Fri, 06 Mar 2020 16:40:10 GMT, Fri, 06 Mar 2020 16:40:10 GMT x-fb-rev 1001802522 alt-svc h3-27=":443"; ma=3600 content-length 218 pragma no-cache x-fb-debug MR6GgGQGn70J7U3O58UuxCt5j7JvJijWqRhiIEfdbCvtSiNbhS9eoKqRhJg4fUtF1gWRf6qTpaK7anbM/zrJaw== x-fb-trace-id EkI4e3yYaCF etag "2839fd96b41fc85c62e9578910379b4b0c5238d1" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id ASqnzp-23TWfXhSPyWXrycF cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 668 B	446ms 148ms	Script application/javascript	151.101.13.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&jsonp=_ate.cbs.rcb_5r0j0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash c74c5f6fa9690d9eebdf7ec071acf4809418db7a00f07333b5dd34b474f4eb3f Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:11 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-fra19137-FRA x-moose majestic server snooserv x-timer S1583512811.019386,VS0,VE124 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	/ Show response graph.facebook.com/	149 B 605 B	45ms 34ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_68h40 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f140262f910a350cff87d858fd05765f1cba73c87ccb92374c26896d0e9e4138 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Fri, 06 Mar 2020 16:40:10 GMT, Fri, 06 Mar 2020 16:40:10 GMT x-fb-rev 1001802522 alt-svc h3-27=":443"; ma=3600 content-length 149 pragma no-cache x-fb-debug nmEQns/TZewPSCFu5wOdjxcT/h1jCArg8YVDgorCNwijPiA4Z7VTueiPzAW0WVr8wS8XaIUWquymB3x5su9qpQ== x-fb-trace-id FTZyawaLAM3 etag "61a08432a2f8d22bebf0bc06aae25e3b65358a65" content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id A459rJKqPoxnj5DyDH3sYkV cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 258 B	715ms 417ms	Script application/javascript	151.101.13.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&jsonp=_ate.cbs.rcb_l47q0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash e1b6a9b3ffc28a94aef0462113792213343394f971fb3bb4c0c4540b08a7f911 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:11 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-fra19137-FRA x-moose majestic server snooserv x-timer S1583512811.019414,VS0,VE393 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	beacon.js Show response ad-delivery.net/	1 KB 994 B	65ms 23ms	Script application/x-javascript	13.225.87.85 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad-delivery.net/beacon.js Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.87.85 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-85.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id null content-encoding gzip last-modified Tue, 31 Jan 2017 15:06:54 GMT server AmazonS3 age 2919 date Fri, 06 Mar 2020 15:51:34 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop FRA2-C2 x-amz-cf-id RqGIJVKdFMuUN6jdKF8YRKZBzAzzyTnOFRrN6hGJBmanW4YrOHNaLg== via 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
GET H/1.1	200 OK	jquery.color-2.1.2.min.js Show response cluster-na.cdnjquery.com/color/	92 B 354 B	367ms 159ms	Script text/javascript	34.225.196.22 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1583512811286&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%222550d996-5fc9-11ea-9121-7875dbe8125e%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&csVersion=1.21.43&clearThroughOptions=undefined Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.225.196.22 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-225-196-22.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash 988c6ea716599b4cd22273e9b04c55a3647b00fbdd35e407ce280b36355b94b2 Security Headers Name Value X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 06 Mar 2020 16:40:11 GMT Content-Encoding gzip Server nginx/1.12.1 ETag W/"5c-Fz9w2rOIZGSWrONzCTnu+nvVEF0" X-Frame-Options DENY Content-Type text/javascript; charset=utf-8 Charset utf8 Connection keep-alive Content-Length 82
GET H2	200	px.gif ad-delivery.net/	43 B 386 B	25ms 24ms	Image image/gif	13.225.87.85 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad-delivery.net/px.gif?ch=1&e=0.6146043235159171 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.87.85 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-87-85.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers x-amz-version-id null via 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront) last-modified Thu, 27 Jul 2017 18:59:05 GMT server AmazonS3 age 78623 etag "ad4b0f606e0f8465bc4c4c170b37e1a3" x-cache Hit from cloudfront content-type image/gif status 200 date Thu, 05 Mar 2020 18:49:49 GMT x-amz-cf-pop FRA2-C2 accept-ranges bytes content-length 43 x-amz-cf-id Wyt_UCPlM0fFTSodWVHbyaL-3bXdMqQzTk8396SLwRHTlRCu3BL-SA==
POST H/1.1	200 OK	cookie_sync Show response prebid.pub.network/	1 KB 536 B	487ms 119ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/cookie_sync Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash 4c0da6452d49460747dfb66e407c09e8b68032777f0760b5c3ac259b1697535a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 255 Expires 0
POST H/1.1	200 OK	auction Show response prebid.pub.network/openrtb2/	143 B 430 B	882ms 504ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/openrtb2/auction Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash b52be4130348e985e420d987aeabb58ea7be93e14b32ce1645a84ecffee0c456 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 149 Expires 0
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 576 B	271ms 230ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=88fb4ede-d9df-4cf2-a23f-d903d8d57192%2C135333fa-c6e5-4e8e-906a-b4d971a0189c%2Ca004a281-1460-4018-b440-ab52167d0107%2C45ee20d9-5ae8-4ea4-b8bc-640877f88bd3%2C20cf9745-f994-405d-af70-ac32d5e08b52%2C8ef30309-adf8-48aa-b57b-51675dede456&nocache=1583512811360&pubcid=0c545dfd-31e7-4db5-af84-6a0ad0ef8d6d&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%7C300x250%2C300x600&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250%2C540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash 5a5489d5fa9594f6b44679685faa0a4cb8de82c554ad60cd10d76d28a9848991 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:11 GMT content-encoding gzip server OXGW/16.176.2 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 164 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 653 B	314ms 22ms	XHR application/json	35.157.197.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.197.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-197-2.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:11 GMT x-auction-status 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	522 B 712 B	14ms 14ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 9d4cd41f54a5c28e7382e0c83998d418a244963a4748549032cd28c1a53edbaa Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:11 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 522 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	730 B 1 KB	326ms 39ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 46f42d92d9cfb52c7cbbf455b83e5a5b18eaef4407c1ca1722f7ac2b7fa073d2 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:13 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.181:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 8853dacc-9102-4c34-b88a-2e1092284bc2 Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=132c7398dd91680d;misc=1583512811368; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	0 0
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369	0 -1 B	1169ms 105ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369	0 -1 B	1170ms 106ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369	0 -1 B	1169ms 106ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369	0 -1 B	1170ms 107ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369	0 -1 B	1180ms 116ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369	0 -1 B	1170ms 108ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369	0 -1 B	1180ms 117ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369	0 -1 B	1166ms 104ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369	0 -1 B	1181ms 119ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369	0 -1 B	1167ms 105ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369	0 -1 B	1181ms 120ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369	0 -1 B	1181ms 120ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	730 B 1 KB	360ms 39ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 3b1510279670ad141570b3a32b4bbcc513fb84e869a895007d84b86a11eecb37 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:13 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.138:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 78916bfe-8577-427c-812e-dcf2c7b45da9 Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 997 B	552ms 250ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2285c17462c3aa605%22%2C%22imp%22%3A%5B%7B%22id%22%3A%228646924514c4cec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2287d69536a2e6a52%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2288c1e088a3cf664%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2289f38de7c9f0a48%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2290c2e7f3e1150b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229113124e44f085d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229255450d0961b0a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22939cf0c7b54f4f8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229460f4d95282ee2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2295c56d1472d2e91%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22967ae9c9bee0acc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22974332ddf96cbfd%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229826f0743e56f9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 814b12aec12813f8fe4c97fde7c7a53b42a2c690ddc2ab2fd1d477212d34573f Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:11 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Fri, 06 Mar 2020 16:40:11 GMT
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
POST		v1 dmx.districtm.io/b/	0 0
POST		v1 dmx.districtm.io/b/	0 0
POST		translator hbopenbid.pubmatic.com/	0 0
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	85 KB 15 KB	569ms 568ms	XHR text/plain	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1625500716952767&correlator=770615904825621&output=ldjh&impl=fifs&adsid=NT&eid=21062414%2C21062452%2C21065138%2C21065393%2C21065432&vrg=2020022701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200306&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_1x1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1%2C300x250%7C300x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1583458531&dt=1583512811746&dlt=1583512809155&idt=866&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C1082%2C1082%2C268%2C800%2C1082&adys=146%2C6030%2C327%2C1136%2C4599%2C6536%2C1661&adks=960084856%2C976516616%2C771041174%2C2389526111%2C4047242158%2C2635258439%2C523518761&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&dssz=58&icsg=175922036613120&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C1200x90%7C306x250%7C306x250%7C834x90%7C1600x6537%7C306x250&msz=1170x90%7C1170x90%7C306x250%7C306x250%7C834x90%7C1600x1%7C306x250&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&fws=4%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash fa56c5e2168aa9569f4557dd037cde9cb5076f259418c1d04d69776fa5bc64ce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:12 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14543 x-xss-protection 0 google-lineitem-id -1,-2,-1,-2,-2,4893662829,-2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -1,-2,-1,-2,-2,138254592126,-2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2020022701.js Show response securepubads.g.doubleclick.net/gpt/	69 KB 25 KB	33ms 33ms	Script text/javascript	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022701.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software sffe / Resource Hash 8b81c098f8cd1362848b2d9b10a139bbf07ed1aa0411712c7d502d31a1734506 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 27 Feb 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 25762 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:11 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	7ms 6ms	Other text/html	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers
GET H2	200	connatix.renderer.infeed.min_dc.js Show response cdns.connatix.com/p/1910/min/ Frame 31FB	724 KB 190 KB	24ms 22ms	Script application/x-javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8bbc9fd047c4e7eb094e4e9dc9c9c648400c8fdc7e17c012ca7bbb746747a20d Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip age 76607 x-cache HIT, HIT status 200 content-length 194364 via 1.1 varnish, 1.1 varnish x-served-by cache-dca17729-DCA, cache-hhn4046-HHN last-modified Thu, 05 Mar 2020 19:17:29 GMT x-timer S1583512812.307045,VS0,VE0 etag "501814885aed3a8b2c73a57c308cfd37" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31557600 accept-ranges bytes x-cache-hits 1, 27331
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	7 KB 5 KB	17ms 17ms	XHR application/json	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200303&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 27a6f2b635710c5056f7398ce0d36dfcd2093ddbae1722cd8fc49f46af4135f9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5232 x-xss-protection 0
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	14 KB 5 KB	40ms 40ms	Script text/javascript	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1582746470043195" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5456 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:12 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame A564	200 KB 55 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2121 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame A564	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2121 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame A564	16 KB 6 KB	9ms 8ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e2c83987a64881c948026b94a025613e0b23e00a7dd45a2160697c59ab29eead Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 18116 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5731 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 11:38:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c74b1adbb57314b7" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 11:38:16 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame A564	92 KB 28 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2330d883dd19a510c1f22595372339a0d087b268c122e0ce88a117077fe9512e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2113 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28193 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "7a316e35698494ac" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:59 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame A564	3 KB 1 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b9acae2affd2b439257a9a6d6cb05b3b11688e46f4372171a33b93019c255887 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2100 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1402 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "6ab65d382fa06140" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:12 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame A564	46 KB 15 KB	11ms 10ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e547999f1ea38d895bb9d1e6aea9c9fc709ebea2c5353083ef7cf8e6022078c5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2102 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14840 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d7a69f9de78cc680" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:10 GMT
GET DATA	200 OK	truncated / Frame A564	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 31969bcca316f076f0d60348a867d7ce422191633595ef29cfd7ba31c3afac58 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012002192257490/	20 KB 7 KB	13ms 11ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e6e4151723a408b5ac112d5a5418d57da536b66eece45b0eb6b654fa4955c85a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2304 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7147 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:01:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "5f4d41a8d71ac199" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:01:48 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	65ms 59ms	XHR text/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&pid=virhXv9ipWySr&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:12 GMT via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id IhsTc1xGV0Fqlv_QwJ8dKqvh6vpGlttFB_LM-wm_77QHg9_A56IDTg==
