urlscan.io logo urlscan.io
SecurityTrails logo

securityintelligence.com Open in urlscan Pro
184.172.117.98  Public Scan

Go To Rescan Add Verdict Report
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Submission: On August 16 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 8 domains to perform 25 HTTP transactions. The main IP is 184.172.117.98, located in Dallas, United States and belongs to SOFTLAYER - SoftLayer Technologies Inc., US. The main domain is securityintelligence.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on December 5th 2017. Valid for: a year.
This is the only time securityintelligence.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 17 184.172.117.98 36351 (SOFTLAYER)
1 3 2a02:26f0:eb:... 20940 (AKAMAI-ASN1)
2 104.108.67.84 16625 (AKAMAI-AS)
2 34.203.119.254 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.14.110 54113 (FASTLY)
1 162.247.242.19 23467 (NEWRELIC-...)
25 7
17    184.172.117.98 (Dallas, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 62.75.acb8.ip4.static.sl-reverse.com
securityintelligence.com
3    2a02:26f0:eb:1a3::b3a (European Union)

ASN20940 (AKAMAI-ASN1, US)
1.www.s81c.com
www.ibm.com
2    104.108.67.84 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-67-84.deploy.static.akamaitechnologies.com
console.bluemix.net
2    34.203.119.254 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-203-119-254.compute-1.amazonaws.com
tracking.skyword.com
1    2a00:1450:4001:817::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    151.101.14.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.19 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-7.nr-data.net
bam.nr-data.net
Domain Requested by
17 securityintelligence.com 1 redirects securityintelligence.com
2 tracking.skyword.com securityintelligence.com
2 console.bluemix.net 1.www.s81c.com
securityintelligence.com
2 1.www.s81c.com securityintelligence.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com securityintelligence.com
1 ajax.googleapis.com securityintelligence.com
1 www.ibm.com 1 redirects
25 8
Subject Issuer Validity Valid
*.securityintelligence.com
COMODO RSA Domain Validation Secure Server CA		 2017-12-05 -
2018-12-17		 a year crt.sh
www.ibm.com
GeoTrust RSA CA 2018		 2018-02-19 -
2019-03-21		 a year crt.sh
wildcard.bluemix.net
DigiCert SHA2 Secure Server CA		 2018-06-19 -
2019-12-18		 a year crt.sh
*.skyword.com
Network Solutions OV Server CA 2		 2017-11-13 -
2018-12-10		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-08-07 -
2018-10-16		 2 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-08-08 -
2019-04-14		 8 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Frame ID: 25EA6F54456C780C66BA3D95594E12CD
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan HTTP 301
    https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • env /^addthis/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

25
Requests

100 %
HTTPS

29 %
IPv6

8
Domains

8
Subdomains

7
IPs

4
Countries

734 kB
Transfer

1298 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan HTTP 301
    https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14
  • https://www.ibm.com/software/info/js/tacticbindlinks.js HTTP 301
  • https://1.www.s81c.com/common/js/tacticbindlinks.js

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Redirect Chain
  • https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan
  • https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
68 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
692a62d9870192203d9a1cdddfb75f3ee644a4608ac2b1bcf8d21a25a65129f1

Request headers

Host
securityintelligence.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
25EA6F54456C780C66BA3D95594E12CD

Response headers

Date
Thu, 16 Aug 2018 04:46:42 GMT
Server
Apache/2.4.33 (Ubuntu)
Link
<https://securityintelligence.com/wp-json/>; rel="https://api.w.org/", <https://securityintelligence.com/?p=398044>; rel=shortlink, <https://securityintelligence.com/wp-json>; rel="https://github.com/WP-API/WP-API"
Cache-Control
max-age=600
Expires
Thu, 16 Aug 2018 04:56:42 GMT
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
14674
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Thu, 16 Aug 2018 04:46:41 GMT
Server
Apache/2.4.33 (Ubuntu)
Location
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Cache-Control
max-age=600
Expires
Thu, 16 Aug 2018 04:56:41 GMT
Content-Length
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
ida_stats.js
1.www.s81c.com/common/stats/ 		21 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://1.www.s81c.com/common/stats/ida_stats.js
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:eb:1a3::b3a , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
49a7c63e3bbd2dd2eed5b759664486d4f91b5d325c4b9bacf5554c1c6cd09e5c
Security Headers
Name Value
Strict-Transport-Security max-age=2592000

