URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Submission: On August 09 via api from IN

Summary

This website contacted 43 IPs in 6 countries across 34 domains to perform 117 HTTP transactions. The main IP is 52.151.96.240, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.trustwave.com.
TLS certificate: Issued by Trustwave Extended Validation SHA256 ... on November 10th 2020. Valid for: a year.
This is the only time www.trustwave.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 40 52.151.96.240 8075 (MICROSOFT...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 140.82.121.4 36459 (GITHUB)
1 151.101.12.217 54113 (FASTLY)
4 204.79.197.234 8068 (MICROSOFT...)
2 104.75.88.126 16625 (AKAMAI-AS)
2 104.111.234.67 16625 (AKAMAI-AS)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:2800:233... 15133 (EDGECAST)
1 2a00:1450:400... 15169 (GOOGLE)
15 52.239.171.228 8075 (MICROSOFT...)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 54.192.219.92 16509 (AMAZON-02)
1 151.101.12.157 54113 (FASTLY)
1 142.250.185.130 15169 (GOOGLE)
2 6 216.58.212.166 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 185.199.109.154 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
2 2 2620:119:50e1... 14413 (LINKEDIN)
1 1 2620:1ec:22::14 8068 (MICROSOFT...)
1 108.174.10.14 14413 (LINKEDIN)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
2 2a03:2880:f11... 32934 (FACEBOOK)
4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 13.32.22.102 16509 (AMAZON-02)
1 2.18.235.40 16625 (AKAMAI-AS)
1 104.244.42.195 13414 (TWITTER)
3 52.84.45.12 16509 (AMAZON-02)
1 52.84.45.59 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2603:1020:1101:: 8075 (MICROSOFT...)
2 2 13.248.242.197 16509 (AMAZON-02)
2 2603:1030:501... 8075 (MICROSOFT...)
2 13.69.106.216 8075 (MICROSOFT...)
117 43
Apex Domain
Subdomains
Transfer
40 trustwave.com
www.trustwave.com
691 KB
15 windows.net
trustwave.blob.core.windows.net
1 MB
11 gstatic.com
www.gstatic.com
fonts.gstatic.com
427 KB
8 doubleclick.net
10419288.fls.doubleclick.net
9785483.fls.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
3 KB
8 google.com
www.google.com
adservice.google.com
22 KB
4 footprintdns.com
6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com Failed
e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com
669 B
4 linkedin.com
px.ads.linkedin.com
www.linkedin.com
px4.ads.linkedin.com
3 KB
4 atmrum.net
www.atmrum.net
4 KB
4 fonts.net
fast.fonts.net
42 KB
3 terminus.services
vidassets.terminus.services
4 KB
3 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
62 KB
3 google-analytics.com
www.google-analytics.com
60 KB
3 cookiepro.com
cookie-cdn.cookiepro.com
24 KB
2 visualstudio.com
dc.services.visualstudio.com
238 B
2 adsrvr.org
match.adsrvr.org
1019 B
2 google.de
www.google.de
171 B
2 facebook.com
www.facebook.com
315 B
2 facebook.net
connect.facebook.net
98 KB
2 marketo.net
munchkin.marketo.net
5 KB
1 onetrust.com
geolocation.onetrust.com
111 B
1 mktoresp.com
815-rfm-693.mktoresp.com
311 B
1 addthisedge.com
v1.addthisedge.com
325 B
1 twitter.com
analytics.twitter.com
658 B
1 moatads.com
z.moatads.com
1 KB
1 t.co
t.co
453 B
1 githubassets.com
github.githubassets.com
11 KB
1 googleadservices.com
www.googleadservices.com
14 KB
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 licdn.com
snap.licdn.com
2 KB
1 msecnd.net
az416426.vo.msecnd.net
22 KB
1 addthis.com
s7.addthis.com
114 KB
1 vimeo.com
player.vimeo.com
7 KB
1 github.com
gist.github.com
8 KB
1 googletagmanager.com
www.googletagmanager.com
62 KB
117 34
Domain Requested by
40 www.trustwave.com 15 redirects www.trustwave.com
az416426.vo.msecnd.net
15 trustwave.blob.core.windows.net www.trustwave.com
7 fonts.gstatic.com www.trustwave.com
www.google.com
6 www.google.com www.trustwave.com
www.gstatic.com
www.google.com
4 www.gstatic.com www.google.com
www.gstatic.com
4 www.atmrum.net www.trustwave.com
www.atmrum.net
az416426.vo.msecnd.net
4 fast.fonts.net www.trustwave.com
fast.fonts.net
3 vidassets.terminus.services www.googletagmanager.com
www.trustwave.com
3 9785483.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.trustwave.com
3 10419288.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.trustwave.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
az416426.vo.msecnd.net
3 cookie-cdn.cookiepro.com www.trustwave.com
cookie-cdn.cookiepro.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com www.trustwave.com
2 match.adsrvr.org 2 redirects
2 6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com www.trustwave.com
2 adservice.google.com 9785483.fls.doubleclick.net
10419288.fls.doubleclick.net
2 www.google.de www.trustwave.com
2 www.facebook.com www.trustwave.com
connect.facebook.net
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net www.trustwave.com
connect.facebook.net
2 munchkin.marketo.net www.trustwave.com
1 geolocation.onetrust.com www.trustwave.com
1 815-rfm-693.mktoresp.com az416426.vo.msecnd.net
1 vars.hotjar.com static.hotjar.com
1 v1.addthisedge.com s7.addthis.com
1 analytics.twitter.com static.ads-twitter.com
1 z.moatads.com s7.addthis.com
1 script.hotjar.com static.hotjar.com
1 t.co www.trustwave.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 stats.g.doubleclick.net az416426.vo.msecnd.net
1 px4.ads.linkedin.com www.trustwave.com
1 www.linkedin.com 1 redirects
1 github.githubassets.com gist.github.com
1 www.googleadservices.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 az416426.vo.msecnd.net www.trustwave.com
1 s7.addthis.com www.trustwave.com
1 player.vimeo.com www.trustwave.com
1 gist.github.com www.trustwave.com
1 www.googletagmanager.com www.trustwave.com
0 d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com Failed www.trustwave.com
117 45
Subject Issuer Validity Valid
www.trustwave.com
Trustwave Extended Validation SHA256 CA, Level 1
2020-11-10 -
2021-11-25
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-06 -
2022-07-05
a year crt.sh
www.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.github.com
DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
2021-03-25 -
2022-03-30
a year crt.sh
*.vimeo.com
GlobalSign Atlas R3 DV TLS CA 2020
2021-05-21 -
2022-06-22
a year crt.sh
atmrum.net
Microsoft Azure TLS Issuing CA 02
2021-06-14 -
2022-06-09
a year crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2021-04-25 -
2022-04-27
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
cookiepro.com
Cloudflare Inc ECC CA-3
2021-05-20 -
2022-05-19
a year crt.sh
sni1e6ffgl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA
2020-04-16 -
2022-04-21
2 years crt.sh
*.gstatic.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01
2021-05-17 -
2022-05-17
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2021-04-30 -
2022-05-11
a year crt.sh
*.hotjar.com
Amazon
2020-12-25 -
2022-01-23
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-21 -
2022-07-26
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-07-20 -
2021-10-18
3 months crt.sh
*.githubassets.com
DigiCert SHA2 High Assurance Server CA
2020-11-02 -
2021-11-09
a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2021-04-15 -
2021-10-15
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2021-01-12 -
2022-01-11
a year crt.sh
*.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-01-21 -
2022-01-25
a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
*.terminus.services
Amazon
2020-12-16 -
2022-01-14
a year crt.sh
*.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA
2020-01-17 -
2022-01-21
2 years crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2021-02-12 -
2022-02-11
a year crt.sh
*.footprintdns.com
Microsoft Azure TLS Issuing CA 01
2021-06-08 -
2022-06-03
a year crt.sh
in.applicationinsights.azure.com
Microsoft RSA TLS CA 01
2021-07-22 -
2022-07-22
a year crt.sh

This page contains 5 frames:

Primary Page: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Frame ID: B288C4F51B6B5545867A671611992023
Requests: 104 HTTP requests in this frame

Frame: https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Frame ID: ECFC27600C2C61ED8E19868BEBB1B507
Requests: 2 HTTP requests in this frame

Frame: https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Frame ID: 64855628678CD038DA3FFCAC6EC5BBB1
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Frame ID: 57B80B3BE33BAB5443B4C22CDEAE5E6D
Requests: 7 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Frame ID: FF73A614FB00C2B75BE03C1B85AD99EA
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • script /\/recaptcha\/api\.js/i

Page Statistics

117
Requests

98 %
HTTPS

51 %
IPv6

34
Domains

45
Subdomains

43
IPs

6
Countries

2823 kB
Transfer

5130 kB
Size

18
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29
  • https://www.trustwave.com/media/16992/reprint_the-forrester-wave_global-managed-security-services-providers_q3-2020-cover.png?anchor=center&mode=crop&width=400&rnd=132404200250000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/6/3/4/1/4/b/63414b969e6787641dc91084b6f18b91fbc35a81.png
Request Chain 30
  • https://www.trustwave.com/media/16795/once-future-cover-image.png?anchor=center&mode=crop&width=400&rnd=132344863110000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/d/c/7/c/7/7/dc7c77f38e04362a6e2e5af76bdc5e200832731d.png
Request Chain 31
  • https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
Request Chain 32
  • https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
Request Chain 33
  • https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
Request Chain 34
  • https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
Request Chain 35
  • https://www.trustwave.com/media/17984/buyers-guide-for-mdr-services-cover.png?anchor=center&mode=crop&width=400&rnd=132672081070000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/d/f/4/e/2/b/df4e2b539469398aae6072a07b533996d3cb17a2.png
Request Chain 36
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Request Chain 37
  • https://www.trustwave.com/media/18115/supplychainrisk-blogheader.jpg?anchor=center&mode=crop&width=400&rnd=132725806090000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/4/1/7/2/f/8/4172f893e52e6d7ce3a20c6e9c3d4ec24fc6e323.jpg
Request Chain 38
  • https://www.trustwave.com/media/18092/managed-security-and-compliance-services_cover.png?anchor=center&mode=crop&width=400&rnd=132719716320000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/3/f/0/4/3/6/3f043692f27dcf4ea5b40d12d7603b92fa71add1.png
Request Chain 39
  • https://www.trustwave.com/media/17186/adp-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132448500440000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/0/6/a/f/a/f/06afafc72bd6d274723e1e23b9b2d3b1aaa18f61.png
Request Chain 40
  • https://www.trustwave.com/media/16698/sae-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315349770000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/3/8/3/3/f/b/3833fb93c432ff11f8a5a99d28a65f11bfecf9e0.png
Request Chain 41
  • https://www.trustwave.com/media/18008/sector-event-header.jpg?anchor=center&mode=crop&width=400&rnd=132684340710000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/0/4/b/4/9/8/04b4980cda4c00b539e5f10fbbc2b0092691c92e.jpg
Request Chain 42
  • https://www.trustwave.com/media/18093/securing-hybrid-webinar-cover.jpg?anchor=center&mode=crop&width=400&rnd=132719721010000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/d/2/d/9/7/4/d2d974c19e3e15cbe51dc55606ff04dfbcd27704.jpg
Request Chain 44
  • https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
Request Chain 59
  • https://10419288.fls.doubleclick.net/activityi;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F HTTP 302
  • https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Request Chain 60
  • https://9785483.fls.doubleclick.net/activityi;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F HTTP 302
  • https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Request Chain 66
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26time%3D1628522733356%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fblogs%252Fspiderlabs-blog%252Fthe-curious-case-of-the-malicious-iis-module%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&liSync=true&e_ipv6=AQIGXzWfXCdSWgAAAXsrhOL7Yn9-ZaYNiZO2C2buuEzlVOtPetEby5GjXqKZTHFx6Yi47H8U
Request Chain 103
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614 HTTP 302
  • https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614&t=f8f5a413-65fd-44d4-b983-58eb84e4b859