GET H2	200	7157410355915222721 tpc.googlesyndication.com/simgad/ Frame A564	58 KB 58 KB	14ms 10ms	Image image/gif	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/7157410355915222721 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5fce856044b90985f1f55e425a3da9d4048106a2d341b08d25b1843bfaa5d211 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 04 Feb 2020 03:41:56 GMT x-content-type-options nosniff age 2725096 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 59611 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:20 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 03 Feb 2021 03:41:56 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A564	2 KB 3 KB	13ms 9ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19874 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A564	295 B 367 B	14ms 10ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13491 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame A564	0 0	40ms 37ms	Image text/html	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CBFKk63xiXtz3MsHL7_UPwOap2ALr2oS0TcDGwLGYCYr8_MrZDRABINrXxTlguei-gNQBoAGrkPPsA8gBA-ACAKgDAcgDCKoEvwJP0ArqgWbH4bXZCkBEWOf5aACnfNFxpbUKQcU7z6jJxlPmOMTgL21aVfNHNIfp54izeSLcMLKuDMJAZYyFY3ovbe0pKFp3pe7Ikbmqn8CLpW8ui5NnJ3DFu2z0lgZsLVIrZwHExlC5-acl_owq5PE1HnokiTE0Hl7_zrV2ghcpuxz1SbV2oPmtJGnyueDiBUEZTgNh0ajwV2kxSHuVZydlNqmz_-oHx_qbGYW2ntZFZlo4vrcoonkw3TrLqKRVLL0x81m8UrMWibc_SF-EitPD2JVqyenBs7AYLvM-jOCuEt8bkIhoBgr902unnbp1bnMWiKHqMho1E1j1IhsRCRJJl_D7mgEmHXy8exHtDECt4xFyFm3QZpQ0JOXYmT1OvU89mhzDVP64aGs7G-6Ww4KHKOsYjIjW9jhV5wUTmKtjwAT_x5m2SOAEAZIFBAgEGAGSBQQIBRgEoAYDgAe974wTqAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfy2RuoB6a-G6gH7NUb2AcB8gcEEOTkB9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTAg&sigh=yc_EGEGpxCY&tpd=AGWhJmvh_VZzpEDkkTEvBNUUk_2EicnSJyeEPHIalUsl5Ivs7w Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame 9CA1	200 KB 55 KB	12ms 9ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2121 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame 9CA1	200 KB 55 KB	10ms 7ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2121 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 9CA1	16 KB 6 KB	9ms 7ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e2c83987a64881c948026b94a025613e0b23e00a7dd45a2160697c59ab29eead Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 18116 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5731 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 11:38:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c74b1adbb57314b7" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 11:38:16 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 9CA1	92 KB 28 KB	13ms 11ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2330d883dd19a510c1f22595372339a0d087b268c122e0ce88a117077fe9512e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2113 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28193 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "7a316e35698494ac" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:59 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 9CA1	3 KB 1 KB	13ms 10ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b9acae2affd2b439257a9a6d6cb05b3b11688e46f4372171a33b93019c255887 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2100 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1402 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "6ab65d382fa06140" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:12 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 9CA1	46 KB 15 KB	12ms 10ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e547999f1ea38d895bb9d1e6aea9c9fc709ebea2c5353083ef7cf8e6022078c5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2102 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14840 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d7a69f9de78cc680" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:10 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CA1	2 KB 3 KB	9ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19874 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CA1	295 B 362 B	8ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13491 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
GET DATA	200 OK	truncated / Frame 9CA1	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a562e8b53d2dd2d90d1f1f48927f7147d6ba08e71fa53eb436e9a0cfd4bb8ab1 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame B9E1	0 0	36ms 35ms	Fetch image/gif	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu0qc5oz_k13Z6DunwwWMulXuGkfx7KgY9ylT699dwVsaq1NED9TLUitNnvT5u4KDArWWQX0A5wocgLYyFQCRHaUF9tCOH5ot5cNOLjPEJcxYMZPwjJTdaNU6bALpPWj-U523yyjZeAum6_qvK_qqVwbdziI7tmF4A4aghSEYkaEpFfskz6Nf6ioe01x5eXj4uJMvkCzY3K3BL8thbmxihOxfbxXLJLfQhomd1bXcsCQ_X2WwXFkXm_jGJ9yyAdSbPFj6qMcD_I6RLVHZ0Yj3MKk2RWlQTtmwZr&sig=Cg0ArKJSzGZbexTGLu7PEAE&urlfix=1&adurl= Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers timing-allow-origin * date Fri, 06 Mar 2020 16:40:12 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame B9E1	73 KB 28 KB	16ms 14ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 31eef561438773aa8905d73dfe2e8400eca13620146d6235c6e019a828bd33fe Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1583324508270956" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28126 x-xss-protection 0 expires Fri, 06 Mar 2020 16:40:12 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 377 B	60ms 57ms	XHR text/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&pid=iT5A3OHC9rmQC&cb=2&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash 5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:12 GMT via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id FhE9odzhs55yfLV7xPZMgVqmvUmrjSD1jeWKUJCVvzJa498K2Ttv6w==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	62ms 59ms	XHR text/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&pid=0BJq5BuEWamYV&cb=3&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash 1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:12 GMT via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id 2HmYI241FhHKdDmX3TK2spOoNDTxk_XtwUrFD5Mje_342_JmNxX_8A==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	62ms 61ms	XHR text/javascript	13.224.199.29 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&pid=jvzh23va82YJa&cb=4&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.199.29 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-199-29.fra2.r.cloudfront.net Software Server / Resource Hash 6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:12 GMT via 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id 0gdfxb7KMNbP5bZRPicJCphJfGCHAffxjmJtuKx5dSw0zcPAIiYnwA==
GET H2	200	13721723812632313485 tpc.googlesyndication.com/simgad/ Frame 9CA1	67 KB 67 KB	7ms 7ms	Image image/gif	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13721723812632313485 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9a0a1e156f835a74a70bf8e11d739e19fe84afc1553a201882b7f0705f39a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 03 Feb 2020 23:29:41 GMT x-content-type-options nosniff age 2740231 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 68538 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:28 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 02 Feb 2021 23:29:41 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 9CA1	0 0	35ms 35ms	Image text/html	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C7qAu63xiXpn6MsHL7_UPwOap2ALr2oS0TaDFwLGYCYr8_MrZDRABINrXxTlguei-gNQBoAGrkPPsA8gBA-ACAKgDAcgDCKoExgJP0BdFSF0mxZz51ZBamjznjBV9NjDe9o4_NCY1HApbVnMhi8b2sL8vSPcSH3q0tkYF83Ly-wZOIyHAuNDt9WXNRk894fTuDxtkozt5ytFbGGm92NU2vkQW67xw6fqngAeB3V9F5B6XVBdu-zZFW4fUWMOdQjnPMGlqax6p9OsRX5KbuHURRidWgA-fgdY1zfthd0Fscj_WzUoZJe9cRXzSzWvru5D1XbN22MLumIZ97MHBvQkvPzYD75azOscgk0_GEVeQfAt5k2zZJcpj1AxCyD2IdyGe2H99LA_Yqxzo1oZRSyPfED4E7zsVvzbYc1h6NfKdvJH0cwBMi0IwEgbbaoYgguRtNspg1tK0YhlExnRvB9wsGRIr3xFXN0DvZ4Wfc7vlTXPue_bCHXZEjgdHayASgFBQHUqutqjQZQZO8Q-A_kdWWcAE_8eZtkjgBAGSBQQIBBgBkgUECAUYBKAGA4AHve-ME6gHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8tkbqAemvhuoB-zVG9gHAfIHBBDGyw_SCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTE3NDIyNDk2MDMyODkwODOACgPICwHYEwI&sigh=5a_E_gjsKUs&tpd=AGWhJmtE8fLEtctVswOXpqZ1FBV2oqhBR21aRtDItx4n9ClH5w Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	g Show response ck.connatix.com/	46 B 235 B	1070ms 23ms	Script text/plain	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ck.connatix.com/g?callback=cnxJSONP_5e4fd900d42192674cad1583512812457 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 77d3c678c4ce72d7f60c2c93fc6ea6d89b7dd1fbe742119a698f994e38f4e64c Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish server Varnish age 0 x-cache HIT status 200 cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1583512814.514184,VS0,VE0 content-length 46 retry-after 0 x-served-by cache-fra19128-FRA
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/209/ Frame 82BD	0 0	13ms 13ms	Document text/html	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/209/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html content-length 5727 date Fri, 06 Mar 2020 15:33:00 GMT expires Sat, 06 Mar 2021 15:33:00 GMT last-modified Tue, 25 Feb 2020 17:32:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 4032 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame A564 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	14ms 14ms	Image text/html	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Fri, 06 Mar 2020 16:40:12 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	479ms 119ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash ceea09fab40faa503186aff0a5aae8d038fc3d5588669590f032b79c8d990edf Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:13 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 9CA1 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	15ms 15ms	Image text/html	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Fri, 06 Mar 2020 16:40:12 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	0 0
GET		ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369 adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	0 0
POST H/1.1	200 OK	auction Show response prebid.pub.network/openrtb2/	143 B 431 B	384ms 384ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/openrtb2/auction Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash beeb78dbca5a0e1a8e98175c01bacc82a641d6bc607d07d0d9e63047f8dbc1db Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 150 Expires 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET		v1 btlr.sharethrough.com/WYu2BXv1/	0 0
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 371 B	177ms 177ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=d2181914-fd7c-46c3-83f3-e40f4a0af4ab&nocache=1583512812622&pubcid=0c545dfd-31e7-4db5-af84-6a0ad0ef8d6d&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash ee2ba2d98adb20130680658aca64b6a9a045635b6b42cb73d4d43f680d171d66 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip server OXGW/16.176.2 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 446 B	77ms 38ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Fri, 06 Mar 2020 16:40:12 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 56fd84672b049d5a-AMS access-control-allow-headers origin, content-type
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	27ms 27ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 3d5b433eaf2ee25a5358822f59a9e2d44058d8a41f4355ecd79620f2a0bc6b60 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.40:80 AN-X-Request-Uuid f6e55262-369e-4d94-9e83-a35659f0716f Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 333 B	22ms 22ms	XHR application/json	35.157.197.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.197.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-197-2.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT x-auction-status 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 122 B	82ms 47ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:12 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com
GET H2	302	ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1...	0 -1 B	105ms 105ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1...	0 -1 B	106ms 106ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1...	0 -1 B	104ms 104ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	13ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash cc889f2598e62e3aff5985b1b46c4baff3edc6e029d83b126c9dcf523b4376ee Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 1 KB	150ms 149ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22176230a853e38144%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22177816119135bfe5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22178310d5526cd303%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221798686da6dd59cc%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cd30e9898237b185a59cf657806616754911c98e1ed0567aaecbf4d706c95b37 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:12 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Fri, 06 Mar 2020 16:40:12 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	51ms 27ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 052604b849b4945ae574bff2b2868a926eb1d1b454ee350b9bd3c4f72ea3f249 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80 AN-X-Request-Uuid 6067fc3e-0dcf-40d7-9e01-6dc01fc5eedf Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	13721723812632313485 tpc.googlesyndication.com/simgad/ Frame 9CA1	67 KB 67 KB	5ms 5ms	Image image/gif	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13721723812632313485 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0f9a0a1e156f835a74a70bf8e11d739e19fe84afc1553a201882b7f0705f39a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 03 Feb 2020 23:29:41 GMT x-content-type-options nosniff age 2740231 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 68538 x-xss-protection 0 last-modified Thu, 05 Apr 2018 11:07:28 GMT server sffe content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 02 Feb 2021 23:29:41 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CA1	2 KB 3 KB	8ms 8ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19874 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9CA1	295 B 363 B	7ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13491 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 49 B	18ms 17ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200303&jk=1625500716952767&bg=!2Nul28NYTR30S6OCW0kCAAAAPFIAAAAKmQFkvevKEZh2QIEcMpQM1x_vnACrdj1fGG-rPFAvHDLQu4d5qOQK69o3qARmkAIRi6k7DTZUGfRVTT-mgwsn5brIsc9HmIGUEoEd3q6TiX6UK_oxNKJUPKT7nIcRuKjD9yY78Kz3rCRsTSf2y2KWHQQn4Bjpg4k3xM50C-3gqVtSYs1uJInd7Z2EbzUctauvgLCBNXgOW3H-e36N1vwHhYC_KIhvLul8OBrRaFmn-9ng6WGwQb2Q87WTzydQP6ahq1kX1DU6Whcet9X6mk4mc0hIAy5IkcEIFnEYqOkw01fp2ha-Gh4E3Tqg4L528QIII2133uiMkAb7JEkggzwGhZ7BPkCzmE6H-JPOo3a7xjdK8_DLIVJ9SdLrkfGZeXlCeuYRuHwQSFkO6G9wrSwEPY-hGd1WmVzJOPpKhfOUkO0Ezl81fzCVY7-OlJz0evp7o7pU7aZ52cPib_xJuhYfMn4Ho4Kp2QI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	605 B 759 B	137ms 137ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1A26787202-5fc9-11ea-b294-125139b028ba;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=28161850242c3f91;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 0ed0e2c0528350f6c8f7a1ee6a75e5b70acd399937bf18b4ed80583a921f07f2 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	606 B 742 B	144ms 144ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1A267894da-5fc9-11ea-8843-12bf237d14d4;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=279ade53db86832a;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash b310efce55be360726a67f8ca38ece737b3d59dd399756ef47ec1ccf03a6baab Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true accept-ranges bytes content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	606 B 736 B	141ms 140ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1A2678ae16-5fc9-11ea-b8e8-1249c31fdca2;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=280ed01e33f8b541;misc=1583512812625 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash d9773c354c6bd029f70a0a8fc0159ef44935efae5b100297f66b26c38bd44f70 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H/1.1	200 OK	auction Show response prebid.pub.network/openrtb2/	142 B 430 B	221ms 221ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/openrtb2/auction Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash efe68b18d2248a236cba72a37e18db9f007e7581b68458cde1298358db5cd258 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 149 Expires 0
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	13ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash a295058695cfc4cd7e8590abd01b633c09632ca2854e639db95a95f4b3855753 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 66 B	42ms 39ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:12 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com
GET		fastlane.json fastlane.rubiconproject.com/a/api/	0 0