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

cteonnt-length
21543
date
Thu, 16 Aug 2018 04:46:12 GMT
content-encoding
gzip
last-modified
Tue, 14 Aug 2018 16:59:34 GMT
etag
"5427-57368225f0980"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
epke-alive
timeout=10, max=64
cache-control
max-age=60264
strict-transport-security
max-age=2592000
accept-ranges
bytes
content-length
6191
expires
Thu, 16 Aug 2018 21:30:36 GMT
autoptimize_a318e34a19c5647cc570eead676317f3.css
securityintelligence.com/wp-content/cache/autoptimize/css/ 		385 B
623 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/wp-content/cache/autoptimize/css/autoptimize_a318e34a19c5647cc570eead676317f3.css
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
b1d854df9d02c9b5d4e269e42d4df0c88cd2bac36f69bfdd46e414605ed43348

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Jul 2018 12:11:31 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"181-5711cbad4cf49-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=30672000, public, immutable
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
196
Expires
Tue, 06 Aug 2019 04:46:43 GMT
autoptimize_f1bfb4105b3664a475e21bf7aa61778d.css
securityintelligence.com/wp-content/cache/autoptimize/css/ 		340 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/wp-content/cache/autoptimize/css/autoptimize_f1bfb4105b3664a475e21bf7aa61778d.css
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
20fd5e764d82db94677a0337c279933e7bb852c75a4f6b5e2a0aec37cfe3ea53

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Content-Encoding
gzip
Last-Modified
Mon, 02 Jul 2018 11:58:28 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"550b2-57002ea6a0ba9-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=30672000, public, immutable
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
50515
Expires
Tue, 06 Aug 2019 04:46:43 GMT
bmaid
console.bluemix.net/analytics/ 		0
340 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://console.bluemix.net/analytics/bmaid
Requested by
Host: 1.www.s81c.com
URL: https://1.www.s81c.com/common/stats/ida_stats.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.108.67.84 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-67-84.deploy.static.akamaitechnologies.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Access-Control-Request-Method
GET
Origin
https://securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

x-response-time
0.276
pragma
no-cache
date
Thu, 16 Aug 2018 04:46:12 GMT
access-control-allow-origin
https://securityintelligence.com
x-frame-options
SAMEORIGIN
x-powered-by
Express
vary
Origin, Access-Control-Request-Headers
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
status
200
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
content-type
content-length
0
expires
Thu, 16 Aug 2018 04:46:12 GMT
bmaid
console.bluemix.net/analytics/ 		0
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://console.bluemix.net/analytics/bmaid
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.108.67.84 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-67-84.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Origin
https://securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
cache-control
max-age=0, no-cache, no-store
content-type
text/html; charset=utf-8
expires
Thu, 16 Aug 2018 04:46:12 GMT
logo-SI.svg
securityintelligence.com/wp-content/themes/security-intelligence/assets/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/themes/security-intelligence/assets/img/logo-SI.svg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
7dc6eea1cb6b915cc787081065a422d83cd6c8724241c59e19ad2b08288b0efc

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Tue, 26 Dec 2017 15:51:55 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"1b3c-561404317fcc0"
Content-Type
image/svg+xml
Cache-Control
max-age=1
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
6972
Expires
Thu, 16 Aug 2018 04:46:44 GMT
phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan-630x330.jpg
securityintelligence.com/wp-content/uploads/2018/08/ 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/08/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan-630x330.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
ada76cb980c8003ba1600354ba7e60162d014b398eac2cc5197a57d76e7ca572