117 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
114 KB
28 KB
Document
General
Full URL
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
c37a2501cb22946026cbb1f06b5ff2191cd1eabd565c21db3e95ef24c3120dfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.trustwave.com
:scheme
https
:path
/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control
no-cache
pragma
no-cache
content-type
text/html; charset=utf-8
content-encoding
gzip
expires
-1
vary
Accept-Encoding
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890;Path=/;Domain=www.trustwave.com ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890;Path=/;Domain=www.trustwave.com;SameSite=None;Secure
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:32 GMT
content-length
27848
9c85e15b-99ed-40a4-929d-2262f9ed2706.css
fast.fonts.net/cssapi/
6 KB
1 KB
Stylesheet
General
Full URL
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:e04e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6603122bf60f4b09cfab59cdc08d792c28773607d897ed680c7c0b607a44a879

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1947
x-amz-request-id
524DRFJVFDKC9674
x-amz-id-2
QhCkM17NqP9x1wM64UDESLrcOKfKqa0dhTeMfIRLkr4y/1GdLB0zzBOJpwvX9BiUWamx9Y2GRuo=
last-modified
Wed, 17 Feb 2021 13:45:35 GMT
server
cloudflare
etag
W/"95ca4d48d1f182a3a2e88fda5b54d70c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
expires
Mon, 09 Aug 2021 19:25:32 GMT
cache-control
public, max-age=14400
cf-ray
67c1ff690d16beec-FRA
x-amz-meta-mtime
1588085447
styles.min.css
www.trustwave.com/dist/css/
240 KB
31 KB
Stylesheet
General
Full URL
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9afb9a9c7d5087ea4eec42c5bde02113fcdbc2cd45f0b257813365bffb82569f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/dist/css/styles.min.css?v=36jj
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:30 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"079a66bc887d71:0"
vary
Accept-Encoding
content-type
text/css
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
32047
x-xss-protection
1; mode=block
api.js
www.google.com/recaptcha/
850 B
645 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
9bb2d4aa044534807ef8ecfd35152fc826f2f5422daa3930bbe86e82e0ef76dc
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
553
x-xss-protection
1; mode=block
expires
Mon, 09 Aug 2021 15:25:32 GMT
api.js
www.google.com/recaptcha/
884 B
653 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?render=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f1f6fe3efae121205ed3317f00bea4b292c128e19003910baa75fdaa645c515d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
584
x-xss-protection
1; mode=block
expires
Mon, 09 Aug 2021 15:25:32 GMT
gtm.js
www.googletagmanager.com/
177 KB
62 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
191b9e47f836e0e1d6f0eab911211aa7754f678b0671e0aeec01a0c44ca94898
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
63083
x-xss-protection
0
last-modified
Mon, 09 Aug 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 09 Aug 2021 15:25:33 GMT
Singtel%20Logo.svg
www.trustwave.com/img/logo/
5 KB
2 KB
Image
General
Full URL
https://www.trustwave.com/img/logo/Singtel%20Logo.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ace78f63f590160b0748a26e60d8b453b4d4ac8bc4da20967632bf7e5bcb58e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/logo/Singtel%20Logo.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
2141
x-xss-protection
1; mode=block
Optus%20Logo.svg
www.trustwave.com/img/logo/
3 KB
1 KB
Image
General
Full URL
https://www.trustwave.com/img/logo/Optus%20Logo.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2a1c9874549a1cb94b6e0dc5822b4f5ca14386d39214a8145670fc1c50045496
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/logo/Optus%20Logo.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
1228
x-xss-protection
1; mode=block
twitter.svg
www.trustwave.com/img/icon/social/svg/dark/
778 B
823 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/twitter.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/icon/social/svg/dark/twitter.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
etag
"0d04c82c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
778
x-xss-protection
1; mode=block
linkedin.svg
www.trustwave.com/img/icon/social/svg/dark/
636 B
681 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/linkedin.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/icon/social/svg/dark/linkedin.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
etag
"0d04c82c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
636
x-xss-protection
1; mode=block
facebook.svg
www.trustwave.com/img/icon/social/svg/dark/
446 B
491 B
Image
General
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/facebook.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/icon/social/svg/dark/facebook.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
etag
"0d04c82c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
446
x-xss-protection
1; mode=block
e4d308f1-644e-47a2-9bda-0eb17d8b34b3.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
17 KB
17 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/e4d308f1-644e-47a2-9bda-0eb17d8b34b3.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8f3fea60c61198c49932e79b6b11177b046e37431f78ab10e2a806b6b2bc4ddf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/e4d308f1-644e-47a2-9bda-0eb17d8b34b3.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:56 GMT
x-aspnet-version
etag
"0c2257bc887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
17028
x-xss-protection
1; mode=block
5affad26-8d9b-4fa8-9dda-dff1aec409bc.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
26 KB
26 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/5affad26-8d9b-4fa8-9dda-dff1aec409bc.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
52fe21fd06b3137814d74879c9230bc3d3273fbac9411c7c132bd5a12f75e434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/5affad26-8d9b-4fa8-9dda-dff1aec409bc.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:40 GMT
x-aspnet-version
etag
"05a9c71c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
26889
x-xss-protection
1; mode=block
69bb5abb-d5ec-4aba-a07e-f9350ccc8e44.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
95 KB
95 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/69bb5abb-d5ec-4aba-a07e-f9350ccc8e44.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4b9ff8de254b4ed3fd00088bad420a1a29af355700610fa9ff3bf4ce38741fb8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/69bb5abb-d5ec-4aba-a07e-f9350ccc8e44.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:42 GMT
x-aspnet-version
etag
"087cd72c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
97016
x-xss-protection
1; mode=block
57410826-1038-44b0-9d91-3183dd7284d6.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
145 KB
145 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/57410826-1038-44b0-9d91-3183dd7284d6.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2e1a04ecce497031f2a9c55b335a82ff044b7337f8e2cc4a1af83ef11a572920
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/57410826-1038-44b0-9d91-3183dd7284d6.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:40 GMT
x-aspnet-version
etag
"05a9c71c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
148268
x-xss-protection
1; mode=block
a89b13b7-253a-4aa1-be5f-209412449950.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
58 KB
58 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/a89b13b7-253a-4aa1-be5f-209412449950.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2de1c72229e7c059582d038e201322bd49009c2155570284b1b5e320937f4b80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/a89b13b7-253a-4aa1-be5f-209412449950.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:50 GMT
x-aspnet-version
etag
"03b9277c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
59599
x-xss-protection
1; mode=block
e9c6d54d-4492-4141-aae2-6089e8fc3ce7.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
36 KB
36 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/e9c6d54d-4492-4141-aae2-6089e8fc3ce7.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
fddcbf3913764ca70387ee7b59eadffc8d41072d9f6bdd8d566b667d3552deb5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/e9c6d54d-4492-4141-aae2-6089e8fc3ce7.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:56 GMT
x-aspnet-version
etag
"0c2257bc887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
37051
x-xss-protection
1; mode=block
88451342-2798-47f2-9b8b-60e712838b87.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
25 KB
25 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/88451342-2798-47f2-9b8b-60e712838b87.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
164fcaec76285c5aaeb134dd33c605bc090bc8a1aba73d7698f4410d876a6bd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/88451342-2798-47f2-9b8b-60e712838b87.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:46 GMT
x-aspnet-version
etag
"0e12f75c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
25264
x-xss-protection
1; mode=block
692a5899-5019-4ed0-833b-034bdf6f365f.png
www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/
29 KB
29 KB
Image
General
Full URL
https://www.trustwave.com/images/slblog-03-02-2018-10-57-10/spiderlabs/692a5899-5019-4ed0-833b-034bdf6f365f.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6b5372992cb38455e82677ab372db26dc114aae71243d25d15f06c03353c9d9b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/images/slblog-03-02-2018-10-57-10/spiderlabs/692a5899-5019-4ed0-833b-034bdf6f365f.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:42 GMT
x-aspnet-version
etag
"087cd72c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/png
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
29277
x-xss-protection
1; mode=block
7840987.js
gist.github.com/jgrunzweig/
85 KB
8 KB
Script
General
Full URL
https://gist.github.com/jgrunzweig/7840987.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
140.82.121.4 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-121-4-fra.github.com
Software
GitHub.com /
Resource Hash
36368204cddb9771eebfc704310c901be66970f3a9a0a35f3150728d507169a9
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events translator.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com render-temp.githubusercontent.com viewscreen.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With
content-length
5806
x-xss-protection
0
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
x-github-request-id
D196:6563:3DC6407:4059564:611148ED
x-frame-options
deny
etag
W/"36368204cddb9771eebfc704310c901b"
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
text/javascript; charset=utf-8
cache-control
max-age=0, private, must-revalidate
permissions-policy
interest-cohort=()
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events translator.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com render-temp.githubusercontent.com viewscreen.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker-3f088aa2.js gist.github.com/socket-worker-3f088aa2.js
accept-ranges
bytes
player.js
player.vimeo.com/api/
19 KB
7 KB
Script
General
Full URL
https://player.vimeo.com/api/player.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
176d19a05a6e38185fc105408cc8d89bb89f1ec6f6d6641451e712de0e653984
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Varnish-Cache
0
Content-Security-Policy
default-src 'none'; style-src 'unsafe-inline'
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
480
X-Cache
HIT
P3p
CP="This is not a P3P policy! See https://vimeo.com/privacy"
Connection
keep-alive
X-VServer
infra-playproxy-b-3
Content-Length
5941
X-Xss-Protection
1; mode=block
X-Served-By
cache-fra19131-FRA
X-Player-Backend
p
Expires
Mon, 09 Aug 2021 15:47:33 GMT
Server
nginx
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-Timer
S1628522733.220741,VS0,VE0
Date
Mon, 09 Aug 2021 15:25:33 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript;charset=utf-8
Via
1.1 varnish, 1.1 varnish
Vary
Accept-Encoding
X-Vimeo-DC
ge
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
X-Cache-Hits
511
scripts.min.js
www.trustwave.com/dist/js/
442 KB
137 KB
Script
General
Full URL
https://www.trustwave.com/dist/js/scripts.min.js?v=v83jj
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4ab535547e1cfc0244eb7e921282ab96098a52b09eda40da8da98a59cfef3fde
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/dist/js/scripts.min.js?v=v83jj
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:30 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"079a66bc887d71:0"
vary
Accept-Encoding
content-type
application/x-javascript
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
139824
x-xss-protection
1; mode=block
rum.js
www.atmrum.net/
301 B
607 B
Script
General
Full URL
https://www.atmrum.net/rum.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
x-content-type-options
nosniff
last-modified
Fri, 02 Jul 2021 00:09:25 GMT
x-msedge-ref
Ref A: 22E708B1EA4346EA8AB9AA637EB00F13 Ref B: PRAEDGE1021 Ref C: 2021-08-09T15:25:33Z
etag
0x8D4FC0223F2F653
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
301
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Mon, 09 Aug 2021 15:25:33 GMT
x-host
s7.addthis.com
content-length
116325
munchkin.js
munchkin.marketo.net/154/
8 KB
4 KB
Script
General
Full URL
https://munchkin.marketo.net/154/munchkin.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9298a280eda6b54290d3c69fda3ae7da0cec1a0169d01d4e5944af63d68939d5