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	89ms 88ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=55049cea-a576-4a20-b4bb-b1fb18c87e22&nocache=1583512812872&pubcid=0c545dfd-31e7-4db5-af84-6a0ad0ef8d6d&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_2&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash 5808f5f66993a5df3d9a121ac17eda1a16292cb098e1097bd97ba50c1e509f65 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT content-encoding gzip server OXGW/16.176.2 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 874 B	101ms 99ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22196f8a59cf0b57fc%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22197ab00492e82529%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2219846b7ea2a242c1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 09c258b9597f703d8e2f6dba681d34b5f6bc512879cbb1b616845e83375ffd63 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:12 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Fri, 06 Mar 2020 16:40:12 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 349 B	23ms 22ms	XHR application/json	35.157.197.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.197.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-197-2.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT x-auction-status 12, 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	52ms 51ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 4d785129b6b136ccc931a8fc41d6b8e9f412bb5c17d4661a4dc52dba3c0d58df Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.249:80 AN-X-Request-Uuid 1e219faf-c4a2-4eff-a08e-dd9d46d7a6ab Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	83ms 31ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash c0b8b605e8017be3081d28b03e63e4357b86f85697a83dac69aa1d0fcd442aa9 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.184:80 AN-X-Request-Uuid ece38d63-fb82-486e-a43e-32f9442bdfd6 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=282c9eee1daaa3e2;misc=1583512812877; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	606 B 760 B	394ms 394ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=282c9eee1daaa3e2;misc=1583512812877; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 976d0a974a81d11000edab5bd4763c1ed3fb7aad9b032d491708b4c547f63a87 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=283deb1054b53db4;misc=1583512812877; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	606 B 736 B	135ms 134ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=283deb1054b53db4;misc=1583512812877; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 2e9da9dfbbd88131c9f9b93b9f62f092eccbecef76279efd6f2f58c71742b6b9 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:12 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 39 B	41ms 41ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Fri, 06 Mar 2020 16:40:12 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 56fd84688c2f9d5a-AMS access-control-allow-headers origin, content-type
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	1068ms 21ms	XHR text/plain	52.58.68.236 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=2159f6e10241f7c3&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.68.236 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-68-236.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	1068ms 22ms	XHR text/plain	52.58.68.236 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=216ebccb96ac56da&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.68.236 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-68-236.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	154ms 117ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash ceea09fab40faa503186aff0a5aae8d038fc3d5588669590f032b79c8d990edf Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:13 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	pls Show response core.connatix.com/ Frame 31FB	8 KB 3 KB	319ms 110ms	Script text/plain	34.232.159.154 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://core.connatix.com/pls?callback=jQuery32106375831695548586_1583512812455&token=83c6e833-8c07-474c-b10f-079d46320a80&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&c_v=1910_1_0_0_0&page_guid=1e4f96d668aae438b51d1583512813530&spp=1&_=1583512812456 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.232.159.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-232-159-154.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 0ba425dd34ea247563c0a6a2245dddec4d840748e0433f2bcd928f3553a7be17 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 200 date Fri, 06 Mar 2020 16:40:13 GMT content-encoding gzip server nginx/1.15.9 (Ubuntu) access-control-allow-origin *
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame A564	42 B 110 B	47ms 47ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsspsI-V_CHHdxVs4IcUhdSd73LaMgTOPUgIvZ92dh6JiUx-pnlRzQ-awDNEEwuvb6LZQATlY-LyPBNMZ9xU59HzCCf_j0MOnTLsiTD9flyxi0Rt61y4xafEUe8f2w&sai=AMfl-YTdJufvFi7zbrdU6lZcl2jxbrePnxrkL2uaAI6JvPvCNY07l1cQmYRcEnK-_HzhDlXIXatvnvMqCGld81jR3udpc8oDvwF35j0D7rWq0fqRUNqUp0OGjZ_kUMkN&sig=Cg0ArKJSzGVAlpcJSUtdEAE&cid=CAASF-Ros1_lRYnZBYD7uYV8b4KQjpM26qRI&id=ampim&o=436,146&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=206&tls=1207&g=100&h=100&tt=1207&r=v&adk=960084856&avms=ampa Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 9CA1	42 B 110 B	26ms 25ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstUcJpkQHqEmN5cwZoWLkttDt4mKTG5BDnYn0PHWvfjtls7xG4WSwVnA2uP8mKigIGgd1sgobQ9nnXw8D27ildVO3KxrsguaairmT0GTWzGt2Cw5CWML1U_SGsaNg&sai=AMfl-YT4DdBOrG8zK9_Sf_kM8nTQQlyGEMf58JHDXhdjWs6dOmRAPn7fEdPOF5m0jDtQZlfeJ0IzaF_zDiYAcedEDZXZ1EcCEb5c5ScZiPBzL-3J-XvspWIBn24TldhJ&sig=Cg0ArKJSzGqyXB4lQRIeEAE&cid=CAASF-RoqEghJ7LNe7QsTQ1cNK0jHEEtcjOX&id=ampim&o=1082,327&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=125&tls=1125&g=100&h=100&tt=1126&r=v&adk=771041174&avms=ampa Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	auction Show response prebid.pub.network/openrtb2/	142 B 430 B	207ms 207ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/openrtb2/auction Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash dab5953bbe52642bd742f75ccc3a8aa9380e48c7e14e534caf2ecd861947d472 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 149 Expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	34ms 34ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 187382f4b5e70b94b2ea14da639e2524caeed77882d603f88c066f5c75691ae9 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.133:80 AN-X-Request-Uuid 86032f40-e306-4126-bc56-06584ee50369 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 4ef5c1d20e1ec3d7164ffa2ce160317fe9f9153f261fd95869fe77d994826b87 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 285 B	29ms 29ms	XHR application/json	35.157.197.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.197.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-197-2.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT x-auction-status 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	30ms 30ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash efdef0c6cecb63a246ea0aedd8436f3009b9dee723aca14374523b6879ce483a Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.83:80 AN-X-Request-Uuid 1a7f7fd0-5909-405f-ab38-8cafac033f5e Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=2849ee49c281cc6b;misc=1583512813825; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	605 B 736 B	137ms 137ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=2849ee49c281cc6b;misc=1583512813825; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 912fb04589af4f0fd086156836782383a86ded415684f3394c1537cd4766dfc9 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 605 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 372 B	129ms 129ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=0c1b455b-1d8e-4fa6-b3d1-1be943e073af&nocache=1583512813825&pubcid=0c545dfd-31e7-4db5-af84-6a0ad0ef8d6d&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90&divIds=bleepingcomputer_728x90_320x50_InContent_1&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash 4a26772d5f333d2f3bab04046bac78bfbd6a202dada8036ece459d33305357f2 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT content-encoding gzip server OXGW/16.176.2 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 166 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	121ms 23ms	XHR text/plain	52.58.68.236 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=2358760e77737ee8&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.68.236 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-68-236.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	240 B 2 KB	759ms 89ms	XHR application/json	69.173.144.143 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=0c1b455b-1d8e-4fa6-b3d1-1be943e073af&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9444466531403763 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 8f3909867b21aad0ad97aaa936874c2a2e5b453775d60141122b1df38e845b0d Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=397 Content-Length 240 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 66 B	42ms 42ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 994 B	82ms 82ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%222405de6a3e919d89%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22241649ee25ee2b88%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b00facbf1761ee625899657a569a747a8623362899f5e0fd954d534bf333dc73 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:13 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Fri, 06 Mar 2020 16:40:13 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 168 B	35ms 35ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Fri, 06 Mar 2020 16:40:13 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 56fd846e79649d5a-AMS access-control-allow-headers origin, content-type
GET DATA	200 OK	truncated /	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	g Show response rtb.connatix.com/	148 B 327 B	454ms 144ms	Script text/plain	52.45.175.234 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=469&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&c_ivt=0&connatix_sess=WbZCEUL__vjtqfwzNddvNoW3u1jXWHOEjC1VI9MK70rHSQ_Fc4azH_HRWdzhA3g7DndRqxORMJvIvfndHPqB7YL_XpVWWZiaKnymdyWldIUqljYqwkvy-l8ddPxurfFAadlehkbU1kwvBEHw4X6O5ROWxXdeaoZORH_-LLM3TqmT0D8s_DC3t-2jAXE85tNK&notServed=false&xplr=true&c_s=false&c_pl=nEQljWeIpeIng9bZOSVNJRKTicVLl2I0ELQ7dEw1B4Cuql1qQ-IbZIqbpIiZclim2Po0ey7stbbHYb7IUNK8c0NyOSU6Ye3eYBAPoMPKqKojWQ8fRRh8pCba4Je73vSTRRWqLDlyR7stLvVm_NVeGE3JWCniwy7scc-tMDhLyNlLVNOMyu8rfyT0B2u__Z2lrh_9KeHwlY_JV2mhFIOp_nnrDmjcHtuewNhQgUgaquEVvfBoHWj3v3g7wJDUWKe0g1aqMwXXM8yZehc81UOw4Q&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=0&v=1&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronaviru&c_v=1910_1_0_0_0&spp=1&callback=cnxJSONP_e9e84c5e43f1932e02231583512813921 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.45.175.234 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-45-175-234.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 68ff76483aa880786daa9c818aed59f64584564e85832a618ddc71d0c49fcb0e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Fri, 06 Mar 2020 16:40:14 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 139
GET H2	200	409.jpg i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/	21 KB 22 KB	31ms 28ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/409.jpg?mode=stretch&connatiximg=true&scale=both&height=469&width=834 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 480038c3698794bd3e7c83d6ac884ea09f83843292ef0d24fcd0b3cc67e3a7fe Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.933093,VS0,VE1 access-control-allow-origin * content-length 21991 x-served-by cache-sjc10023-SJC, cache-hhn4046-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/d488ddc2-2ae2-41a8-a8e6-f9e124b510f2/	26 KB 26 KB	37ms 34ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/d488ddc2-2ae2-41a8-a8e6-f9e124b510f2/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e200e35e4ab3a0d5a5b8402cd178a5244b2b48844733609ef8c973521eb647ee Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.946072,VS0,VE1 access-control-allow-origin * content-length 26935 x-served-by cache-sjc10042-SJC, cache-hhn4046-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/50e55a6b-cd7d-46ca-8b3c-21f7cf9df461/	35 KB 35 KB	45ms 42ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/50e55a6b-cd7d-46ca-8b3c-21f7cf9df461/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 750d8959ec4d107989f46bd3f85b8a13be82f2c790151c75f31daa34af8fffdb Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.946089,VS0,VE1 access-control-allow-origin * content-length 35528 x-served-by cache-sjc10028-SJC, cache-hhn4046-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/a56b8e37-7e6c-4935-8c68-e54479b36c49/	28 KB 28 KB	28ms 25ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/a56b8e37-7e6c-4935-8c68-e54479b36c49/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8cf1b63240dea032162215dcbb62d9cfa0e50f562e4288f8229116325aa3cc80 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.933069,VS0,VE1 access-control-allow-origin * content-length 28552 x-served-by cache-sjc10033-SJC, cache-hhn4046-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/8983f1b2-7aea-4ee3-89d5-74a67ca85cb4/	20 KB 20 KB	30ms 28ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/8983f1b2-7aea-4ee3-89d5-74a67ca85cb4/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 7a993f70fd619515279cf74456d2a9d4b14821135a1c4c681792da35de3a0753 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.933089,VS0,VE1 access-control-allow-origin * content-length 20849 x-served-by cache-sjc10035-SJC, cache-hhn4046-HHN
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/84704ad0-60ee-4612-85f3-bd710e62924c/	59 KB 59 KB	30ms 27ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/84704ad0-60ee-4612-85f3-bd710e62924c/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4f46f43cce331f802f78998127523cdd086f37915f5b386b85ff8e50477dcee Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 51519 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 1 accept-ranges bytes x-timer S1583512814.933118,VS0,VE1 access-control-allow-origin * content-length 60285 x-served-by cache-sjc10034-SJC, cache-hhn4046-HHN
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56e644a617b2d1e4e7d808dfc334a7ea8622979f22999dc9eccd21c61958b3 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT cf-cache-status HIT age 119763 cf-polished origFmt=png, origSize=15281 status 200 content-disposition inline; filename="bleeping-computerlogo-lg.webp" cf-bgj imgq:85 content-length 7156 last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 56fd846f1ec4bd59-CDG expires Sat, 04 Apr 2020 07:24:10 GMT
GET H2	200	0_th_1.jpg i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/ Frame 31FB	23 KB 23 KB	24ms 23ms	Image image/jpeg	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/0_th_1.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c3034d0370c5faa09e7a8d7b0c48925afa0371cf17e4827dde23059f56019dae Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 16:40:13 GMT via 1.1 varnish, 1.1 varnish age 16563032 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1583512814.963768,VS0,VE1 access-control-allow-origin * content-length 23507 x-served-by cache-sjc3139-SJC, cache-hhn4046-HHN
GET H2	403	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 31FB	949 B 1 KB	266ms 88ms	XHR text/html	2600:1f18:612b:4232:525a:c3f1:a5b7:d386 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-wc2tk&playerWidth=834&playerHeight=469&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4232:525a:c3f1:a5b7:d386 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 9d60ac0d334c77a039cad6f125f940635ff0043a610271fc0729d61cc9546401 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:14 GMT server Apache-Coyote/1.1 p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' status 403 content-language en access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true x-tremorvideo-status REJECTED_BY_SEAT_QPS_LIMIT content-type text/html;charset=utf-8 content-length 949