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Mon, 06 Aug 2018 16:06:03 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"d725-572c6744010c0"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
55077
Expires
Thu, 16 Aug 2018 07:46:43 GMT
tracker.js
tracking.skyword.com/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.skyword.com/tracker.js?contentId=281474979871709
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.119.254 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-203-119-254.compute-1.amazonaws.com
Software
/
Resource Hash
df2c98f28d3d3f56215c44f5572fe66795c07b5cfb4b26f12f7241b18e28fc10

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Connection
keep-alive
Date
Thu, 16 Aug 2018 04:46:12 GMT
Content-Length
3514
new-protocol-promises-to-improve-wi-fi-security-eventually-600x260.jpg
securityintelligence.com/wp-content/uploads/2018/07/ 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/07/new-protocol-promises-to-improve-wi-fi-security-eventually-600x260.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
8e7fdfed4c711f63cc9ca01e21d64e307e637f5cf13af9cb1445994b6e0847d8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Mon, 16 Jul 2018 11:25:44 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"7da6-5711c17179e00"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
32166
Expires
Thu, 16 Aug 2018 07:46:43 GMT
recent-attack-suggests-ransomware-is-alive-and-well-in-healthcare-600x260.jpg
securityintelligence.com/wp-content/uploads/2018/07/ 		35 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/07/recent-attack-suggests-ransomware-is-alive-and-well-in-healthcare-600x260.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
65763b5017fb531a5a3430c9813ecb0ec5c49080b9c9192f7f816a930111d530

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Wed, 18 Jul 2018 13:55:48 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"8cf9-571466b748100"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
36089
Expires
Thu, 16 Aug 2018 07:46:43 GMT
threat-actors-exploit-new-drupal-flaw-to-deliver-cryptocurrency-mining-malware-600x260.jpg
securityintelligence.com/wp-content/uploads/2018/07/ 		50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/07/threat-actors-exploit-new-drupal-flaw-to-deliver-cryptocurrency-mining-malware-600x260.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
8f99919973d931adaff2e921397dfaca10a04335670d4374bba9d618c12f5e85

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Mon, 23 Jul 2018 17:46:25 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"c6e5-571ae39693e40"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
50917
Expires
Thu, 16 Aug 2018 07:46:43 GMT
ShaneSchick2013-200x200.jpeg
securityintelligence.com/wp-content/uploads/2014/09/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2014/09/ShaneSchick2013-200x200.jpeg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
962c8da3452448661ee30b809bd266f180e2413df19d04b14389a16a5ffc3421

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Last-Modified
Fri, 12 Jan 2018 15:19:38 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"221a-56295caf11680"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
8730
Expires
Thu, 16 Aug 2018 07:46:44 GMT
Boom-right-rail-promo.jpg
securityintelligence.com/wp-content/uploads/2018/06/ 		274 KB
274 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/06/Boom-right-rail-promo.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
62129cd0181c4757c0035af1f0aa8bb83d07a87017ed1333410925136917afaf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Last-Modified
Sun, 17 Jun 2018 10:49:05 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"44848-56ed432a42349"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
280648
Expires
Thu, 16 Aug 2018 07:46:44 GMT
logo-SI-wht.svg
securityintelligence.com/wp-content/themes/security-intelligence/assets/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/themes/security-intelligence/assets/img/logo-SI-wht.svg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
9e6fcf49348b90eecc2524393f3a64ead45fc8faae869fada5d3f8fb2ad26b35

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Last-Modified
Tue, 26 Dec 2017 15:51:55 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"1a29-561404317fcc0"
Content-Type
image/svg+xml
Cache-Control
max-age=1
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
6697
Expires
Thu, 16 Aug 2018 04:46:45 GMT
tacticbindlinks.js
1.www.s81c.com/common/js/
Redirect Chain
  • https://www.ibm.com/software/info/js/tacticbindlinks.js
  • https://1.www.s81c.com/common/js/tacticbindlinks.js
1 KB
757 B 		Script
General
Check archive.org
Download Go to
Full URL
https://1.www.s81c.com/common/js/tacticbindlinks.js
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:eb:1a3::b3a , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
04e70dcb1fbeef2e4571f9643748c3f00913df66b232b4b0ba50fe16d3f24fae
Security Headers
Name Value
Strict-Transport-Security max-age=2592000