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 09 Aug 2021 15:25:33 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 May 2018 02:45:27 GMT
Server
AkamaiNetStorage
ETag
"808fc844032f646c32adce24553838be:1526611527"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
3700
Expires
Wed, 17 Nov 2021 15:25:33 GMT
5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
cookie-cdn.cookiepro.com/langswitch/
2 KB
1 KB
Script
General
Full URL
https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9545498791418ba2847374815a974cc5bad7368ffb1df4c44c67d25027dd219e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
content-md5
2Q95fkKCF+yYcVGygzYfBA==
age
7131
x-ms-lease-status
unlocked
last-modified
Mon, 29 Apr 2019 14:20:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
bb3bc517-601e-0082-605b-3779f3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
67c1ff6a794b1f51-FRA
1.css
fast.fonts.net/t/
0
242 B
Stylesheet
General
Full URL
https://fast.fonts.net/t/1.css?apiType=css&projectid=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: fast.fonts.net
URL: https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:e04e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
cf-cache-status
HIT
age
289355
cf-ray
67c1ff694d46beec-FRA
content-length
0
x-amz-id-2
CPcqX2VK8VuBYzih1jpcJ5mCdRJjmmuwBnXTSFjJTFGIsbw3VT8odAdWB9eczYLeba/Z7ziLl70=
last-modified
Tue, 23 Mar 2021 12:59:23 GMT
server
cloudflare
etag
"d41d8cd98f00b204e9800998ecf8427e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
1KPPTX06WFMA7SPN
cache-control
public, max-age=0, s-maxage=604800
accept-ranges
bytes
content-type
text/css; charset=utf-8
x-amz-meta-mtime
1519217722
ai.0.js
az416426.vo.msecnd.net/scripts/a/
94 KB
22 KB
Script
General
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FA5) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1371
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (frc/8FA5)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
91b0f2c8-201e-0099-5e2f-8d97c8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Mon, 09 Aug 2021 15:55:33 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/
341 KB
133 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b468609a3058aeac4dcd21581d0d8ce84ee810878a513735ed4a1676fd3b77fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 13:22:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7386
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
135980
x-xss-protection
0
last-modified
Mon, 02 Aug 2021 02:15:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 09 Aug 2022 13:22:27 GMT
logo-trustwave-white.svg
www.trustwave.com/img/logo/
3 KB
1 KB
Image
General
Full URL
https://www.trustwave.com/img/logo/logo-trustwave-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/logo/logo-trustwave-white.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
1354
x-xss-protection
1; mode=block
63414b969e6787641dc91084b6f18b91fbc35a81.png
trustwave.blob.core.windows.net/cache/6/3/4/1/4/b/
Redirect Chain
  • https://www.trustwave.com/media/16992/reprint_the-forrester-wave_global-managed-security-services-providers_q3-2020-cover.png?anchor=center&mode=crop&width=400&rnd=132404200250000000
  • https://trustwave.blob.core.windows.net/cache/6/3/4/1/4/b/63414b969e6787641dc91084b6f18b91fbc35a81.png
81 KB
82 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/6/3/4/1/4/b/63414b969e6787641dc91084b6f18b91fbc35a81.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
44f60c08d39f76681af5e1eada34c18b7754a089f1403eea70c86c56c171a425

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 28 Jul 2021 14:28:04 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
OXk1n/bqvmijIZPuBQ7LaQ==
ETag
0x8D951D3E9229A89
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
1903c5bd-301e-0027-0d32-8d7962000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
82963

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/6/3/4/1/4/b/63414b969e6787641dc91084b6f18b91fbc35a81.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
dc7c77f38e04362a6e2e5af76bdc5e200832731d.png
trustwave.blob.core.windows.net/cache/d/c/7/c/7/7/
Redirect Chain
  • https://www.trustwave.com/media/16795/once-future-cover-image.png?anchor=center&mode=crop&width=400&rnd=132344863110000000
  • https://trustwave.blob.core.windows.net/cache/d/c/7/c/7/7/dc7c77f38e04362a6e2e5af76bdc5e200832731d.png
26 KB
27 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/d/c/7/c/7/7/dc7c77f38e04362a6e2e5af76bdc5e200832731d.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
c99841b9fa07daa705c029caca740cbd2d8c4b53b07c5b7999e7fe7da91e6670

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 20 May 2021 22:13:47 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
af88Lml3DW25n2ABu8zXOw==
ETag
0x8D91BDC8A276853
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
a8455558-d01e-003f-3f32-8da605000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
26903

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/d/c/7/c/7/7/dc7c77f38e04362a6e2e5af76bdc5e200832731d.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/
Redirect Chain
  • https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000
  • https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
276 KB
277 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
19a5abc3ee71d9689286163dd786564ab2d59a118563fc140e62fa96d0d386df

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 04 Aug 2021 14:54:30 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
2nJMTgekKPiIq9CgmTKqrg==
ETag
0x8D95757C3D9AC4D
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
c6ef6398-701e-00a0-7032-8dea07000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
282667

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
5a6834a869db6f970c8f090a022f77a1c482c6a8.png
trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/
Redirect Chain
  • https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000
  • https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
53 KB
54 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
049bf83ad4e353fb4bce7d9fff2ba6b0996aa1a8bbdba76ca83a2ee78c887687

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Fri, 06 Nov 2020 12:23:38 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
7yCcZEg8vp+Cqn2BqP21Mw==
ETag
0x8D8824ECA31B220
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
84d41ac9-f01e-0007-7032-8d02c5000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
54413

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/
Redirect Chain
  • https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000
  • https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
142 KB
143 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2e45a8996ec5c8b3fce4c3f71fc56ef806673998113d09c32f73c7a3d6efdb38

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 07 Apr 2021 18:45:16 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
5UtgQThYJzYHnzR2krDd3w==
ETag
0x8D8F9F54990AA7D
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
c6ef6282-701e-00a0-8032-8dea07000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
145855

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/
Redirect Chain
  • https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000
  • https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
32 KB
32 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
14da1d6311764bee490145f7909d480858b94fc01c6ba2b5d8c112feabe53a99

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 28 Jan 2021 22:24:11 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
wcV8714ZrmJmS6VqXbqxbQ==
ETag
0x8D8C3DB6FA8E30B
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
1903c560-301e-0027-3b32-8d7962000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
32269

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
df4e2b539469398aae6072a07b533996d3cb17a2.png
trustwave.blob.core.windows.net/cache/d/f/4/e/2/b/
Redirect Chain
  • https://www.trustwave.com/media/17984/buyers-guide-for-mdr-services-cover.png?anchor=center&mode=crop&width=400&rnd=132672081070000000
  • https://trustwave.blob.core.windows.net/cache/d/f/4/e/2/b/df4e2b539469398aae6072a07b533996d3cb17a2.png
316 KB
317 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/d/f/4/e/2/b/df4e2b539469398aae6072a07b533996d3cb17a2.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4bc6413276d4b73e8c889d6517197cb9fda32a359035afdf5e02db53d6f96f11

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:34 GMT
Last-Modified
Thu, 03 Jun 2021 16:02:59 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
KTNKRe9blW9sykFhvn6DpA==
ETag
0x8D926A90F424547
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
cb2aa184-701e-0026-3332-8d26be000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
323885

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/d/f/4/e/2/b/df4e2b539469398aae6072a07b533996d3cb17a2.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/
Redirect Chain
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
9 KB
10 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
9998a28912966aa8ae78c7bae4b70bce32095ac4cafb972428f96c60bf374a98

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 28 Jan 2021 22:24:11 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
MsdJ7/i6e4BXG2Gh7eeTmQ==
ETag
0x8D8C3DB6FA47557
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
a845551e-d01e-003f-1132-8da605000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
9529

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
4172f893e52e6d7ce3a20c6e9c3d4ec24fc6e323.jpg
trustwave.blob.core.windows.net/cache/4/1/7/2/f/8/
Redirect Chain
  • https://www.trustwave.com/media/18115/supplychainrisk-blogheader.jpg?anchor=center&mode=crop&width=400&rnd=132725806090000000
  • https://trustwave.blob.core.windows.net/cache/4/1/7/2/f/8/4172f893e52e6d7ce3a20c6e9c3d4ec24fc6e323.jpg
15 KB
15 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/4/1/7/2/f/8/4172f893e52e6d7ce3a20c6e9c3d4ec24fc6e323.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
27624a6de0fad61d9683f8d2df3dad590690d76da6cc076d22c4278b58c229e3

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 04 Aug 2021 19:57:39 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
hLsL9MSj8xly9ehw6ywjvQ==
ETag
0x8D957821CEE7120
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
c08b1f90-a01e-0047-6332-8d05fd000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
15037

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/4/1/7/2/f/8/4172f893e52e6d7ce3a20c6e9c3d4ec24fc6e323.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
3f043692f27dcf4ea5b40d12d7603b92fa71add1.png
trustwave.blob.core.windows.net/cache/3/f/0/4/3/6/
Redirect Chain
  • https://www.trustwave.com/media/18092/managed-security-and-compliance-services_cover.png?anchor=center&mode=crop&width=400&rnd=132719716320000000
  • https://trustwave.blob.core.windows.net/cache/3/f/0/4/3/6/3f043692f27dcf4ea5b40d12d7603b92fa71add1.png
111 KB
111 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/3/f/0/4/3/6/3f043692f27dcf4ea5b40d12d7603b92fa71add1.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
50d22582135c1457f139318edebb3283eb206bbacb4fefeab79156a5efd5faa2

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 28 Jul 2021 18:48:49 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
8p6BPlwe86bVPkeGyLj9XA==
ETag
0x8D951F85698BD88
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
c08b201c-a01e-0047-5e32-8d05fd000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
113286