POST H/1.1	200 OK	auction Show response prebid.pub.network/openrtb2/	256 B 501 B	399ms 398ms	XHR application/json	35.226.134.247 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://prebid.pub.network/openrtb2/auction Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.226.134.247 , United States, ASN15169 (GOOGLE, US), Reverse DNS 247.134.226.35.bc.googleusercontent.com Software / Resource Hash b2aa6bef734befcea0bba7d8219c21a8c39823f7baf4fcfcb01bcf25c1489b0e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache content-encoding gzip Content-Type application/json access-control-allow-origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 220 Expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 874 B	39ms 39ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.40:80 AN-X-Request-Uuid b8cf3d90-652d-4f67-83da-dc59d959504a Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	22ms 22ms	XHR text/plain	52.58.68.236 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=2526c1a27eb22dde&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.68.236 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-68-236.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	23ms 22ms	XHR text/plain	52.58.68.236 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=2531c6c20723771&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.68.236 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-68-236.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 66 B	64ms 63ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Fri, 06 Mar 2020 16:40:13 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 349 B	22ms 21ms	XHR application/json	35.157.197.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.197.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-197-2.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT x-auction-status 12, 12, 12, 12, 12 status 200 content-type application/json; charset=utf-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=28577ff5c31b96c6;misc=1583512813952; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	606 B 760 B	143ms 142ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=28577ff5c31b96c6;misc=1583512813952; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 6cab507550e2abc8c7cd63372e64cd13b3d3de86400aac8e3608c17df189146e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:14 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=28614d8d325c11b2;misc=1583512813952; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	606 B 737 B	144ms 143ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=28614d8d325c11b2;misc=1583512813952; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash cd6fa3f67af8a589376186347092c6e3a321aa81320ccfe333bbe98d8bff6ba2 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:14 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 606 expires Mon, 15 Jun 1998 00:00:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 39 B	42ms 39ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Fri, 06 Mar 2020 16:40:13 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 56fd846f39ec9d5a-AMS access-control-allow-headers origin, content-type
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	145 B 1 KB	31ms 30ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash ffbb2b4e8cca6cd1a875ba88d4126c5c6b100467f05acb882c0b503c16ec000f Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.60:80 AN-X-Request-Uuid 1d8cf379-5573-48b0-b0a8-2884bbc6bbf3 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 145 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 95cbd796d901c1df9e620aa4b92ca960e4b6a7968e16dba5f66f4e8850a128e8 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:13 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 874 B	120ms 119ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22272dfb1d30dc461b%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22273d161a07a76311%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222744eed62807a2d5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 566159677ee4bc062b7a3b08597e54618b6d189716b97275c7b14c3abe5bfc51 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Fri, 06 Mar 2020 16:40:14 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	261 B 2 KB	880ms 249ms	XHR application/json	69.173.144.143 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=e1bd2aac-a57f-45cc-a183-93a8bde53de4&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5736045771918823 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash ed5dcd7f9b5944f2d9b83f4dfc3887e598bea7f68fff44b8e82dbf1db2f2a45d Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:14 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=162 Content-Length 261 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	78ms 77ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=e1bd2aac-a57f-45cc-a183-93a8bde53de4&nocache=1583512813955&pubcid=0c545dfd-31e7-4db5-af84-6a0ad0ef8d6d&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash 30554e1517590f08a4d94a49f08de309ac54fca3d710fd827a738b582b64b2b4 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:14 GMT content-encoding gzip server OXGW/16.176.2 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	r trk.connatix.com/ Frame 31FB	0 162 B	418ms 104ms	Image text/plain	52.23.140.165 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/r?connatix_sess=WbZCEUL__vjtqfwzNddvNoW3u1jXWHOEjC1VI9MK70rHSQ_Fc4azH_HRWdzhA3g7DndRqxORMJvIvfndHPqB7YL_XpVWWZiaKnymdyWldIUqljYqwkvy-l8ddPxurfFAadlehkbU1kwvBEHw4X6O5ROWxXdeaoZORH_-LLM3TqmT0D8s_DC3t-2jAXE85tNK&videoID=639404&c_pl=nEQljWeIpeIng9bZOSVNJRKTicVLl2I0ELQ7dEw1B4Cuql1qQ-IbZIqbpIiZclim2Po0ey7stbbHYb7IUNK8c0NyOSU6Ye3eYBAPoMPKqKojWQ8fRRh8pCba4Je73vSTRRWqLDlyR7stLvVm_NVeGE3JWCniwy7scc-tMDhLyNlLVNOMyu8rfyT0B2u__Z2lrh_9KeHwlY_JV2mhFIOp_nnrDmjcHtuewNhQgUgaquEVvfBoHWj3v3g7wJDUWKe0g1aqMwXXM8yZehc81UOw4Q&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronaviru&c_v=1910_1_0_0_0&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.23.140.165 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-23-140-165.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Fri, 06 Mar 2020 16:40:14 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 241 B	223ms 223ms	XHR text/plain	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1625500716952767&correlator=770615904825621&output=ldjh&impl=fifs&adsid=NT&eid=21062414%2C21062452%2C21065138%2C21065393%2C21065432&vrg=2020022701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200306&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D8eda4560b9b7d836%3AT%3D1583512811%3AS%3DALNI_MZKQ8QxNGt93hoWuTG1iB_Bw70FSQ&cookie_enabled=1&bc=31&abxe=1&lmt=1583458531&dt=1583512814063&dlt=1583512809155&idt=866&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=6605&adks=976516616&ucis=8&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&dssz=59&icsg=175922036613120&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x90&msz=1170x90&psts=ABP-KfTQA0vb2UAco6aZQFr5uyqh1aOZMvCUR7bMSS7xb6INl3jr5IT7RDik3vzlBARN6e6ND2QBGRAUGIOI%2CABP-KfQ1F_EDpwqiqFh3txAOEJa3&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash adfe3507463b73d3bcf523d3401da98bf2af40df3413053606fbda430a5a23d6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:14 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 152 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 232 B	438ms 438ms	XHR text/plain	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1625500716952767&correlator=770615904825621&output=ldjh&impl=fifs&adsid=NT&eid=21062414%2C21062452%2C21065138%2C21065393%2C21065432&vrg=2020022701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200306&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D8eda4560b9b7d836%3AT%3D1583512811%3AS%3DALNI_MZKQ8QxNGt93hoWuTG1iB_Bw70FSQ&cookie_enabled=1&bc=31&abxe=1&lmt=1583458531&dt=1583512814090&dlt=1583512809155&idt=866&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1136&adks=2389526111&ucis=9&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&dssz=59&icsg=175922036613120&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfTQA0vb2UAco6aZQFr5uyqh1aOZMvCUR7bMSS7xb6INl3jr5IT7RDik3vzlBARN6e6ND2QBGRAUGIOI%2CABP-KfQ1F_EDpwqiqFh3txAOEJa3&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash a1260c2554b54e6a954352d304752964731f4aa577fae79ac0ec2839c8b5fa78 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:14 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 154 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	51 KB 11 KB	803ms 802ms	XHR text/plain	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1625500716952767&correlator=770615904825621&output=ldjh&impl=fifs&adsid=NT&eid=21062414%2C21062452%2C21065138%2C21065393%2C21065432&vrg=2020022701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200306&iu_parts=15184186%2Cbleepingcomputer_728x90_320x50_InContent_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D8eda4560b9b7d836%3AT%3D1583512811%3AS%3DALNI_MZKQ8QxNGt93hoWuTG1iB_Bw70FSQ&cookie_enabled=1&bc=31&abxe=1&lmt=1583458531&dt=1583512814095&dlt=1583512809155&idt=866&frm=20&biw=1600&bih=1200&oid=3&adxs=268&adys=5174&adks=4047242158&ucis=a&ifi=5&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&dssz=59&icsg=175922036613120&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=834x90&msz=834x90&psts=ABP-KfTQA0vb2UAco6aZQFr5uyqh1aOZMvCUR7bMSS7xb6INl3jr5IT7RDik3vzlBARN6e6ND2QBGRAUGIOI%2CABP-KfQ1F_EDpwqiqFh3txAOEJa3&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash e917e79500340f9ca2eb862b3994238d4398e78b34bd9fddbe42c66e2d56a7e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:14 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 11370 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 31FB	119 B 462 B	257ms 256ms	XHR text/xml	2600:1f18:612b:4232:525a:c3f1:a5b7:d386 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-bwjaw&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4232:525a:c3f1:a5b7:d386 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:14 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 31FB	119 B 462 B	225ms 225ms	XHR text/xml	2600:1f18:612b:4232:525a:c3f1:a5b7:d386 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-nac38&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4232:525a:c3f1:a5b7:d386 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:14 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	125ms 124ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:14 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 2 KB	153ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 620f877c3c876d8901a83d911b003b2d137ba378deb55153c167f92f0cd0aaa6 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:14 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 902
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 951C	421 KB 94 KB	130ms 46ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:14 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512814.dop004.wa1.t,1583512814.cds009.wa1.hc,1583512814.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768332 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame EF7C	200 KB 55 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2123 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame EF7C	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2123 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame EF7C	16 KB 6 KB	12ms 12ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e2c83987a64881c948026b94a025613e0b23e00a7dd45a2160697c59ab29eead Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 18118 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5731 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 11:38:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c74b1adbb57314b7" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 11:38:16 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame EF7C	92 KB 28 KB	10ms 9ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2330d883dd19a510c1f22595372339a0d087b268c122e0ce88a117077fe9512e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2115 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28193 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "7a316e35698494ac" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:59 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame EF7C	3 KB 1 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b9acae2affd2b439257a9a6d6cb05b3b11688e46f4372171a33b93019c255887 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2102 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1402 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "6ab65d382fa06140" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:12 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame EF7C	46 KB 15 KB	9ms 8ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e547999f1ea38d895bb9d1e6aea9c9fc709ebea2c5353083ef7cf8e6022078c5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2104 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14840 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d7a69f9de78cc680" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:10 GMT
GET H2	200	css fonts.googleapis.com/ Frame EF7C	5 KB 776 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:819::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Fri, 06 Mar 2020 16:40:14 GMT server ESF date Fri, 06 Mar 2020 16:40:14 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 06 Mar 2020 16:40:14 GMT
GET H2	200	css fonts.googleapis.com/ Frame EF7C	5 KB 730 B	17ms 17ms	Stylesheet text/css	2a00:1450:4001:819::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Fri, 06 Mar 2020 16:40:14 GMT server ESF date Fri, 06 Mar 2020 16:40:14 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 06 Mar 2020 16:40:14 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame EF7C	2 KB 3 KB	6ms 5ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19876 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame EF7C	295 B 368 B	6ms 6ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13493 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
GET DATA	200 OK	truncated / Frame EF7C	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f2d7750c78afe35a53d2404ca3c26efd0050896729aefb638e9eb5f6d7801b70 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame EF7C	4 KB 5 KB	11ms 11ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSUAUKRAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhgIrAEQWhgBIAEtAAAAPzCsAThaRQAAgD8&rs=AOga4qnLQ6u4peBFptRtvsFo64U3N8154w Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff8d4b73a8346b4a1ebfea06de87f3e0abe4bdd93c3713fb912fa9820019a60f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 04 Feb 2020 06:23:47 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 2715387 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 4583 x-xss-protection 0 expires Wed, 03 Feb 2021 06:23:47 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame EF7C	8 KB 8 KB	7ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 07:48:53 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 3142281 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 07:48:53 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame EF7C	0 0	38ms 36ms	Image text/html	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CnlxI7nxiXubAH7WG7_UPzL-ckAOu1tWHWo2V34awCsGhj5UBEAEg2tfFOWC56L6A1AGgAY-Us5cDyAEG4AIAqAMByAMKqgS9Ak_QPdRERteY6eDt2chnvkkOaO_C5HeTuqdDR2o4kTFQDbJEuylCd_66EPvabtTV5pZ3rQr4ZWbCf5LLHi4Vhhr-6fPGr1HeI53JzCDcU8ttrp3Ea8Hy649SkQKqmMXLr48daJb6RY_UYtOZUzlO3E-Sl8TZrXg3PLL75GErOf9-VhxD5NZfmzbvgW34cN7cR2EBMPR93PnMM4oGfcIS1bONN_gxhz2cZ9NKO-wDlue_CPk8FLR5u8KKkhyTMVKTGhGKmeFhUOKQLjN7b_VRArGkPFVcxcV0pfAdDpaGaSksDCpSMvgFuHUAkstk-5KRBuNGcXMsjLBQ1aiy4Z6jCxuuKuSFAJy5UJDt1A7HKyMCVJrafYN2_3vV-mvYoqA2nLzj_tPtBx9fHsoui5ZYLJ0yLSWEN9mfHiWHlY4ywAS7ws2htALgBAGSBQQIBBgBkgUECAUYBKAGN4AH2evMaKgHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8tkbqAemvhuoB-zVG9gHAfIHBBCPmgPSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTE3NDIyNDk2MDMyODkwODOACgPICwHYEwKIFAM&sigh=6gT6Yvnohck&template_id=492&tpd=AGWhJmvXFhaOy9uRVarKRSYwssOKhlPkSoEE1uKG1Y3xTd2jfg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame EF7C	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 719588 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame EF7C	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 134855 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/2225613035339725144/ Frame EF7C	4 KB 5 KB	7ms 5ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2225613035339725144/downsize_200k_v1?sqp=4sqPyQSUAUKRAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhgIrAEQWhgBIAEtAAAAPzCsAThaRQAAgD8&rs=AOga4qnLQ6u4peBFptRtvsFo64U3N8154w Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff8d4b73a8346b4a1ebfea06de87f3e0abe4bdd93c3713fb912fa9820019a60f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 04 Feb 2020 06:23:47 GMT x-content-type-options nosniff last-modified Fri, 22 Mar 2019 17:26:36 GMT server sffe age 2715388 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 4583 x-xss-protection 0 expires Wed, 03 Feb 2021 06:23:47 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/13256797330833292739/ Frame EF7C	8 KB 8 KB	7ms 6ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 30 Jan 2020 07:48:53 GMT x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:36:44 GMT server sffe age 3142282 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 8473 x-xss-protection 0 expires Fri, 29 Jan 2021 07:48:53 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame EF7C	2 KB 3 KB	7ms 6ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19877 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame EF7C	295 B 368 B	7ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13494 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	122ms 122ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:15 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 951C	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60293 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 951C	160 B 861 B	19ms 19ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 