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

cteonnt-length
1299
date
Thu, 16 Aug 2018 04:46:12 GMT
content-encoding
gzip
last-modified
Tue, 20 Mar 2018 14:21:07 GMT
etag
"513-567d8c9099ac0"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=49306
strict-transport-security
max-age=2592000
accept-ranges
bytes
kp-eealive
timeout=10, max=54
content-length
513
expires
Thu, 16 Aug 2018 18:27:58 GMT

Redirect headers

status
301
date
Thu, 16 Aug 2018 04:46:12 GMT
x-powered-by
Express
content-length
136
location
//1.www.s81c.com/common/js/tacticbindlinks.js
content-type
application/x-javascript
autoptimize_5a4214ce6c8e44a597f5c7e336ef080f.js
securityintelligence.com/wp-content/cache/autoptimize/js/ 		213 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/wp-content/cache/autoptimize/js/autoptimize_5a4214ce6c8e44a597f5c7e336ef080f.js
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
fb746f3b35e8d760cb82f5622cd3afbf41b948fb1f8c601c917798f879c07457

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 17 May 2018 12:40:42 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"352fd-56c6624b90b6a-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=30672000, public, immutable
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Expires
Tue, 06 Aug 2019 04:46:44 GMT
ibm-si.woff
securityintelligence.com/wp-content/themes/security-intelligence/assets/fonts/ 		5 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/wp-content/themes/security-intelligence/assets/fonts/ibm-si.woff
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
723d22580f1953d6652e1af5eb2bf169d0c81dab04a82fb1f7558f1c1268ced9

Request headers

Pragma
no-cache
Origin
https://securityintelligence.com
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Origin
https://securityintelligence.com

Response headers

Date
Thu, 16 Aug 2018 04:46:43 GMT
Last-Modified
Mon, 12 Dec 2016 17:04:44 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"1328-5437919a68300"
Content-Type
application/x-font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=1
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
4904
Expires
Thu, 16 Aug 2018 04:46:44 GMT
photo-contributors-DEV.jpg
securityintelligence.com/wp-content/uploads/2017/12/ 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2017/12/photo-contributors-DEV.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
52b361e647c21e378baa8a3b0fe2bfd945f2465d2c2026c707ddc7aa93689b97