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/3/f/0/4/3/6/3f043692f27dcf4ea5b40d12d7603b92fa71add1.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
06afafc72bd6d274723e1e23b9b2d3b1aaa18f61.png
trustwave.blob.core.windows.net/cache/0/6/a/f/a/f/
Redirect Chain
  • https://www.trustwave.com/media/17186/adp-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132448500440000000
  • https://trustwave.blob.core.windows.net/cache/0/6/a/f/a/f/06afafc72bd6d274723e1e23b9b2d3b1aaa18f61.png
16 KB
17 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/0/6/a/f/a/f/06afafc72bd6d274723e1e23b9b2d3b1aaa18f61.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
030c1e4eced902d0d6d3215f8f9078ba504b61c697b931fd9829887a9075d126

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 17 Sep 2020 21:04:03 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
PXcEN3gAVUErtmdW6IDHcA==
ETag
0x8D85B4D3539C967
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
cb2aa12b-701e-0026-6032-8d26be000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
16601

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/0/6/a/f/a/f/06afafc72bd6d274723e1e23b9b2d3b1aaa18f61.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
3833fb93c432ff11f8a5a99d28a65f11bfecf9e0.png
trustwave.blob.core.windows.net/cache/3/8/3/3/f/b/
Redirect Chain
  • https://www.trustwave.com/media/16698/sae-trial-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=132315349770000000
  • https://trustwave.blob.core.windows.net/cache/3/8/3/3/f/b/3833fb93c432ff11f8a5a99d28a65f11bfecf9e0.png
19 KB
19 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/3/8/3/3/f/b/3833fb93c432ff11f8a5a99d28a65f11bfecf9e0.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
55e16d248a51e62be7f1c6308a4d9e53d167b882942e2d37d6d8cdd818f6af7f

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 10 Feb 2021 23:42:26 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
FnBLR9DOXrQA5uHOgGV3Lg==
ETag
0x8D8CE1D8586DBC9
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
84d41beb-f01e-0007-7932-8d02c5000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
19039

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/3/8/3/3/f/b/3833fb93c432ff11f8a5a99d28a65f11bfecf9e0.png
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
04b4980cda4c00b539e5f10fbbc2b0092691c92e.jpg
trustwave.blob.core.windows.net/cache/0/4/b/4/9/8/
Redirect Chain
  • https://www.trustwave.com/media/18008/sector-event-header.jpg?anchor=center&mode=crop&width=400&rnd=132684340710000000
  • https://trustwave.blob.core.windows.net/cache/0/4/b/4/9/8/04b4980cda4c00b539e5f10fbbc2b0092691c92e.jpg
10 KB
10 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/0/4/b/4/9/8/04b4980cda4c00b539e5f10fbbc2b0092691c92e.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
37e1a0fe9cb3b8cccde605f99f54dfe0612196c3177d521d36be8abed50a3e7d

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 17 Jun 2021 20:08:52 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
QmLQr3zfFmq7vd8M/5QJcg==
ETag
0x8D931CBBA727A61
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
a845558d-d01e-003f-6b32-8da605000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
9827

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/0/4/b/4/9/8/04b4980cda4c00b539e5f10fbbc2b0092691c92e.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
d2d974c19e3e15cbe51dc55606ff04dfbcd27704.jpg
trustwave.blob.core.windows.net/cache/d/2/d/9/7/4/
Redirect Chain
  • https://www.trustwave.com/media/18093/securing-hybrid-webinar-cover.jpg?anchor=center&mode=crop&width=400&rnd=132719721010000000
  • https://trustwave.blob.core.windows.net/cache/d/2/d/9/7/4/d2d974c19e3e15cbe51dc55606ff04dfbcd27704.jpg
16 KB
17 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/d/2/d/9/7/4/d2d974c19e3e15cbe51dc55606ff04dfbcd27704.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
1ab02dadb2dc4da565d23f726991b238340b0ac2dc92982944c8ed56b1ffaa89

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Wed, 28 Jul 2021 18:56:56 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
cDii0FDHNU6vpuuwdZyVKA==
ETag
0x8D951F978DAAF28
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
a84555c6-d01e-003f-1b32-8da605000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
16478

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/d/2/d/9/7/4/d2d974c19e3e15cbe51dc55606ff04dfbcd27704.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
logo-trustwave-25-ver-white.png
www.trustwave.com/media/17452/
9 KB
9 KB
Image
General
Full URL
https://www.trustwave.com/media/17452/logo-trustwave-25-ver-white.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8fdceff414f9b7f984ec9a14c5a75a30c9311a076324d3d7fb08c611c479ebc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/media/17452/logo-trustwave-25-ver-white.png
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
x-frame-options
SAMEORIGIN
date
Mon, 09 Aug 2021 15:25:34 GMT
vary
Accept-Encoding
content-type
image/png
cache-control
public, must-revalidate, max-age=31536000
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
8874
x-xss-protection
1; mode=block
expires
Tue, 09 Aug 2022 15:25:33 GMT
9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/
Redirect Chain
  • https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000
  • https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
8 KB
9 KB
Image
General
Full URL
https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.171.228 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
cb8fd428f0d96267a4df07e3603d7e9fc4f424096eec1923269d49efa9f31dbb

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 09 Aug 2021 15:25:33 GMT
Last-Modified
Thu, 28 Jan 2021 22:24:11 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
YYg1/108u00f4mbVmhIfVw==
ETag
0x8D8C3DB6FA70DE0
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
84d41c86-f01e-0007-0132-8d02c5000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
8271

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:33 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
cache-control
no-cache
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
content-length
219
x-xss-protection
1; mode=block
loading-white.svg
www.trustwave.com/img/utility/
687 B
782 B
Image
General
Full URL
https://www.trustwave.com/img/utility/loading-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/utility/loading-white.svg
pragma
no-cache
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.trustwave.com
referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
etag
"0d04c82c887d71:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
687
x-xss-protection
1; mode=block
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v20/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxP.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 02 Aug 2021 20:40:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
585916
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20742
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 02 Aug 2022 20:40:17 GMT
KFOlCnqEu92Fr1MmEU9fBBc9.ttf
fonts.gstatic.com/s/roboto/v20/
36 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
719df7954428f52779f3fa18641c19fc854b39394193d87eea5a61795dec8dbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 03:25:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
561588
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20908
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 03 Aug 2022 03:25:45 GMT
MaterialIcons-Regular.woff2
www.trustwave.com/fonts/material-icons/
43 KB
43 KB
Font
General
Full URL
https://www.trustwave.com/fonts/material-icons/MaterialIcons-Regular.woff2
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://www.trustwave.com
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
:path
/fonts/material-icons/MaterialIcons-Regular.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=36jj
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:01:30 GMT
x-aspnet-version
etag
"079a66bc887d71:0"
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff2
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
44300
x-xss-protection
1; mode=block
KFOlCnqEu92Fr1MmWUlfBBc9.ttf
fonts.gstatic.com/s/roboto/v20/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a637d3ff767789f9b113bbfa208bdb6a76efed7c4c111da2a130f6a38a51d353
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 02 Aug 2021 18:40:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
593103
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20796
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:59 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 02 Aug 2022 18:40:30 GMT
d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2
fast.fonts.net/dv2/14/
20 KB
20 KB
Font
General
Full URL
https://fast.fonts.net/dv2/14/d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2?d44f19a684109620e4841470a190e8187da2675ee4d21384fcc31c18ab36cd3000b30c7b2714554b2fa45c7114a369ae46a92d2cbcc413b53d0101698114ce8d7e74e9017f28ef808677fbf0b28df9dd5c148045f073a59c253d54554cb37ea9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: fast.fonts.net
URL: https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:e04e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f422b8961953524e333d562521c3b4e0a2ed33da87079bd92c08ec4389372358

Request headers

Origin
https://www.trustwave.com
Referer
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
cf-cache-status
HIT
age
6706
content-length
20472
x-amz-request-id
EK417FX2DZW3W779
x-amz-id-2
1FC4xW9t8i6nI+KLwQNqSYbF5IABPmzx5a0RcWGe2Ha1x1kQGjOtVl4I8rzQANH7dZxeZ7jtUUo=
expires
Mon, 09 Aug 2021 19:25:33 GMT
last-modified
Sat, 14 Nov 2020 21:18:12 GMT
server
cloudflare
etag
"6f6b6c30d8b67bbd1eab4672a7d86d64"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
67c1ff6a7d21536a-FRA
x-amz-meta-mtime
1417743636
KFOlCnqEu92Fr1MmSU5fBBc9.ttf
fonts.gstatic.com/s/roboto/v20/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b4c96f55c265e0a80be4243a16f7e88b9a67c85b71b4e2aa8cea4e1aa989b0d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 02 Aug 2021 23:09:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
576984
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20827
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:53 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 02 Aug 2022 23:09:09 GMT
71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2
fast.fonts.net/dv2/14/
20 KB
20 KB
Font
General
Full URL
https://fast.fonts.net/dv2/14/71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2?d44f19a684109620e4841470a190e8187da2675ee4d21384fcc31c18ab36cd3000b30c7b2714554b2fa45c7114a369ae46a92d2cbcc413b53d0101698114ce8d7e74e9017f28ef808677fbf0b28df9dd5c148045f073a59c253d54554cb37ea9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: fast.fonts.net
URL: https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:e04e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd1f1f47a863ac3be54dab002af884683776e666b68d50ec7641ca732991d54f