848e40816ca1bb30cbfebc0f23949aaa5177a6b50bd6c66d148326cf7046c03e Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.13:80 AN-X-Request-Uuid 3a4dfd7a-4dec-497d-a78f-58e0250a5726 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 951C	159 B 860 B	18ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0964f4670767063104b294edad7f1018b11d030326e9f0c661816b30b5a3f4d7 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.78:80 AN-X-Request-Uuid 9ed747a0-b2a3-4436-ac4e-fddca4573154 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 159 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 951C	44 B 667 B	75ms 38ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%22d17af7a7%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=d17af7a7-da1b-47d2-bc55-6116e9098622&pv=d17af7a7-da1b-47d2-bc55-6116e9098622&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash fea9638e775c2e737e060da2dc929ab137c28986a923ed4f5bd701bd5c2e34d7 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-8 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 951C	150 B 340 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 2436218f29dc79869e62ca6d82102cc7933bc7816599ee0e52b8711df3af2e4e Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:15 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 951C	20 B 320 B	210ms 98ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=d17af7a7-da1b-47d2-bc55-6116e9098622-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:15 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	40 KB 10 KB	651ms 651ms	XHR text/plain	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1625500716952767&correlator=770615904825621&output=ldjh&impl=fifs&adsid=NT&eid=21062414%2C21062452%2C21065138%2C21065393%2C21065432&vrg=2020022701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200306&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1583458531&dt=1583512815339&dlt=1583512809155&idt=866&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1661&adks=523518761&ucis=b&ifi=6&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&dssz=57&icsg=175922036613120&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfQ1F_EDpwqiqFh3txAOEJa3%2CABP-KfQ1F_EDpwqiqFh3txAOEJa3%2CABP-KfTQA0vb2UAco6aZQFr5uyqh1aOZMvCUR7bMSS7xb6INl3jr5IT7RDik3vzlBARN6e6ND2QBGRAUGIOI&ga_vid=275196153.1583512810&ga_sid=1583512810&ga_hid=1343790522&fws=516&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software cafe / Resource Hash e72927de6327e09e1bd60e69c56e72fd890dbeed23656f84465bdc98f545801a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 06 Mar 2020 16:40:15 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 10248 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 951C	0 217 B	113ms 37ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=d17af7a7&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:15 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 2 KB	39ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash ae793962c18bfc135abc26d8a68de01d94b6e26b162d6c47ff7e8d7895c5f593 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:15 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 905
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 3D94	421 KB 94 KB	42ms 41ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:15 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512815.dop004.wa1.t,1583512815.cds009.wa1.hc,1583512815.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768331 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 3D94	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60293 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 3D94	160 B 861 B	86ms 86ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 8bb5f2c45e4868e3b8cb346429568a81e54cee20ae6ef79c5cb3b863f15a8ded Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.49:80 AN-X-Request-Uuid af9722c7-9e8c-431a-939b-1e63cfd9e446 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 3D94	160 B 862 B	20ms 20ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e921b11551ba9ad9e06966f515258365db72f76cabe05402447ca88a7bf98d27 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.149:80 AN-X-Request-Uuid 5b6dfdfc-b8ab-4a9c-b695-a2a1b5dc1da9 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 3D94	150 B 340 B	13ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 41c96d61cecd6bddd3d9e41e2c8676be08ddba84872c2c72c9f9937ba5e08678 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:15 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 3D94	44 B 604 B	76ms 76ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%2275b19f57%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=75b19f57-12d5-445d-bca6-eb374ccf3ddf&pv=75b19f57-12d5-445d-bca6-eb374ccf3ddf&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash f6abc9984a732cf82c867d35075d73435fc7a8938db32a7b2d2abeb62769700e Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:15 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-8 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 3D94	20 B 320 B	100ms 99ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=75b19f57-12d5-445d-bca6-eb374ccf3ddf-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:15 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 3D94	0 217 B	39ms 39ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=75b19f57&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:15 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	41ms 39ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 6cc53245eba509b6a01f5c35350268c1a8cff9f5c8c04ade28f955ee06e8aa6c Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:15 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 915
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 1DDA	421 KB 94 KB	48ms 43ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:15 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512815.dop004.wa1.t,1583512815.cds009.wa1.hc,1583512815.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768331 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame 27FD	200 KB 55 KB	30ms 13ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2125 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012002192257490/ Frame 27FD	200 KB 55 KB	29ms 12ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b23c6db2aad79c099d48bac09371e980079a3995d071fa8d8c0ddf40b36a994a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2125 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55776 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:51 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ef402632ed7828b5" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:51 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 27FD	16 KB 6 KB	38ms 21ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e2c83987a64881c948026b94a025613e0b23e00a7dd45a2160697c59ab29eead Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 18120 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5731 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 11:38:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c74b1adbb57314b7" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 11:38:16 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 27FD	92 KB 28 KB	35ms 18ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2330d883dd19a510c1f22595372339a0d087b268c122e0ce88a117077fe9512e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2117 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28193 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:04:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "7a316e35698494ac" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:04:59 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 27FD	3 KB 1 KB	33ms 17ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b9acae2affd2b439257a9a6d6cb05b3b11688e46f4372171a33b93019c255887 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2104 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1402 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "6ab65d382fa06140" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:12 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012002192257490/v0/ Frame 27FD	46 KB 15 KB	32ms 16ms	Script text/javascript	2a00:1450:4001:820::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012002192257490/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e547999f1ea38d895bb9d1e6aea9c9fc709ebea2c5353083ef7cf8e6022078c5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp content-encoding br x-content-type-options nosniff age 2106 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14840 x-xss-protection 0 server sffe date Fri, 06 Mar 2020 16:05:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d7a69f9de78cc680" accept-ranges bytes timing-allow-origin * expires Sat, 06 Mar 2021 16:05:10 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27FD	2 KB 3 KB	18ms 5ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19878 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27FD	295 B 370 B	22ms 10ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003031018/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13495 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
GET DATA	200 OK	truncated / Frame 27FD	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8336b59eaeabadeca452ea6c88bc978022aff0941e6520189d21181a3f584a34 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	342695929382157241 tpc.googlesyndication.com/simgad/ Frame 27FD	43 KB 44 KB	20ms 6ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/342695929382157241?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnX5wUGpK7Pdw3wUhGlziPPylM8lg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 12d58aa8ef47f86544df8e64e81fafb00fa9669eae51a68b5060d3325d4066c6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 29 Jan 2020 23:01:43 GMT x-content-type-options nosniff last-modified Fri, 10 Jan 2020 00:59:47 GMT server sffe age 3173913 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 44517 x-xss-protection 0 expires Thu, 28 Jan 2021 23:01:43 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 27FD	0 0	48ms 33ms	Image text/html	172.217.23.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C1UNu73xiXtOKJMDF7_UPp6OBqA2djczzW8Le5PyUC5_x243xEhABINrXxTlguei-gNQBoAGY1_P8A8gBAuACAKgDAcgDCKoEuwJP0F4NfiD-I4NtXkUDP3EEXSON2s1wVh9RY0qRr_-q_FYHE4F6TweFtPVx8RXSUo5DJBG5r26yAue1YQ99_JYEhg2QmAdw09SMBpSxF9SBrxhaE7E8ir56jawGByEret84oPqaUgjM4oudWD6Pu6UTfvTNwWNLuS0Yzmdg8gTDw_61crE8-lrBBnpfYCykwPnkEJXY4PfEUsY-9Ol9OZb30LAIJq18Iu4zzeCgKsPhkI7DmlTepENW7-5df0_sjx-1rptN6n8Bby8vJvOvl7AmpMuafPa7CIjq94IbFGR20mrHSHLd-9XaFb4tWgw5dspV935piRKnW8vSRQieuiUb0hHnlpDfQA7QhY6X7cOwr-T3mA6TK7VNMZ4fASE05DPSKAF9C8GlFs7h22YJQa_y017JSjZFUA1r49_ABJmwva3XAuAEAZIFBAgEGAGSBQQIBRgEoAYCgAeLyKZ5qAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfy2RuoB6a-G6gH7NUb2AcB8gcEEOOfA9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTDQ&sigh=krpRkp9Ewhg&tpd=AGWhJmvjm-Dej3SjnZu1_Y7lVzBXr2GW7TrpXcajKBx6Tid6GQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s18-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	120ms 120ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:16 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 1DDA	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60294 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 1DDA	160 B 861 B	22ms 22ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash b4177cac753011b7a3382ed8fa42b6bbddcca84e994bae5fc2d858c7d3b79a7d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.19:80 AN-X-Request-Uuid 407f22c6-f9a5-4dcb-be82-1969466022be Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 1DDA	160 B 862 B	21ms 20ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash c919790a6cd6990d2f176c3142beeba5aad949b0b0bb3aabca94c1da940887e1 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.184:80 AN-X-Request-Uuid 5c594132-e00f-48eb-a9fe-f3d690f014db Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 1DDA	150 B 340 B	18ms 18ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash e1d1a3d9f8123ddc6f1fd5f0a1fa04dbd803c7eb8eb883adaf3135415f10d601 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:16 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 1DDA	44 B 604 B	38ms 30ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%223dc37724%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=3dc37724-0abe-436f-8a67-a1fb983ea6ee&pv=3dc37724-0abe-436f-8a67-a1fb983ea6ee&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 3164068970144e42b67a9aeb215930d400ad76e1dea275500db37cc7ea248175 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:16 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-8 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 27FD Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	16ms 16ms	Image text/html	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Fri, 06 Mar 2020 16:40:16 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 1DDA	20 B 320 B	114ms 113ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=3dc37724-0abe-436f-8a67-a1fb983ea6ee-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:16 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
GET H2	200	342695929382157241 tpc.googlesyndication.com/simgad/ Frame 27FD	43 KB 44 KB	9ms 8ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/342695929382157241?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnX5wUGpK7Pdw3wUhGlziPPylM8lg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 12d58aa8ef47f86544df8e64e81fafb00fa9669eae51a68b5060d3325d4066c6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 29 Jan 2020 23:01:43 GMT x-content-type-options nosniff last-modified Fri, 10 Jan 2020 00:59:47 GMT server sffe age 3173913 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 44517 x-xss-protection 0 expires Thu, 28 Jan 2021 23:01:43 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27FD	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 11:08:58 GMT x-content-type-options nosniff content-type image/png server cafe age 19878 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Sat, 07 Mar 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27FD	295 B 367 B	7ms 6ms	Image image/png	2a00:1450:4001:819::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012002192257490/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 06 Mar 2020 12:55:21 GMT x-content-type-options nosniff content-type image/png server cafe age 13495 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Sat, 07 Mar 2020 12:55:21 GMT
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 1DDA	0 217 B	41ms 40ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=3dc37724&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:16 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	41ms 40ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 63a4826b41132b651ce2bd518b4db9da473cc425c1fcf49e360c127c6027a79f Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:16 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 903
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 9D57	421 KB 94 KB	42ms 42ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:16 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512816.dop004.wa1.t,1583512816.cds009.wa1.hc,1583512816.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768330 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 9D57	29 KB 8 KB	21ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60294 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 9D57	160 B 861 B	18ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 1d0bea825164fcd9bca3543d4bd1dfba7d91c1db0fdca148a7f92b2db77dd7cc Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.18:80 AN-X-Request-Uuid b19fb2eb-1100-4d17-a8c4-e8dec93de0c2 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 9D57	160 B 861 B	18ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 3797ab01917ca4929d60cdd76d7180d80254b7e42cedba11b1bbc0c0e0c62c32 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.49:80 AN-X-Request-Uuid f58ec874-3070-47b1-9a7a-be019e196824 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 9D57	44 B 604 B	92ms 92ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%222db052d1%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=2db052d1-655a-4b48-94ad-87a6ad74a253&pv=2db052d1-655a-4b48-94ad-87a6ad74a253&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 34958e3ea98a01242d4beb963c8ba762068517f13064c042b274dede62d055bf Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:16 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-8 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 9D57	150 B 340 B	13ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 21890d85dcbc1a8b646751b1ea975706d8610f4ffd3f77ad2b77cb53d8896a25 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:16 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	138ms 138ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:16 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 9D57	20 B 320 B	90ms 89ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=2db052d1-655a-4b48-94ad-87a6ad74a253-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:16 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 9D57	0 217 B	42ms 42ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=2db052d1&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:16 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 2 KB	74ms 73ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 21525d9f6b6e27e9d6270c3517417ab557f4ccd816f64b99d30f5c7b23ed110c Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:16 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 902