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Last-Modified
Tue, 23 Jan 2018 11:47:43 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"88b9-563701d52b5c0"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
35001
Expires
Thu, 16 Aug 2018 07:46:44 GMT
SI-Promo-xforce-red-in-action-podcast-blur-grey.jpg
securityintelligence.com/wp-content/uploads/2018/07/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityintelligence.com/wp-content/uploads/2018/07/SI-Promo-xforce-red-in-action-podcast-blur-grey.jpg
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
59650c43b476a5cee6bb3b137e9d3d1928210c5d9881f2614ade929d9978773b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Last-Modified
Thu, 19 Jul 2018 16:02:31 GMT
Server
Apache/2.4.33 (Ubuntu)
ETag
"781b-5715c4e7873c0"
Content-Type
image/jpeg
Cache-Control
max-age=10800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
30747
Expires
Thu, 16 Aug 2018 07:46:44 GMT
tracker.gif
tracking.skyword.com/ 		43 B
475 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tracking.skyword.com/tracker.gif?_url=https%3A//securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/&_anonymize=no&_doNotTrack=no&_referer=&_cacheBust=15343947731441e1b9&_contentId=281474979871709
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.119.254 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-203-119-254.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 16 Aug 2018 04:46:12 GMT
Connection
keep-alive
P3P
policyref="http://.skyword.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length
43
Content-Type
image/gif
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.2/ 		93 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/wp-content/cache/autoptimize/js/autoptimize_5a4214ce6c8e44a597f5c7e336ef080f.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:817::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 23 Jul 2018 14:32:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2038443
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
33845
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 Jul 2019 14:32:10 GMT
Cookie set admin-ajax.php
securityintelligence.com/wp-admin/ 		26 B
729 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securityintelligence.com/wp-admin/admin-ajax.php
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/wp-content/cache/autoptimize/js/autoptimize_5a4214ce6c8e44a597f5c7e336ef080f.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.172.117.98 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
62.75.acb8.ip4.static.sl-reverse.com
Software
Apache/2.4.33 (Ubuntu) /
Resource Hash
3703a9e94cce96cde509dac34a5683d05c33c4ee47cdfd43d66d4f8e36002dde
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Pragma
no-cache
Origin
https://securityintelligence.com
Accept-Encoding
gzip, deflate
Host
securityintelligence.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
application/json, text/javascript, */*; q=0.01
Cache-Control
no-cache
X-Requested-With
XMLHttpRequest
Connection
keep-alive
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Content-Length
24
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Origin
https://securityintelligence.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Thu, 16 Aug 2018 04:46:44 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
46
Referrer-Policy
strict-origin-when-cross-origin
Server
Apache/2.4.33 (Ubuntu)
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
https://securityintelligence.com
Cache-Control
no-cache, must-revalidate, max-age=0
Access-Control-Allow-Credentials
true
Set-Cookie
news_counter=1534394805; expires=Fri, 16-Aug-2019 04:46:45 GMT; Max-Age=31536000; path=/
X-Robots-Tag
noindex
Keep-Alive
timeout=5, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
nr-1071.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1071.min.js
Requested by
Host: securityintelligence.com
URL: https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 16 Aug 2018 04:46:14 GMT
content-encoding
gzip
x-amz-request-id
481FE111768851BD
x-cache
HIT
status
200
content-length
9086
x-amz-id-2
0YRbL+xndniUNryTFyPMh7blhTKIHFgax7VZOYNB0faQOHdTX/PT1kK81w0HdqDzPFNiC/1Ey3g=
x-served-by
cache-fra19134-FRA
last-modified
Wed, 28 Feb 2018 23:33:31 GMT
server
AmazonS3
x-timer
S1534394774.185259,VS0,VE0
etag
"a1a545c95f313a230157b47dca555c25"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
641
e790975210
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/e790975210?a=142227645&v=1071.385e752&to=NgZUMUVQWxEHUhJYCw9MdwZDWFoMSUIPXwMNBhsMVVxqDANGFQ%3D%3D&rst=4202&ref=https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/&ap=992&be=2185&fe=4170&dc=3488&perf=%7B%22timing%22:%7B%22of%22:1534394770008,%22n%22:0,%22r%22:0,%22re%22:1059,%22f%22:1059,%22dn%22:1059,%22dne%22:1059,%22c%22:1059,%22ce%22:1059,%22rq%22:1059,%22rp%22:2178,%22rpe%22:2300,%22dl%22:2180,%22di%22:2731,%22ds%22:3489,%22de%22:3489,%22dc%22:4170,%22l%22:4170,%22le%22:4185%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&at=GkFXRw1KSB8%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1071.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.19 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-7.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://securityintelligence.com/news/phishing-campaign-uses-ftp-links-to-deliver-danabot-banking-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require object| digitalData undefined| topIdaStatsLoaded object| _appInfo object| _dl boolean| idaPageIsSPA boolean| isIdaStatsLoaded object| ghostQueue function| cmCreatePageviewTag function| cmCreateProductviewTag function| cmCreateShopAction5Tag function| cmDisplayShops function| cmCreateShopAction9Tag function| cmCreateOrderTag function| cmCreateRegistrationTag function| cmCreateElementTag function| cmCreateConversionEventTag function| cmCreateManualPageviewTag function| cmCreateManualLinkClickTag function| cmCreateManualImpressionTag function| cmCreateCustomTag function| cmSetupOther function| cmSetCurrencyCode function| cmDisplayShop9s function| cmDisplayShop5s function| cmRetrieveUserID object| ibmStats function| createPageviewTagForSPA object| v16elu string| pageViewAttributes object| ibmweb boolean| idaGetAnonymousIDCalled string| ajaxurl object| addthis_config object| addthis_share object| qpprFrontData object| object_name object| themeajax object| tcPassingBindAllIwmLinks object| skywordTracker function| skywordContentId object| contentId function| domready object| DateFormat object| siModule undefined| $ function| jQuery object| jQuery1124011203978426815708 function| passParams object| jstz object| CSSFontLoader object| wp object| settings object| url