Request headers

Origin
https://www.trustwave.com
Referer
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
cf-cache-status
HIT
age
6249
content-length
20080
x-amz-request-id
FTVHWW00MWWDEDGJ
x-amz-id-2
M4I3WwpFjV3fT/edt4N68QQnEyMwhRzv9+WQICmh36Yza0zebh0EwwmetKjLYI119qimwPrhHX4=
expires
Mon, 09 Aug 2021 19:25:33 GMT
last-modified
Fri, 13 Nov 2020 23:30:15 GMT
server
cloudflare
etag
"13e00f91a428349f2cb5ae6744b4eb6d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
67c1ff6a7d24536a-FRA
x-amz-meta-mtime
1417743758
KFOkCnqEu92Fr1Mu51xIIzc.ttf
fonts.gstatic.com/s/roboto/v20/
37 KB
22 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzc.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/css/styles.min.css?v=36jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0dfa4684ad9c52a1a97d91764ef1d404c15dd95ed20f00a2f9f3f4d11df2abf9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 00:16:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
572938
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22299
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 03 Aug 2022 00:16:35 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
6539
date
Mon, 09 Aug 2021 13:36:34 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Mon, 09 Aug 2021 15:36:34 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
5 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:296::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 09 Aug 2021 15:25:33 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Jun 2021 01:25:13 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=36107
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2079
hotjar-1372211.js
static.hotjar.com/c/
4 KB
2 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-1372211.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.219.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-219-92.mrs52.r.cloudfront.net
Software
/
Resource Hash
4d968af0d0f4ec08e7226a2b72ce0614322df45c36850e52bdb6e399490a1ac2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:24:37 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
age
56
etag
W/744da13420ce55bbf3e1231c3e93f0db
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
x-amz-cf-pop
MRS52-P2
content-length
1900
via
1.1 ab94358e0d2d36f8b4f6ff94645b8b39.cloudfront.net (CloudFront)
x-amz-cf-id
XYvtY2S8fpBl47eyJE6gfrQWPSblscRC-IXDXOJ6OiTK8KZmxttssQ==
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
via
1.1 varnish
last-modified
Mon, 12 Jul 2021 21:25:31 GMT
age
55099
etag
"65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1958
x-timer
S1628522733.399294,VS0,VE0
x-served-by
cache-fra19147-FRA
conversion_async.js
www.googleadservices.com/pagead/
36 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13910
x-xss-protection
0
server
cafe
etag
8154934153164151798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 09 Aug 2021 15:25:33 GMT
activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fbl...
10419288.fls.doubleclick.net/ Frame ECFC
Redirect Chain
  • https://10419288.fls.doubleclick.net/activityi;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2...
  • https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.t...
623 B
418 B
Document
General
Full URL
https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f166.1e100.net
Software
cafe /
Resource Hash
4cd281df3bd61337094874b0c4773fec883363fb86709e7159226578e81e0f43
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10419288.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trustwave.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 09 Aug 2021 15:25:33 GMT
expires
Mon, 09 Aug 2021 15:25:33 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
393
x-xss-protection
0
set-cookie
IDE=AHWqTUnromfGk8Cs6Lb3QEVTOYO_AKIfE0yl3ujOTTR-ZkUQjG2qdLGFdSl3eaZbci0; expires=Sat, 03-Sep-2022 15:25:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 09 Aug 2021 15:25:33 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresour...
9785483.fls.doubleclick.net/ Frame 6485
Redirect Chain
  • https://9785483.fls.doubleclick.net/activityi;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Freso...
  • https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%...
492 B
411 B
Document
General
Full URL
https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f166.1e100.net
Software
cafe /
Resource Hash
5fe0267081facbcc679d3c6c5be216ab7cbb8266c85cd949e099cfcb2fe2f583
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9785483.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trustwave.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 09 Aug 2021 15:25:33 GMT
expires
Mon, 09 Aug 2021 15:25:33 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
386
x-xss-protection
0
set-cookie
IDE=AHWqTUlMGWCSbENACxnQb4hGjr5xEpzJpc0_PZh9YeCfhJPFFkex83z3X2pftbOhqWQ; expires=Sat, 03-Sep-2022 15:25:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 09 Aug 2021 15:25:33 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fbevents.js
connect.facebook.net/en_US/
98 KB
26 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25944
x-xss-protection
0
pragma
public
x-fb-debug
MHmsXLzLsYbNgTW9OxEXW+AAY/EKfYRceKW7pSq0rjzJcHj8vocplN/Yneta3zYzRGpv89NjziUaAWoymJHqXg==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
date
Mon, 09 Aug 2021 15:25:33 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
activityi;register_conversion=1;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspider...
10419288.fls.doubleclick.net/
0
0
Image
General
Full URL
https://10419288.fls.doubleclick.net/activityi;register_conversion=1;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f166.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

activityi;register_conversion=1;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%...
9785483.fls.doubleclick.net/
0
0
Image
General
Full URL
https://9785483.fls.doubleclick.net/activityi;register_conversion=1;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f166.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

gist-embed-9aaf32ed9e871ce21297cfc30356e101.css
github.githubassets.com/assets/
54 KB
11 KB
Stylesheet
General
Full URL
https://github.githubassets.com/assets/gist-embed-9aaf32ed9e871ce21297cfc30356e101.css
Requested by
Host: gist.github.com
URL: https://gist.github.com/jgrunzweig/7840987.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.109.154 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-109-154.github.com
Software
AmazonS3 /
Resource Hash
26531267fe98b17f07b013af741004e4164287cab7165901d8687a99994f23a7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id
cd03c7ff58016f2f62e58c4de6dd62177c2cb3b2
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
age
333403
x-cache
HIT, HIT
strict-transport-security
max-age=31536000
content-length
10585
via
1.1 varnish, 1.1 varnish
x-served-by
cache-dca17725-DCA, cache-cdg20765-CDG
last-modified
Thu, 05 Aug 2021 18:46:17 GMT
server
AmazonS3
etag
"6c34f2ee765ed533a372c67fcf6325d7"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
3, 1576
js
www.google-analytics.com/gtm/
105 KB
40 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-5B38B7F&t=gtm4&cid=1083470474.1628522733
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
539674653f6ef0a18dd4a167014c56d76be9d2f95a1e7651b054a82e34fe02d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41189
x-xss-protection
0
expires
Mon, 09 Aug 2021 15:25:33 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26time%3D1628522733356%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-ii...
0
155 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&liSync=true&e_ipv6=AQIGXzWfXCdSWgAAAXsrhOL7Yn9-ZaYNiZO2C2buuEzlVOtPetEby5GjXqKZTHFx6Yi47H8U
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-10-14.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:34 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-edc2
content-type
application/javascript
content-length
0
x-li-uuid
ZiIIhcysmRYghU4akisAAA==

Redirect headers

date
Mon, 09 Aug 2021 15:25:34 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&time=1628522733356&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&liSync=true&e_ipv6=AQIGXzWfXCdSWgAAAXsrhOL7Yn9-ZaYNiZO2C2buuEzlVOtPetEby5GjXqKZTHFx6Yi47H8U
x-li-proto
http/2
x-li-pop
prod-esv5
content-length
0
x-li-uuid
DCdQb8ysmRZAHEoHqyoAAA==
657537318161329
connect.facebook.net/signals/config/
253 KB
72 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/657537318161329?v=2.9.44&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ec20f46b9ae6e443d3b8b2de6f089098d8834d5e630ca0e90628bc4adfbbcd17
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
YnUqQBjshRZ962/KEABW46dv2hY/KahRpZjythauo1p5kgp124m8SvjNjFLplG5RHaT0JLVPklQtnybkMs3loQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Mon, 09 Aug 2021 15:25:33 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&a=2053283940&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&ul=en-us&de=UTF-8&dt=The%20Curious%20Case%20of%20the%20Malicious%20IIS%20Module%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEADQAAAAC~&jid=783426144&gjid=1916545339&cid=1083470474.1628522733&tid=UA-123880220-1&_gid=146567686.1628522733&_r=1&gtm=2wg84054M2ZJN&z=1923219696
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
90 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-123880220-1&cid=1083470474.1628522733&jid=783426144&gjid=1916545339&_gid=146567686.1628522733&_u=aGDAAEACQAAAAC~&z=1273162030
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 09 Aug 2021 15:25:33 GMT
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/494613180/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/494613180/?random=1628522733494&cv=9&fst=1628522733494&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&tiba=The%20Curious%20Case%20of%20the%20Malicious%20IIS%20Module%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c06436749a10d9fc5499145a94786175af58a8f0eb150721bd5f57e6ec9937fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1082
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
453 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o4ya5&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
pragma
no-cache
last-modified
Mon, 09 Aug 2021 15:25:33 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d5bb4f5c8d09381cc591f112888005ebb4d1f67e208e332d5f11a93d21e263c2
x-transaction
8a98ec7a3be70bea
expires
Tue, 31 Mar 1981 05:00:00 GMT
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=657537318161329&ev=PageView&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&rl=&if=false&ts=1628522733509&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1628522733508.998635287&it=1628522733363&coo=false&rqm=GET
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 09 Aug 2021 15:25:33 GMT
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-123880220-1&cid=1083470474.1628522733&jid=783426144&_u=aGDAAEACQAAAAC~&z=1059879437
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-123880220-1&cid=1083470474.1628522733&jid=783426144&_u=aGDAAEACQAAAAC~&z=1059879437
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
modules.9a6619e61150e4449f35.js
script.hotjar.com/
221 KB
59 KB
Script
General
Full URL
https://script.hotjar.com/modules.9a6619e61150e4449f35.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1372211.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.22.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-22-102.fra56.r.cloudfront.net
Software
/
Resource Hash
fc04d1fd608cedf1f0c4735145a15031f77cb7491d6234cec4ee2cd9be74937a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 05 Aug 2021 14:18:05 GMT
content-encoding
br
x-content-type-options
nosniff
age
349648
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
59579
access-control-allow-origin
*
last-modified
Thu, 05 Aug 2021 14:17:07 GMT
etag
"f404c80c4e9647abd5db65360cf9ecee"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C2
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
swg-EPmNoDdv-N_4O8sKLhzgn_M6Wz6cnsbkk0r0g7EiN64XVikRzA==
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v83jj
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 09 Aug 2021 15:25:33 GMT
Content-Encoding
gzip
Last-Modified
Fri, 28 May 2021 01:40:41 GMT
Server
AkamaiNetStorage
ETag
"5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
fpv2.min.js
www.atmrum.net/client/v1/atm/
3 KB
3 KB
Script
General
Full URL
https://www.atmrum.net/client/v1/atm/fpv2.min.js
Requested by
Host: www.atmrum.net
URL: https://www.atmrum.net/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
x-content-type-options
nosniff
last-modified
Fri, 02 Jul 2021 00:09:25 GMT
x-msedge-ref
Ref A: E487E9984CE34EB6B648B6B839438B92 Ref B: PRAEDGE1021 Ref C: 2021-08-09T15:25:33Z
etag
0x8D501F7AFB7338D
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
2983
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=60195
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
cookie-cdn.cookiepro.com/consent/
69 KB
16 KB
Script
General
Full URL
https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c3bfab00f5e70133e4daafbd95aea46f572bbcf33335ee75b9f2240742c7982
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
content-md5
tokLCuVTsBOR85IgoPx1iA==
age
7131
x-ms-lease-status
unlocked
last-modified
Mon, 29 Apr 2019 14:20:11 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c7e99030-101e-0021-6c8d-7f1c36000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
67c1ff6cedd41f51-FRA
adsct
analytics.twitter.com/i/
31 B
658 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=o4ya5&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
pragma
no-cache
last-modified
Mon, 09 Aug 2021 15:25:33 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d0a3bea7a632e4199b71432f27a572e0756ce297529b98361c0d5db536a69fe9
x-transaction
76b7547fca9db55f
expires
Tue, 31 Mar 1981 05:00:00 GMT
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-5286e9523a723348/
166 B
325 B
Script
General
Full URL
https://v1.addthisedge.com/live/boost/ra-5286e9523a723348/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
etag
659743217
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=14, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
154
anchor
www.google.com/recaptcha/api2/ Frame 57B8
39 KB
19 KB
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/recaptcha__en.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
ef1ca883dab926ea1c836d4d0a0486ede63d1b1c24cdd62bc411140fb8cfcd25
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ziPGL/2J65PCj6T19G97VQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trustwave.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.trustwave.com/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 09 Aug 2021 15:25:33 GMT
content-security-policy
script-src 'report-sample' 'nonce-ziPGL/2J65PCj6T19G97VQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
19899
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
t.js
vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/
4 KB
2 KB
Script
General
Full URL
https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.45.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-45-12.mrs52.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 14:42:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2576
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Tue, 20 Jul 2021 22:16:42 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
via
1.1 235fd46744276a751642777ed38c479c.cloudfront.net (CloudFront)
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
MRS52-P1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
-kn6mgVxVn_-IL6NovD25NJh92YGYhzFHYQ7JcNAKE2PAeoZjiNa6Q==
en-us.json
www.trustwave.com/locale/en-us/LC_MESSAGES/
1 KB
649 B
XHR
General
Full URL
https://www.trustwave.com/locale/en-us/LC_MESSAGES/en-us.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
21c3d65ef1a0105fb3114d843bd4c68e474e7571db6b0af5ca759fbfec9eca81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ai_user=t6sJy|2021-08-09T15:25:33.292Z; _gcl_au=1.1.1959751197.1628522733; _ga=GA1.2.1083470474.1628522733; _gid=GA1.2.146567686.1628522733; _gat_UA-123880220-1=1; ai_session=shwuZ|1628522733488.5|1628522733488.5; _fbp=fb.1.1628522733508.998635287; __atuvc=1%7C32; __atuvs=611148eda3b917f2000
request-id
|EdMn4.EYoyh
:path
/locale/en-us/LC_MESSAGES/en-us.json
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
X-Requested-With
XMLHttpRequest
Request-Id
|EdMn4.EYoyh
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
application/json
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
590
x-xss-protection
1; mode=block
ja-jp.json
www.trustwave.com/locale/ja-jp/LC_MESSAGES/
1 KB
924 B
XHR
General
Full URL
https://www.trustwave.com/locale/ja-jp/LC_MESSAGES/ja-jp.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7b0ef13b754c456f5621d74ca260e49b061f759bcaeb9223e0eaa78ff4359189
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ai_user=t6sJy|2021-08-09T15:25:33.292Z; _gcl_au=1.1.1959751197.1628522733; _ga=GA1.2.1083470474.1628522733; _gid=GA1.2.146567686.1628522733; _gat_UA-123880220-1=1; ai_session=shwuZ|1628522733488.5|1628522733488.5; _fbp=fb.1.1628522733508.998635287; __atuvc=1%7C32; __atuvs=611148eda3b917f2000
request-id
|EdMn4.MuTlG
:path
/locale/ja-jp/LC_MESSAGES/ja-jp.json
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
X-Requested-With
XMLHttpRequest
Request-Id
|EdMn4.MuTlG
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
application/json
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
877
x-xss-protection
1; mode=block
de-de.json
www.trustwave.com/locale/de-de/LC_MESSAGES/
1 KB
611 B
XHR
General
Full URL
https://www.trustwave.com/locale/de-de/LC_MESSAGES/de-de.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b5e5c5c8b9ebe9fb7f4a8cde7f2ff4f6652e6beb87585c18e99fb446fbb301a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ai_user=t6sJy|2021-08-09T15:25:33.292Z; _gcl_au=1.1.1959751197.1628522733; _ga=GA1.2.1083470474.1628522733; _gid=GA1.2.146567686.1628522733; _gat_UA-123880220-1=1; ai_session=shwuZ|1628522733488.5|1628522733488.5; _fbp=fb.1.1628522733508.998635287; __atuvc=1%7C32; __atuvs=611148eda3b917f2000
request-id
|EdMn4.3Y6o8
:path
/locale/de-de/LC_MESSAGES/de-de.json
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
X-Requested-With
XMLHttpRequest
Request-Id
|EdMn4.3Y6o8
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Aug 2021 18:02:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0d04c82c887d71:0"
vary
Accept-Encoding
content-type
application/json
date
Mon, 09 Aug 2021 15:25:33 GMT
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
accept-ranges
bytes
content-length
564
x-xss-protection
1; mode=block
box-25a418976ea02a6f393fbbe77cec94bb.html
vars.hotjar.com/ Frame FF73
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1372211.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.45.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-45-59.mrs52.r.cloudfront.net
Software
/
Resource Hash
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-25a418976ea02a6f393fbbe77cec94bb.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trustwave.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.trustwave.com/