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame FA63	421 KB 94 KB	43ms 42ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:16 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512816.dop004.wa1.t,1583512816.cds009.wa1.hc,1583512816.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768330 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame FA63	29 KB 8 KB	29ms 28ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60294 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame FA63	160 B 861 B	21ms 21ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash dda18517198d57bf399872dab39fc8c17660bb36f1aba0f422c0177d793d137c Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.68:80 AN-X-Request-Uuid d3e50019-819d-4583-8170-aa32d9d5af2e Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame FA63	19 B 719 B	23ms 23ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.44:80 AN-X-Request-Uuid 9b2263e8-e32b-4a1d-b3fd-08977b7f60bc Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame FA63	44 B 671 B	40ms 39ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%2245c570be%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=45c570be-8f5b-4d88-9630-259bbde9de16&pv=45c570be-8f5b-4d88-9630-259bbde9de16&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 0bae17b2d1a61d6558a83d057ccac3afd77140fe9531e18146877e8e24341503 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:16 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-128 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame FA63	150 B 340 B	15ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 69d6ad34e003590bde8dab9037a2f950d27d47d9dafee3b3e490ea55ff053ea5 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:16 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	tracking.png trk.connatix.com/ Frame 31FB	0 162 B	110ms 108ms	Image text/plain	52.23.140.165 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/tracking.png?c_rpobidMeta=[{id:15447,c_wt:313,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:388,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:316,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:621,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22}]&cb=6ddce1dc33759e793d6b1583512816931&c_pl=nEQljWeIpeIng9bZOSVNJRKTicVLl2I0ELQ7dEw1B4Cuql1qQ-IbZIqbpIiZclim2Po0ey7stbbHYb7IUNK8c0NyOSU6Ye3eYBAPoMPKqKojWQ8fRRh8pCba4Je73vSTRRWqLDlyR7stLvVm_NVeGE3JWCniwy7scc-tMDhLyNlLVNOMyu8rfyT0B2u__Z2lrh_9KeHwlY_JV2mhFIOp_nnrDmjcHtuewNhQgUgaquEVvfBoHWj3v3g7wJDUWKe0g1aqMwXXM8yZehc81UOw4Q&c_v=1910_1_0_0_0&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronaviru&xplt=false&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.23.140.165 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-23-140-165.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Fri, 06 Mar 2020 16:40:16 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame FA63	20 B 320 B	67ms 67ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=45c570be-8f5b-4d88-9630-259bbde9de16-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:17 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame FA63	0 217 B	39ms 39ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=45c570be&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:17 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	39ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 296403bba6a12725d69e656d733df48f61546d203452fb9fe63b58e3c4cb85e0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:17 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 911
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame A9AB	421 KB 94 KB	42ms 42ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:17 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512817.dop004.wa1.t,1583512817.cds009.wa1.hc,1583512817.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768329 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame A9AB	29 KB 8 KB	22ms 22ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60295 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame A9AB	160 B 861 B	82ms 81ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash cdf039cc5a380cdc1cf2cc96b8e5bd6f08e96512fca4b985c7bebddd473971a7 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:19 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.56:80 AN-X-Request-Uuid 025c2aba-3ffd-475e-955d-f1b089e2b528 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame A9AB	160 B 861 B	19ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e4f4e4e699215e25d940f53efe062cefe7a7c04b3466b21dabc8762621081049 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:19 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.37:80 AN-X-Request-Uuid a074b7f2-1f20-44c1-a352-dddeb7e6390d Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame A9AB	150 B 340 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 583d1c5ed9e3c68ffd9b2a379c04221f6d5148062a6ba4367abba3786aee24cb Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:17 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame A9AB	44 B 671 B	40ms 40ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%22fe0374a9%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=fe0374a9-c4d4-4c5a-9c74-840ded1a1fde&pv=fe0374a9-c4d4-4c5a-9c74-840ded1a1fde&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 481325b4012b58679eed03fa782c78cbe06fd401d27b317b1a2fe0dc5146d4c8 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-128 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame A9AB	20 B 320 B	99ms 99ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=fe0374a9-c4d4-4c5a-9c74-840ded1a1fde-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:17 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame A9AB	0 217 B	39ms 38ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=fe0374a9&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:17 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	39ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash a1221bb88f59e3641e008167e5831fdcf78231910d787e23b8b60e137414bd94 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:17 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 910
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame FC9C	421 KB 94 KB	42ms 41ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:17 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512817.dop004.wa1.t,1583512817.cds009.wa1.hc,1583512817.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768329 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame FC9C	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60295 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame FC9C	160 B 861 B	21ms 21ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash a450c0f57757f5600e7ecb91c46eb17008907e59d05419bbeed1bdb1f4fe07eb Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:19 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.43:80 AN-X-Request-Uuid cfb1cd75-1a56-4bab-877a-9174cbf37712 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame FC9C	160 B 862 B	20ms 20ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 47335ab6cb2250e3be5d1c0385078e625f4f0fe5a455a5fe65a46d8d0f748d3e Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:19 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.108:80 AN-X-Request-Uuid 062509cc-3aae-4eca-9b5c-c900438ce0fb Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame FC9C	150 B 340 B	13ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash f6b202a99e30592add295606bda8c13782e9b076e1b59355a9719e34b5e8859c Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:17 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame FC9C	44 B 606 B	53ms 53ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%2237f8e07e%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=37f8e07e-1aeb-4e14-a5f2-cccacedb4f6c&pv=37f8e07e-1aeb-4e14-a5f2-cccacedb4f6c&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash de091989e05bf9c6f3098d484b55fc8f61d470f4f1d606984fb106746526eb8e Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:17 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-128 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame FC9C	20 B 320 B	113ms 112ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=37f8e07e-1aeb-4e14-a5f2-cccacedb4f6c-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:17 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame FC9C	0 217 B	38ms 38ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=37f8e07e&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:17 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	39ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 962e7b1ea36faff733d9eb8c4edd10c049095f3445e81e2d487d5d350f4527a6 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:18 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 904
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 4185	421 KB 94 KB	42ms 42ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:18 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512818.dop004.wa1.t,1583512818.cds009.wa1.hc,1583512818.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768328 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 4185	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60296 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 4185	160 B 862 B	22ms 22ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash cf884f6089672fd47a121e816fd4e107d45d0093a9b12570cc5cb96c92c4716e Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.106:80 AN-X-Request-Uuid 1e114721-dd85-440c-ba9b-d518aa7b60e6 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 4185	160 B 861 B	18ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 134f853afd5ed96aa62b5ba39baf6151f06d01d5bbee81bea9c83f0f345eba8b Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.81:80 AN-X-Request-Uuid e3ec4cd9-b8a7-4fa8-b98c-93cbcddfba31 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 4185	150 B 340 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash fcfc5162514038d6803d78f42c3be840cea44a4fdcc2fc652614f438e12575b2 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:18 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 4185	44 B 606 B	29ms 29ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%224a8e31fb%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=4a8e31fb-d1ea-4e8a-84e4-99902bc78e55&pv=4a8e31fb-d1ea-4e8a-84e4-99902bc78e55&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 3cc2ca6190b7844b4b792cb4cbffaba76ebab5f9b35bcd3e889f702997314cbd Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-128 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 4185	20 B 320 B	105ms 104ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=4a8e31fb-d1ea-4e8a-84e4-99902bc78e55-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:18 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 4185	0 217 B	39ms 38ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=4a8e31fb&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:18 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	39ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 6f3d6b96ea8cfdb47740a69c74ff61f44114120b6b5ea2b59762d996e56ed4f1 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:18 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 907
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 09CF	421 KB 94 KB	44ms 43ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:18 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512818.dop004.wa1.t,1583512818.cds009.wa1.hc,1583512818.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768328 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 09CF	29 KB 8 KB	55ms 54ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60296 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 09CF	160 B 862 B	19ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 9ec7bb90e65b7961e1f0ad8b017401c39deee8e1721d158d81acc19305657f96 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.166:80 AN-X-Request-Uuid 651de788-71c0-4cea-863f-aba8ae04c5f5 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 09CF	160 B 860 B	18ms 18ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 10c74779ab296cb9ffaf210714125ae2e59c8c5d464a132b5365a98c039d976f Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:20 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.5:80 AN-X-Request-Uuid cd757b54-77a9-41b0-866f-ab8eba4ef938 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 09CF	44 B 606 B	58ms 58ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%22fc14f9c0%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=fc14f9c0-bb7f-4a03-ba86-6746e0e30e7a&pv=fc14f9c0-bb7f-4a03-ba86-6746e0e30e7a&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 720f52a074c9434ae788362a691be37ef3cb0da563a3bb857568ab72ff386c9d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:18 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-128 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 09CF	150 B 340 B	14ms 14ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 5654a2541346b396e05de2fe759236b4242455cd8c06e16f7c04f63051680c66 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:18 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H2	200	sync eb2.3lift.com/ Frame 0DFC Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	100ms 28ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=18297689970786034784 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQuanghYsuCgoI4gEQuanghYsuCgoI5gEQuanghYsuCgkICRC5qeCFiy4KCgipARC5qeCFiy4KCQg5ELmp4IWLLgoJCDoQuanghYsuCgkICxC5qeCFiy4KCgjOARC5qeCFiy4KCQgfELmp4IWLLg==; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 set-cookie tluid=12835835924958591098; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	index.html cdn.districtm.io/ids/ Frame 4CF4	0 0	152ms 147ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html set-cookie __cfduid=d2341c37af0eb0d976e6c370ce359f0131583512818; expires=Sun, 05-Apr-20 16:40:18 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 56fd848c5aac9d5a-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 9868 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	31ms 29ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1583512818|mOsLgqgikin0fcmWiygu; Version=1; Expires=Sat, 21-Mar-2020 16:40:18 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=8135c114-d992-0d10-0a2b-636939359f20|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 601C Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	28ms 27ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1583512818|mOsLgqgikin0fcmWiygu; Version=1; Expires=Sat, 21-Mar-2020 16:40:18 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 via 1.1 google alt-svc clear
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame FED0	0 0	93ms 21ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Fastly-Debug-Digest e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055 Content-Length 506 Accept-Ranges bytes Date Fri, 06 Mar 2020 16:40:18 GMT Age 18428303 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4075-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 2235898 X-Timer S1583512819.694383,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 1B97	0 0	142ms 71ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Fastly-Debug-Digest e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055 Content-Length 506 Accept-Ranges bytes Date Fri, 06 Mar 2020 16:40:18 GMT Age 18428303 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4059-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 2230925 X-Timer S1583512819.694892,VS0,VE0 Vary Accept-Encoding