1 Cookies

Domain/Path Name / Value
securityintelligence.com/ Name: news_counter
Value: 1534394805

2 Console Messages

Source Level URL
Text
console-api error URL: https://1.www.s81c.com/common/stats/ida_stats.js(Line 4)
Message:
+++DBDM-ERROR > anonymousId: Error while calling BMAID service. status:[-1] statusText:[Error while calling service]
console-api log URL: https://securityintelligence.com/wp-content/cache/autoptimize/js/autoptimize_5a4214ce6c8e44a597f5c7e336ef080f.js(Line 8)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.www.s81c.com
ajax.googleapis.com
bam.nr-data.net
console.bluemix.net
js-agent.newrelic.com
securityintelligence.com
tracking.skyword.com
www.ibm.com
104.108.67.84
151.101.14.110
162.247.242.19
184.172.117.98
2a00:1450:4001:817::200a
2a02:26f0:eb:1a3::b3a
34.203.119.254
04e70dcb1fbeef2e4571f9643748c3f00913df66b232b4b0ba50fe16d3f24fae
20fd5e764d82db94677a0337c279933e7bb852c75a4f6b5e2a0aec37cfe3ea53
3703a9e94cce96cde509dac34a5683d05c33c4ee47cdfd43d66d4f8e36002dde
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
49a7c63e3bbd2dd2eed5b759664486d4f91b5d325c4b9bacf5554c1c6cd09e5c
52b361e647c21e378baa8a3b0fe2bfd945f2465d2c2026c707ddc7aa93689b97
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280
59650c43b476a5cee6bb3b137e9d3d1928210c5d9881f2614ade929d9978773b
62129cd0181c4757c0035af1f0aa8bb83d07a87017ed1333410925136917afaf
65763b5017fb531a5a3430c9813ecb0ec5c49080b9c9192f7f816a930111d530
692a62d9870192203d9a1cdddfb75f3ee644a4608ac2b1bcf8d21a25a65129f1
723d22580f1953d6652e1af5eb2bf169d0c81dab04a82fb1f7558f1c1268ced9
7dc6eea1cb6b915cc787081065a422d83cd6c8724241c59e19ad2b08288b0efc
8e7fdfed4c711f63cc9ca01e21d64e307e637f5cf13af9cb1445994b6e0847d8
8f99919973d931adaff2e921397dfaca10a04335670d4374bba9d618c12f5e85
962c8da3452448661ee30b809bd266f180e2413df19d04b14389a16a5ffc3421
9e6fcf49348b90eecc2524393f3a64ead45fc8faae869fada5d3f8fb2ad26b35
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
ada76cb980c8003ba1600354ba7e60162d014b398eac2cc5197a57d76e7ca572
b1d854df9d02c9b5d4e269e42d4df0c88cd2bac36f69bfdd46e414605ed43348
df2c98f28d3d3f56215c44f5572fe66795c07b5cfb4b26f12f7241b18e28fc10
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
fb746f3b35e8d760cb82f5622cd3afbf41b948fb1f8c601c917798f879c07457