Response headers

content-type
text/html
content-length
1044
date
Thu, 03 Jun 2021 10:15:05 GMT
accept-ranges
bytes
cache-control
max-age=31536000
content-encoding
br
etag
"76922233be8bdb14c053af468d29404a"
last-modified
Thu, 03 Jun 2021 10:14:54 GMT
x-amz-server-side-encryption
AES256
x-robots-tag
none
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 579cfbd9c011d359d737aee6a310afc2.cloudfront.net (CloudFront)
x-amz-cf-pop
MRS52-P1
x-amz-cf-id
q3UNifkNTK_eUwtYmmVc_AHaMEX7E_5b7eclodM3ZwpOsM-PsKLx2w==
age
5807428
/
www.google.com/pagead/1p-user-list/494613180/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/494613180/?random=1628522733494&cv=9&fst=1628521200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&frm=0&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&tiba=The%20Curious%20Case%20of%20the%20Malicious%20IIS%20Module%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&async=1&fmt=3&is_vtc=1&random=600132789&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/494613180/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/494613180/?random=1628522733494&cv=9&fst=1628521200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg840&sendb=1&frm=0&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&tiba=The%20Curious%20Case%20of%20the%20Malicious%20IIS%20Module%20%7C%20Trustwave%20%7C%20SpiderLabs%20%7C%20Trustwave&async=1&fmt=3&is_vtc=1&random=600132789&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
fpconfig.min.json
www.atmrum.net/conf/v1/atm/
191 B
500 B
XHR
General
Full URL
https://www.atmrum.net/conf/v1/atm/fpconfig.min.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:32 GMT
x-content-type-options
nosniff
last-modified
Fri, 02 Jul 2021 00:09:25 GMT
x-msedge-ref
Ref A: 59FF2C60E5E04F668E6215A47A1B2D7B Ref B: PRAEDGE0911 Ref C: 2021-08-09T15:25:33Z
etag
0x8D501F7AFB7338D
x-cache
CONFIG_NOCACHE
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
191
visitWebPage
815-rfm-693.mktoresp.com/webevents/
2 B
311 B
XHR
General
Full URL
https://815-rfm-693.mktoresp.com/webevents/visitWebPage?_mchNc=1628522733661&_mchCn=&_mchId=815-RFM-693&_mchTk=_mch-trustwave.com-1628522733661-76309&_mchHo=www.trustwave.com&_mchPo=&_mchRu=%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&_mchPc=https%3A&_mchVr=154&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 09 Aug 2021 15:25:34 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
e036455d-3a47-4d19-85bc-59787a4586f4
optanon.css
cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/optanon.css
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:678 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
content-md5
jzLE25vmrDR3ZmMxTSa8+w==
age
7130
x-ms-lease-status
unlocked
last-modified
Thu, 19 Sep 2019 18:59:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
58dc1d9a-201e-0015-4f02-422ffe000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
cf-ray
67c1ff6d6ecb1f51-FRA
EU
geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/
32 B
111 B
Script
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery331012383402374945152_1628522733532&_=1628522733533
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v83jj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
67c1ff6d6e02c26d-FRA
content-length
32
dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%...
adservice.google.com/ddm/fls/z/ Frame 6485
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Requested by
Host: 9785483.fls.doubleclick.net
URL: https://9785483.fls.doubleclick.net/activityi;dc_pre=CMalpPifpPICFQRV0wodJc0BPA;src=9785483;type=siter0;cat=siter00;ord=5521597808055;gtm=2wg840;auiddc=1959751197.1628522733;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9785483.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=*;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-cu...
adservice.google.com/ddm/fls/z/ Frame ECFC
42 B
515 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=*;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F
Requested by
Host: 10419288.fls.doubleclick.net
URL: https://10419288.fls.doubleclick.net/activityi;dc_pre=CJCUpPifpPICFbIg0wodLK8AcA;src=10419288;type=trust0;cat=trust0;ord=8327806542257;gtm=2wg840;auiddc=1959751197.1628522733;u1=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F;ps=1;~oref=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://10419288.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:33 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/ Frame 57B8
52 KB
25 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:06:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1138
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25732
x-xss-protection
0
last-modified
Mon, 02 Aug 2021 02:15:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 09 Aug 2022 15:06:35 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/ Frame 57B8
341 KB
133 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b468609a3058aeac4dcd21581d0d8ce84ee810878a513735ed4a1676fd3b77fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:15:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
626
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
135980
x-xss-protection
0
last-modified
Mon, 02 Aug 2021 02:15:08 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 09 Aug 2022 15:15:07 GMT
trans.gif
6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com/apc/
43 B
242 B
Image
General
Full URL
https://6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com/apc/trans.gif?fb7ce507b777473ea8cd21377bc1162c
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:1101:: Malmo, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 16 Mar 2021 14:53:38 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
date
Mon, 09 Aug 2021 15:25:33 GMT
accept-ranges
bytes
content-length
43
etag
"0859825741ad71:0"
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 57B8
2 KB
2 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/styles__ltr.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.gstatic.com/recaptcha/releases/RDRwZ7RcROX_wCxEJ01WeqEX/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 00:00:30 GMT
x-content-type-options
nosniff
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
age
573903
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type
image/png
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
expires
Tue, 10 Aug 2021 00:00:30 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 57B8
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.google.com
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 02 Aug 2021 21:27:21 GMT
x-content-type-options
nosniff
age
583092
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 02 Aug 2022 21:27:21 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 57B8
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.google.com
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 14:26:18 GMT
x-content-type-options
nosniff
age
521955
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 03 Aug 2022 14:26:18 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 57B8
102 B
132 B
Other
General
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f9fb02852dda1e5714cdaed5afa720c8b3a12e5ac59744bb303ce601c280dd23
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=RDRwZ7RcROX_wCxEJ01WeqEX&size=invisible&cb=4u190asdy69c
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:25:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Mon, 09 Aug 2021 15:25:33 GMT
s.gif
vidassets.terminus.services/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614
  • https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614&t=f8f5a413-65fd-44d4-b983-58eb84e4b859
42 B
683 B
Image
General
Full URL
https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614&t=f8f5a413-65fd-44d4-b983-58eb84e4b859
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.45.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-45-12.mrs52.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:09:15 GMT
via
1.1 235fd46744276a751642777ed38c479c.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
979
x-cache
Hit from cloudfront
content-length
42
last-modified
Tue, 20 Jul 2021 22:16:42 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
MRS52-P1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
oaqo3WjdkrGJyc4hMZwL36Q3fSNSNvev6eCtGc0V9sroL9dz8bZNJw==