GET H2	200	index.html cdn.districtm.io/ids/ Frame 5A43	0 0	143ms 142ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html set-cookie __cfduid=d2341c37af0eb0d976e6c370ce359f0131583512818; expires=Sun, 05-Apr-20 16:40:18 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 56fd848c6ab59d5a-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame 90C8	0 0	208ms 91ms	Document text/html	23.210.249.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-92.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Last-Modified Tue, 04 Feb 2020 05:12:07 GMT ETag "13006b6-9f85-59db914d12ccf" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 14955 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=96372 Expires Sat, 07 Mar 2020 19:26:30 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	sync eb2.3lift.com/ Frame 555B Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	99ms 27ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=18297689970786034784 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQuqnghYsuCgoI4gEQuqnghYsuCgoI5gEQuqnghYsuCgkICRC6qeCFiy4KCgipARC6qeCFiy4KCQg5ELqp4IWLLgoJCDoQuqnghYsuCgkICxC6qeCFiy4KCgjOARC6qeCFiy4KCQgfELqp4IWLLg==; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 set-cookie tluid=11606418530230478705; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 5FA7 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	32ms 29ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; pd=v2|1583512818|mOsLgqgikin0fcmWiygu Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1583512818|rsgmkimWfcvmsHqGgqmuiynIsLomgemOgunsn0gi; Version=1; Expires=Sat, 21-Mar-2020 16:40:18 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html content-length 480 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=430ab0e1-f148-0208-0ca7-52e80adefa18|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	sync eb2.3lift.com/ Frame 718D Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	97ms 25ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=18297689970786034784 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQuqnghYsuCgoI4gEQuqnghYsuCgoI5gEQuqnghYsuCgkICRC6qeCFiy4KCgipARC6qeCFiy4KCQg5ELqp4IWLLgoJCDoQuqnghYsuCgkICxC6qeCFiy4KCgjOARC6qeCFiy4KCQgfELqp4IWLLg==; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 set-cookie tluid=9621810292308626921; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 7C81	0 0	114ms 20ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Fastly-Debug-Digest e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055 Content-Length 506 Accept-Ranges bytes Date Fri, 06 Mar 2020 16:40:18 GMT Age 18428303 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4075-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 2235900 X-Timer S1583512819.772822,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame FF73	0 0	151ms 69ms	Document text/html	23.210.249.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-92.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Last-Modified Tue, 04 Feb 2020 05:12:07 GMT ETag "13006b6-9f85-59db914d12ccf" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 14955 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=96372 Expires Sat, 07 Mar 2020 19:26:30 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame 3E11	0 0	192ms 32ms	Document text/html	23.37.55.184 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Wed, 04 Mar 2020 22:48:14 GMT Content-Encoding gzip Content-Length 7617 Content-Type text/html; charset=UTF-8 Cache-Control max-age=60753 Expires Sat, 07 Mar 2020 09:32:51 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	index.html cdn.districtm.io/ids/ Frame 089A	0 0	120ms 110ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html set-cookie __cfduid=d2341c37af0eb0d976e6c370ce359f0131583512818; expires=Sun, 05-Apr-20 16:40:18 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 56fd848d5b879d5a-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H2	200	sync eb2.3lift.com/ Frame 0DD1 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	43ms 29ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=18297689970786034784 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQuqnghYsuCgoI4gEQuqnghYsuCgoI5gEQuqnghYsuCgkICRC6qeCFiy4KCgipARC6qeCFiy4KCQg5ELqp4IWLLgoJCDoQuqnghYsuCgkICxC6qeCFiy4KCgjOARC6qeCFiy4KCQgfELqp4IWLLg==; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 set-cookie tluid=918467847483213058; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	sync eb2.3lift.com/ Frame 4E10 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	38ms 29ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=18297689970786034784 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQu6nghYsuCgoI4gEQu6nghYsuCgoI5gEQu6nghYsuCgkICRC7qeCFiy4KCgipARC7qeCFiy4KCQg5ELup4IWLLgoJCDoQu6nghYsuCgkICxC7qeCFiy4KCgjOARC7qeCFiy4KCQgfELup4IWLLg==; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Fri, 06 Mar 2020 16:40:18 GMT content-length 0 set-cookie tluid=18297689970786034784; Max-Age=7776000; Expires=Thu, 4 Jun 2020 16:40:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	index.html cdn.districtm.io/ids/ Frame E1B2	0 0	124ms 115ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html set-cookie __cfduid=d2341c37af0eb0d976e6c370ce359f0131583512818; expires=Sun, 05-Apr-20 16:40:18 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 56fd848d5b8b9d5a-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame 8887	0 0	192ms 88ms	Document text/html	23.210.249.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-92.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Last-Modified Tue, 04 Feb 2020 05:12:07 GMT ETag "13006b6-9f85-59db914d12ccf" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 14955 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=96372 Expires Sat, 07 Mar 2020 19:26:30 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 01BA	0 0	37ms 29ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; pd=v2|1583512818|mOsLgqgikin0fcmWiygu Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1583512818|rsgmkimWfcvmsHqGgqmuiynIsLomgemOgunsn0gi; Version=1; Expires=Sat, 21-Mar-2020 16:40:18 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html content-length 480 content-encoding gzip via 1.1 google alt-svc clear
GET H2	200	index.html cdn.districtm.io/ids/ Frame 927A	0 0	119ms 112ms	Document text/html	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html set-cookie __cfduid=d2341c37af0eb0d976e6c370ce359f0131583512818; expires=Sun, 05-Apr-20 16:40:18 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 56fd848d5b8c9d5a-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame 7FFA	0 0	191ms 90ms	Document text/html	23.210.249.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-92.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Last-Modified Tue, 04 Feb 2020 05:12:07 GMT ETag "13006b6-9f85-59db914d12ccf" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 14955 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=96372 Expires Sat, 07 Mar 2020 19:26:30 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 0B98	0 0	30ms 27ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.176.2 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ accept-encoding gzip, deflate, br accept-language en-US cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; pd=v2|1583512818|mOsLgqgikin0fcmWiygu Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=9b658fa5-d1c8-0d88-05e5-8dc17031ff28|1583512818; Version=1; Expires=Sat, 06-Mar-2021 16:40:18 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1583512818|rsgmkimWfcvmsHqGgqmuiynIsLomgemOgunsn0gi; Version=1; Expires=Sat, 21-Mar-2020 16:40:18 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.176.2 p3p CP="CUR ADM OUR NOR STA NID" date Fri, 06 Mar 2020 16:40:18 GMT content-type text/html content-length 480 content-encoding gzip via 1.1 google alt-svc clear
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame F245	0 0	263ms 73ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Fastly-Debug-Digest e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055 Content-Length 506 Accept-Ranges bytes Date Fri, 06 Mar 2020 16:40:18 GMT Age 18428304 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4060-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 1765463 X-Timer S1583512819.992029,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame 824E	0 0	156ms 89ms	Document text/html	23.210.249.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-92.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Last-Modified Tue, 04 Feb 2020 05:12:07 GMT ETag "13006b6-9f85-59db914d12ccf" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 14955 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=96372 Expires Sat, 07 Mar 2020 19:26:30 GMT Date Fri, 06 Mar 2020 16:40:18 GMT Connection keep-alive Vary Accept-Encoding
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame E585	0 0	203ms 71ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Fastly-Debug-Digest e0a1bb88354655bae6b4f44be1ff58238053e5563770e29e0e433e905ee66055 Content-Length 506 Accept-Ranges bytes Date Fri, 06 Mar 2020 16:40:18 GMT Age 18428303 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4076-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 1760624 X-Timer S1583512819.992005,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 09CF	20 B 320 B	284ms 94ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=fc14f9c0-bb7f-4a03-ba86-6746e0e30e7a-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:19 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 09CF	0 217 B	71ms 69ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=fc14f9c0&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:19 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 1 KB	41ms 41ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash ab1caeca1f194d8944ce8c762175ed5d973ce62a8ba3dc45594f720838493255 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:19 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 903
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 0B40	421 KB 94 KB	189ms 172ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:19 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512819.dop004.wa1.t,1583512819.cds009.wa1.hc,1583512819.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768327 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 0B40	29 KB 8 KB	97ms 22ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60297 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 0B40	160 B 861 B	175ms 71ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 1a4d0b74b49d411c4a18be7a80a20a70fc76d3b6901c67acc403e2c3ab361617 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:21 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.44:80 AN-X-Request-Uuid 53738a27-1137-460c-9ed4-6dd2fe33e69b Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 0B40	160 B 861 B	209ms 28ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e45afa18f4e0043d9004e4998658aaa382edf37ba2fa6cf513f97f7edef67de7 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:21 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.86:80 AN-X-Request-Uuid 6f9c7758-ef9b-4d0f-b575-4135ace463e1 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 0B40	150 B 340 B	87ms 14ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash c02e146f7b36fdd8e631677c869a6ae3d3248699a78783839895c3183b9f102a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:19 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET		trinity.json apex.go.sonobi.com/ Frame 0B40	0 0
GET H/1.1	200 OK	tracking.png trk.connatix.com/ Frame 31FB	0 162 B	311ms 104ms	Image text/plain	52.23.140.165 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/tracking.png?c_rpobidMeta=[{id:15447,c_wt:824,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:256,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:285,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:487,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22},{id:15447,c_wt:230,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22}]&cb=87ec1911b0c1de4a773f1583512819931&c_pl=nEQljWeIpeIng9bZOSVNJRKTicVLl2I0ELQ7dEw1B4Cuql1qQ-IbZIqbpIiZclim2Po0ey7stbbHYb7IUNK8c0NyOSU6Ye3eYBAPoMPKqKojWQ8fRRh8pCba4Je73vSTRRWqLDlyR7stLvVm_NVeGE3JWCniwy7scc-tMDhLyNlLVNOMyu8rfyT0B2u__Z2lrh_9KeHwlY_JV2mhFIOp_nnrDmjcHtuewNhQgUgaquEVvfBoHWj3v3g7wJDUWKe0g1aqMwXXM8yZehc81UOw4Q&c_v=1910_1_0_0_0&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronaviru&xplt=false&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.23.140.165 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-23-140-165.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Fri, 06 Mar 2020 16:40:20 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 0B40	20 B 320 B	177ms 102ms	XHR application/json	34.252.47.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=404bb394-7d20-4870-9bb8-8839322c0b48-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.47.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-47-177.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Fri, 06 Mar 2020 16:40:20 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 0B40	0 217 B	115ms 38ms	XHR text/plain	54.171.158.217 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=404bb394&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.158.217 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-158-217.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Fri, 06 Mar 2020 16:40:20 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 31FB	2 KB 2 KB	114ms 38ms	XHR application/xml	108.128.234.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.128.234.189 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-108-128-234-189.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 6cb9cad09067bbfa876fd8e258668d3700abf7080602b7b50f788de59e7ddbef Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 06 Mar 2020 16:40:20 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 910
GET H2	200	vpaid_2d0ef349.js Show response vpaid.springserve.com/production/ Frame 51DD	421 KB 94 KB	49ms 49ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_2d0ef349.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1910/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 9b668fd63cc9b73ab4e0efa6cfd227c62c244a95f54a6a98125ab2f869a87f1a Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 06 Mar 2020 16:40:21 GMT content-encoding gzip last-modified Tue, 14 Jan 2020 17:06:38 GMT server AmazonS3 x-amz-request-id 49FAD6158A43D26F etag "53a89f9184b1b0306557f2639fb3f7b7" x-hw 1583512821.dop004.wa1.t,1583512821.cds009.wa1.hc,1583512821.cds010.wa1.c content-type application/javascript status 200 cache-control max-age=768325 accept-ranges bytes access-control-allow-origin * content-length 96293 x-amz-id-2 KLPzn3SPLJZsvYl5uDM1/UxWNGvOPegQehmBS1kebC4QSWn2YK3EfjoFHwzM2bU8ksI03ZkK+F0=
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 51DD	29 KB 8 KB	22ms 21ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Thu, 05 Mar 2020 23:55:23 GMT content-encoding gzip x-content-type-options nosniff age 60299 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 UnqWFxx8IFZcKqzfIjsxjbL/TX7z4PirDYPJh14tLtxdanOtlPCpXw6i91XCr8oeWA1FSzOv2/M= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id A8CD411BD43C2B41 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 51DD	160 B 862 B	58ms 20ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 1f1a015ebee7354bf0ddb49c21e7ea3cf03285ba6ec54902970eefa5312da9b9 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:23 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.113:80 AN-X-Request-Uuid 854245f2-6ba3-4b3d-8105-2288e379e6cc Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 51DD	160 B 861 B	56ms 19ms	XHR application/json	185.33.223.221 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.221 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 316.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c050a968dfeff3782b3da25ecc940c5231ab1b0ac275db8067c3eba5b9a74fb Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Fri, 06 Mar 2020 16:40:23 GMT X-Proxy-Origin 82.102.19.134; 82.102.19.134; 316.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.47:80 AN-X-Request-Uuid cbdbcc80-826a-4c75-ab9a-786a9413d505 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET		trinity.json apex.go.sonobi.com/ Frame 51DD	0 0
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 51DD	150 B 340 B	24ms 24ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_2d0ef349.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 9bb76bc0c6abd1dbdf22cdd7ae2fe6be3a213424f21f2089953b92e6dbbfb4f9 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Mar 2020 16:40:21 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET		bc2 bc-rtb-dub.springserve.com/ Frame 51DD	0 0
GET H/1.1	200 OK	tracking.png trk.connatix.com/ Frame 31FB	0 162 B	310ms 104ms	Image text/plain	52.23.140.165 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/tracking.png?c_rpobidMeta=[{id:15447,c_wt:1609,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22}]&cb=824bcb278dd2a4889ac01583512822932&c_pl=nEQljWeIpeIng9bZOSVNJRKTicVLl2I0ELQ7dEw1B4Cuql1qQ-IbZIqbpIiZclim2Po0ey7stbbHYb7IUNK8c0NyOSU6Ye3eYBAPoMPKqKojWQ8fRRh8pCba4Je73vSTRRWqLDlyR7stLvVm_NVeGE3JWCniwy7scc-tMDhLyNlLVNOMyu8rfyT0B2u__Z2lrh_9KeHwlY_JV2mhFIOp_nnrDmjcHtuewNhQgUgaquEVvfBoHWj3v3g7wJDUWKe0g1aqMwXXM8yZehc81UOw4Q&c_v=1910_1_0_0_0&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronaviru&xplt=false&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.23.140.165 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-23-140-165.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Fri, 06 Mar 2020 16:40:23 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=88fb4ede-d9df-4cf2-a23f-d903d8d57192&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8059746835520154

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=135333fa-c6e5-4e8e-906a-b4d971a0189c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.20363192387609974

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=a004a281-1460-4018-b440-ab52167d0107&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7480852929722497

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=45ee20d9-5ae8-4ea4-b8bc-640877f88bd3&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7954031528141967

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=20cf9745-f994-405d-af70-ac32d5e08b52&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7030392623989152

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=8ef30309-adf8-48aa-b57b-51675dede456&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5948597044579089

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=132c7398dd91680d;misc=1583512811368;

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1002fc667ee2c056&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=101cfb9d23cbf403&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=102ed44a108c11bb&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1035e5cfdbc04c5d&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=1048d75fe7cdbf6a&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=105342591ce19f77&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=106a15784300f6e4&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=107c324b8acadcf8&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=108ede9af1f35451&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=109c0d14bdc38966&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=110930ce97c68362&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

dmx.districtm.io

URL

https://dmx.districtm.io/b/v1

Domain

dmx.districtm.io

URL

https://dmx.districtm.io/b/v1

Domain

hbopenbid.pubmatic.com

URL

https://hbopenbid.pubmatic.com/translator?source=prebid-client

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=14076a137674c85d;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=133171ea090df76;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=142fea01744976e4;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13507f6704e32fad;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13437f1bdcfadf12;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=13679b7fe9360562;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=138279b68f36bb39;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=137279960b3b1a2a;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=139e29c7fc53cef1;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=1412a4ab97cef77b;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1583512811;v=2;cmd=bid;cors=yes;alias=144568f5632e2e0d;misc=1583512811369

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1583512812;v=2;cmd=bid;cors=yes;alias=143b15e16cb69a57;misc=1583512811369

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=15172882e4d82d47&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

btlr.sharethrough.com

URL

https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=152563e693ef5b21&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D&

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=d2181914-fd7c-46c3-83f3-e40f4a0af4ab&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5871253138347972

Domain

fastlane.rubiconproject.com

URL

https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Ftrickbot-malware-targets-italy-in-fake-who-coronavirus-emails%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=55049cea-a576-4a20-b4bb-b1fb18c87e22&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6990692937953698

Domain

apex.go.sonobi.com

URL

https://apex.go.sonobi.com/trinity.json?key_maker={%22404bb394%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=404bb394-7d20-4870-9bb8-8839322c0b48&pv=404bb394-7d20-4870-9bb8-8839322c0b48&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0

Domain

apex.go.sonobi.com

URL

https://apex.go.sonobi.com/trinity.json?key_maker={%22436fb988%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=436fb988-a138-435d-a877-f4ec0706944d&pv=436fb988-a138-435d-a877-f4ec0706944d&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0

Domain

bc-rtb-dub.springserve.com

URL

https://bc-rtb-dub.springserve.com/bc2?r=436fb988-a138-435d-a877-f4ec0706944d-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834