Redirect headers

pragma
no-cache
date
Mon, 09 Aug 2021 15:25:34 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|72300150-05c9-4f4c-ac7f-77ae319b6614&t=f8f5a413-65fd-44d4-b983-58eb84e4b859
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
343
t.gif
vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/
42 B
692 B
Image
General
Full URL
https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.gif?d=72300150-05c9-4f4c-ac7f-77ae319b6614&s=ca02939b-7644-4b66-b546-1a045dd071d8&p=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&cb=1628522733856
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.84.45.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-84-45-12.mrs52.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 09 Aug 2021 15:01:33 GMT
via
1.1 235fd46744276a751642777ed38c479c.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
1815
x-cache
Hit from cloudfront
content-length
42
last-modified
Tue, 20 Jul 2021 22:16:42 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
MRS52-P1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
n2DX66bqeujVC_Uw1plgvd1VqokEtKcPSUrQn7Fz7bue6EiPJKWXpQ==
IsUserAusi
www.trustwave.com/umbraco/surface/AJAX/
5 B
196 B
XHR
General
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAusi
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ai_user=t6sJy|2021-08-09T15:25:33.292Z; _gcl_au=1.1.1959751197.1628522733; _ga=GA1.2.1083470474.1628522733; _gid=GA1.2.146567686.1628522733; _gat_UA-123880220-1=1; ai_session=shwuZ|1628522733488.5|1628522733488.5; _fbp=fb.1.1628522733508.998635287; __atuvc=1%7C32; __atuvs=611148eda3b917f2000; _mkto_trk=id:815-RFM-693&token:_mch-trustwave.com-1628522733661-76309; _hjid=eecdf948-aa4d-449e-93f7-6b0e0c21adb4; _hjFirstSeen=1; OptanonConsent=landingPath=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&datestamp=Mon+Aug+09+2021+17%3A25%3A33+GMT%2B0200+(Central+European+Summer+Time)&version=4.8.0&EU=true; d-a8e6=72300150-05c9-4f4c-ac7f-77ae319b6614; s-9da4=ca02939b-7644-4b66-b546-1a045dd071d8
request-id
|EdMn4.ziGcM
:path
/umbraco/surface/AJAX/IsUserAusi
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
X-Requested-With
XMLHttpRequest
Request-Id
|EdMn4.ziGcM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:34 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
private
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
vary
Accept-Encoding
content-length
123
x-xss-protection
1; mode=block
IsUserAPAC
www.trustwave.com/umbraco/surface/AJAX/
5 B
164 B
XHR
General
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAPAC
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ApplicationGatewayAffinityCORS=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890; ai_user=t6sJy|2021-08-09T15:25:33.292Z; _gcl_au=1.1.1959751197.1628522733; _ga=GA1.2.1083470474.1628522733; _gid=GA1.2.146567686.1628522733; _gat_UA-123880220-1=1; ai_session=shwuZ|1628522733488.5|1628522733488.5; _fbp=fb.1.1628522733508.998635287; __atuvc=1%7C32; __atuvs=611148eda3b917f2000; _mkto_trk=id:815-RFM-693&token:_mch-trustwave.com-1628522733661-76309; _hjid=eecdf948-aa4d-449e-93f7-6b0e0c21adb4; _hjFirstSeen=1; OptanonConsent=landingPath=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&datestamp=Mon+Aug+09+2021+17%3A25%3A33+GMT%2B0200+(Central+European+Summer+Time)&version=4.8.0&EU=true; d-a8e6=72300150-05c9-4f4c-ac7f-77ae319b6614; s-9da4=ca02939b-7644-4b66-b546-1a045dd071d8
request-id
|EdMn4.MfimJ
:path
/umbraco/surface/AJAX/IsUserAPAC
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.trustwave.com
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
X-Requested-With
XMLHttpRequest
Request-Id
|EdMn4.MfimJ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
x-aspnet-version
date
Mon, 09 Aug 2021 15:25:34 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
cache-control
private
set-cookie
ARRAffinity=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net ARRAffinitySameSite=d5a3b58a1996a4fd94c3ee80034405752be4b0b42f4ad07616473b9cd0988bb5;Path=/;HttpOnly;SameSite=None;Secure;Domain=trustwave-umbraco-uk.azurewebsites.net
vary
Accept-Encoding
content-length
123
x-xss-protection
1; mode=block
trans.gif
6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com/apc/
43 B
81 B
Image
General
Full URL
https://6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com/apc/trans.gif?8e40655690977fbf0726a82d2963b0a9
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:1101:: Malmo, Sweden, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 16 Mar 2021 14:53:38 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
date
Mon, 09 Aug 2021 15:25:33 GMT
accept-ranges
bytes
content-length
43
etag
"0859825741ad71:0"
trans.gif
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com/apc/
0
0

/
www.facebook.com/tr/
0
18 B
Ping
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryBNPvAQIFcp3jnVu8

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Mon, 09 Aug 2021 15:25:34 GMT
content-type
text/plain
access-control-allow-origin
https://www.trustwave.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-length
0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
trans.gif
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com/apc/
0
0

trans.gif
e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com/apc/
43 B
242 B
Image
General
Full URL
https://e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com/apc/trans.gif?d2c18a4f5509a7364d7161884bd2025b
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1030:501:2::1 Phoenix, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 16 Mar 2021 14:53:38 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
date
Mon, 09 Aug 2021 15:25:33 GMT
accept-ranges
bytes
content-length
43
etag
"0859825741ad71:0"
trans.gif
e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com/apc/
43 B
104 B
Image
General
Full URL
https://e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com/apc/trans.gif?327cfc261ecd4f0852ef76e12bf239cf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1030:501:2::1 Phoenix, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Tue, 16 Mar 2021 14:53:38 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
date
Mon, 09 Aug 2021 15:25:34 GMT
accept-ranges
bytes
content-length
43
etag
"0859825741ad71:0"
r.gif
www.atmrum.net/report/v1/atm/
7 B
159 B
XHR
General
Full URL
https://www.atmrum.net/report/v1/atm/r.gif?MonitorID=atm&rid=7df11bfd577c9f3907c46ca7bb251568&w3c=true&prot=https:&v=2017061301&tag=602cc9bb0a513db2b327299487211347&DATA=[{%22RequestID%22:%226f4b7dde6a7faf04f28c2ad5555d53b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:102},{%22RequestID%22:%226f4b7dde6a7faf04f28c2ad5555d53b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:21},{%22RequestID%22:%22d5e9e4b375d8969ede59a346692bdcf1%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:-1},{%22RequestID%22:%22d5e9e4b375d8969ede59a346692bdcf1%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:-1},{%22RequestID%22:%22e97e3080a382a29d862c5f8f57b03fac%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:451},{%22RequestID%22:%22e97e3080a382a29d862c5f8f57b03fac%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:141}]
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f82624464e9e95dfae29e0e54c360aff84dda3c419fc8c3bd10ef668bbe7df9e

Request headers

Referer
https://www.trustwave.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
https://www.trustwave.com
date
Mon, 09 Aug 2021 15:25:34 GMT
cache-control
no-store
x-msedge-ref
Ref A: 850E00268E6747D793C3E8B8EE4CF25F Ref B: PRAEDGE0911 Ref C: 2021-08-09T15:25:35Z
content-type
image/gif
track
dc.services.visualstudio.com/v2/ Frame
0
0
Preflight
General
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Server
13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://www.trustwave.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Mon, 09 Aug 2021 15:25:34 GMT
content-length
0
track
dc.services.visualstudio.com/v2/
98 B
238 B
XHR
General
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.216 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
967ca5c0d0c49b09efac7089784703761917a290a528097b19f63ea179925f55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
E20FD742-1388-4DEA-9EE0-A405B87B9F14
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Mon, 09 Aug 2021 15:25:35 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length
98

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com
URL
https://d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com/apc/trans.gif?1c6713d89561d7ac146ea38803115801
Domain
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com
URL
https://d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com/apc/trans.gif?3495d2176b5ba97309d0b3b2e26a89c9

Verdicts & Comments Add Verdict or Comment

183 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| appInsights object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client number| SThreshold number| globalmktoid boolean| globalpartnerform boolean| globalfooterform object| AI object| Microsoft function| __extends function| _endsWith object| google_tag_manager function| postscribe object| google_tag_manager_external object| recaptcha object| google_tag_data string| GoogleAnalyticsObject function| ga string| _linkedin_data_partner_id function| hj object| _hjSettings function| twq function| fbq function| _fbq object| gaplugins object| gaGlobal object| gaData function| lintrk boolean| _already_called_lintrk object| google_optimize object| Vimeo boolean| VimeoPlayerResizeEmbeds_ object| twttr function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| FormAbandonmentTracker string| ajaxReq function| autoSuggest string| navAjaxReq function| navAutoSuggest function| formatNumber function| formatCurrency object| loadmorexrh function| objectifyForm function| trim function| rgb2hex function| rgbaToHex function| UpdateResults function| ShowHideLoadMore function| LoadingOn function| LoadingOff function| LoadMore function| GetCurrentLang function| MediaReleases function| closeResetMobile function| closeResetDesktop string| currentCheckSize function| checkSize function| FixScrollOnLoad function| doMenu function| MainMenu function| CardListCheckForZero function| OutputFooterGlobalForm function| FixButtonColorsinSections function| AddAusiLogo function| AddAPACLogo function| AddTaglineToLogo function| LoadDefaultMKTOForms function| FixConsoleErrors function| FixFooterSectionColorAngle function| ScrollToScript function| SpecialEventMenu function| PressReleases function| ToggleFilterOptions function| ResourceLibrary function| pushToAnalytics function| nextPart function| SearchResults function| SLBlog function| CardHeroSliders function| CardLists function| CardListOurHistory function| SWUpdates function| TWBlog function| getParameterByName function| jsonToUrl function| SetupImgClickToVideo object| videoLabels object| lastP object| _playerTitle object| _playerAuthor object| _playerAuthorURL object| _playerUploadDate function| Vimeoinit function| updateUrl function| onMessageReceived function| post function| getLabel function| getVimeoInfo function| vimeoCallback function| onReady function| onPlay function| onPause function| onPlayProgress object| Modernizr function| $ function| jQuery function| Cookies function| pluralRuleParser function| TWFilters object| MktoForms2 function| TWLang object| mktoprefilldata function| TWMkto function| TWStepsForm function| supportInfo object| rum function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| OneTrust string| containerName string| languageSwitcherFileName string| useDocumentLanguage string| languageSwitcherFilePathPart string| languageSwitcherURL function| getLanguageSwitcherScriptPath function| isLanguageSwitcherFile function| OptanonWrapper object| addthis_share object| addthis_config object| closure_lm_830266 object| Munchkin object| MunchkinTracker function| mktoMunchkin function| mktoMunchkinFunction object| Footprint undefined| a undefined| c function| jsonFeed object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups boolean| __@@##MUH object| fpconfig function| filterHandler

18 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUnromfGk8Cs6Lb3QEVTOYO_AKIfE0yl3ujOTTR-ZkUQjG2qdLGFdSl3eaZbci0
.trustwave.com/ Name: OptanonConsent
Value: landingPath=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Fthe-curious-case-of-the-malicious-iis-module%2F&datestamp=Mon+Aug+09+2021+17%3A25%3A35+GMT%2B0200+(Central+European+Summer+Time)&version=4.8.0&EU=true&groups=1%3A1%2C2%3A0%2C3%3A0%2C0_32924%3A1%2C4%3A0%2C0_32898%3A0%2C0_32899%3A0%2C0_32900%3A0%2C0_32901%3A0%2C0_32902%3A0%2C0_32903%3A0%2C0_32904%3A0%2C0_32905%3A0%2C0_32893%3A0%2C0_32894%3A0%2C0_32895%3A0%2C0_32896%3A0%2C0_32897%3A0
www.trustwave.com/ Name: s-9da4
Value: ca02939b-7644-4b66-b546-1a045dd071d8
www.trustwave.com/ Name: d-a8e6
Value: 72300150-05c9-4f4c-ac7f-77ae319b6614
.trustwave.com/ Name: _hjFirstSeen
Value: 1
.trustwave.com/ Name: _hjid
Value: eecdf948-aa4d-449e-93f7-6b0e0c21adb4
.trustwave.com/ Name: _mkto_trk
Value: id:815-RFM-693&token:_mch-trustwave.com-1628522733661-76309
.www.trustwave.com/ Name: ApplicationGatewayAffinityCORS
Value: bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
www.trustwave.com/ Name: __atuvc
Value: 1%7C32
.trustwave.com/ Name: _fbp
Value: fb.1.1628522733508.998635287
www.trustwave.com/ Name: ai_user
Value: t6sJy|2021-08-09T15:25:33.292Z
.trustwave.com/ Name: _ga
Value: GA1.2.1083470474.1628522733
www.trustwave.com/ Name: __atuvs
Value: 611148eda3b917f2000
www.trustwave.com/ Name: ai_session
Value: shwuZ|1628522733488.5|1628522733488.5
.trustwave.com/ Name: _gat_UA-123880220-1
Value: 1
.trustwave.com/ Name: _gid
Value: GA1.2.146567686.1628522733
.www.trustwave.com/ Name: ApplicationGatewayAffinity
Value: bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
.trustwave.com/ Name: _gcl_au
Value: 1.1.1959751197.1628522733

2 Console Messages

Source Level URL
Text
console-api warning URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js(Line 1)
Message:
AI: CannotSerializeObjectNonSerializable message:"Attempting to serialize an object which does not implement ISerializable" props:"{name:baseData}"
console-api warning URL: https://connect.facebook.net/en_US/fbevents.js(Line 24)
Message:
[Facebook Pixel] - Unable to parse JSON-LD tag. Malformed JSON found: ' { "@context": "http://schema.org", "@type": "WebSite", "url": "https://www.trustwave.com/", "potentialAction": { "@type": "SearchAction", "target": "https://www.trustwave.com/en-us/search/?q={search_term_string}", "query-input": "required name=search_term_string" } } { "@context": "http://schema.org", "@type": "Organization", "url": "https://www.trustwave.com/", "logo": "https://www.trustwave.com/img/logo/TW-logo-color.png" } '.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10419288.fls.doubleclick.net
6f4b7dde6a7faf04f28c2ad5555d53b0.azr.footprintdns.com
815-rfm-693.mktoresp.com
9785483.fls.doubleclick.net
adservice.google.com
analytics.twitter.com
az416426.vo.msecnd.net
connect.facebook.net
cookie-cdn.cookiepro.com
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com
dc.services.visualstudio.com
e97e3080a382a29d862c5f8f57b03fac.azr.footprintdns.com
fast.fonts.net
fonts.gstatic.com
geolocation.onetrust.com
gist.github.com
github.githubassets.com
googleads.g.doubleclick.net
match.adsrvr.org
munchkin.marketo.net
player.vimeo.com
px.ads.linkedin.com
px4.ads.linkedin.com
s7.addthis.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
trustwave.blob.core.windows.net
v1.addthisedge.com
vars.hotjar.com
vidassets.terminus.services
www.atmrum.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.trustwave.com
z.moatads.com
d5e9e4b375d8969ede59a346692bdcf1.azr.footprintdns.com
104.111.234.67
104.244.42.195
104.244.42.197
104.75.88.126
108.174.10.14
13.248.242.197
13.32.22.102
13.69.106.216
140.82.121.4
142.250.185.130
151.101.12.157
151.101.12.217
185.199.109.154
192.28.144.124
2.18.235.40
204.79.197.234
216.58.212.166
2603:1020:1101::
2603:1030:501:2::1
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::6814:b844
2606:4700::6811:e04e
2606:4700::6812:678
2620:119:50e1:101::6cae:b25
2620:1ec:22::14
2a00:1450:4001:800::2003
2a00:1450:4001:800::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::200e
2a00:1450:4001:811::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::2004
2a00:1450:4001:828::2003
2a00:1450:4001:828::200e
2a00:1450:4001:82b::2008
2a00:1450:4001:831::2003
2a00:1450:400c:c00::9a
2a02:26f0:6c00:296::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
52.151.96.240
52.239.171.228
52.84.45.12
52.84.45.59
54.192.219.92
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
030c1e4eced902d0d6d3215f8f9078ba504b61c697b931fd9829887a9075d126
049bf83ad4e353fb4bce7d9fff2ba6b0996aa1a8bbdba76ca83a2ee78c887687
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe
0dfa4684ad9c52a1a97d91764ef1d404c15dd95ed20f00a2f9f3f4d11df2abf9
0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14da1d6311764bee490145f7909d480858b94fc01c6ba2b5d8c112feabe53a99
164fcaec76285c5aaeb134dd33c605bc090bc8a1aba73d7698f4410d876a6bd5
176d19a05a6e38185fc105408cc8d89bb89f1ec6f6d6641451e712de0e653984
191b9e47f836e0e1d6f0eab911211aa7754f678b0671e0aeec01a0c44ca94898
19a5abc3ee71d9689286163dd786564ab2d59a118563fc140e62fa96d0d386df
1ab02dadb2dc4da565d23f726991b238340b0ac2dc92982944c8ed56b1ffaa89
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1c3bfab00f5e70133e4daafbd95aea46f572bbcf33335ee75b9f2240742c7982
21c3d65ef1a0105fb3114d843bd4c68e474e7571db6b0af5ca759fbfec9eca81
26531267fe98b17f07b013af741004e4164287cab7165901d8687a99994f23a7
27624a6de0fad61d9683f8d2df3dad590690d76da6cc076d22c4278b58c229e3
2a1c9874549a1cb94b6e0dc5822b4f5ca14386d39214a8145670fc1c50045496
2de1c72229e7c059582d038e201322bd49009c2155570284b1b5e320937f4b80
2e1a04ecce497031f2a9c55b335a82ff044b7337f8e2cc4a1af83ef11a572920
2e45a8996ec5c8b3fce4c3f71fc56ef806673998113d09c32f73c7a3d6efdb38
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
36368204cddb9771eebfc704310c901be66970f3a9a0a35f3150728d507169a9
37e1a0fe9cb3b8cccde605f99f54dfe0612196c3177d521d36be8abed50a3e7d
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
44f60c08d39f76681af5e1eada34c18b7754a089f1403eea70c86c56c171a425
4ab535547e1cfc0244eb7e921282ab96098a52b09eda40da8da98a59cfef3fde
4b9ff8de254b4ed3fd00088bad420a1a29af355700610fa9ff3bf4ce38741fb8
4bc6413276d4b73e8c889d6517197cb9fda32a359035afdf5e02db53d6f96f11
4cd281df3bd61337094874b0c4773fec883363fb86709e7159226578e81e0f43
4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
4d968af0d0f4ec08e7226a2b72ce0614322df45c36850e52bdb6e399490a1ac2
50d22582135c1457f139318edebb3283eb206bbacb4fefeab79156a5efd5faa2
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
52fe21fd06b3137814d74879c9230bc3d3273fbac9411c7c132bd5a12f75e434
539674653f6ef0a18dd4a167014c56d76be9d2f95a1e7651b054a82e34fe02d7
55e16d248a51e62be7f1c6308a4d9e53d167b882942e2d37d6d8cdd818f6af7f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5fe0267081facbcc679d3c6c5be216ab7cbb8266c85cd949e099cfcb2fe2f583
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
6603122bf60f4b09cfab59cdc08d792c28773607d897ed680c7c0b607a44a879
6b5372992cb38455e82677ab372db26dc114aae71243d25d15f06c03353c9d9b
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271
719df7954428f52779f3fa18641c19fc854b39394193d87eea5a61795dec8dbe
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9
7b0ef13b754c456f5621d74ca260e49b061f759bcaeb9223e0eaa78ff4359189
8069956acb4c566506ff71f7a23c8e23f75ce9443384fe3393ed5c846924026e
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8f3fea60c61198c49932e79b6b11177b046e37431f78ab10e2a806b6b2bc4ddf
8fdceff414f9b7f984ec9a14c5a75a30c9311a076324d3d7fb08c611c479ebc8
9298a280eda6b54290d3c69fda3ae7da0cec1a0169d01d4e5944af63d68939d5
9545498791418ba2847374815a974cc5bad7368ffb1df4c44c67d25027dd219e
967ca5c0d0c49b09efac7089784703761917a290a528097b19f63ea179925f55
9998a28912966aa8ae78c7bae4b70bce32095ac4cafb972428f96c60bf374a98
9afb9a9c7d5087ea4eec42c5bde02113fcdbc2cd45f0b257813365bffb82569f
9bb2d4aa044534807ef8ecfd35152fc826f2f5422daa3930bbe86e82e0ef76dc
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a637d3ff767789f9b113bbfa208bdb6a76efed7c4c111da2a130f6a38a51d353
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ace78f63f590160b0748a26e60d8b453b4d4ac8bc4da20967632bf7e5bcb58e3
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b468609a3058aeac4dcd21581d0d8ce84ee810878a513735ed4a1676fd3b77fc
b4c96f55c265e0a80be4243a16f7e88b9a67c85b71b4e2aa8cea4e1aa989b0d1
b5e5c5c8b9ebe9fb7f4a8cde7f2ff4f6652e6beb87585c18e99fb446fbb301a4
bd1f1f47a863ac3be54dab002af884683776e666b68d50ec7641ca732991d54f
c06436749a10d9fc5499145a94786175af58a8f0eb150721bd5f57e6ec9937fe
c37a2501cb22946026cbb1f06b5ff2191cd1eabd565c21db3e95ef24c3120dfa
c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b
c99841b9fa07daa705c029caca740cbd2d8c4b53b07c5b7999e7fe7da91e6670
cb8fd428f0d96267a4df07e3603d7e9fc4f424096eec1923269d49efa9f31dbb
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
ec20f46b9ae6e443d3b8b2de6f089098d8834d5e630ca0e90628bc4adfbbcd17
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef1ca883dab926ea1c836d4d0a0486ede63d1b1c24cdd62bc411140fb8cfcd25
f1f6fe3efae121205ed3317f00bea4b292c128e19003910baa75fdaa645c515d
f422b8961953524e333d562521c3b4e0a2ed33da87079bd92c08ec4389372358
f82624464e9e95dfae29e0e54c360aff84dda3c419fc8c3bd10ef668bbe7df9e
f9fb02852dda1e5714cdaed5afa720c8b3a12e5ac59744bb303ce601c280dd23
fc04d1fd608cedf1f0c4735145a15031f77cb7491d6234cec4ee2cd9be74937a
fddcbf3913764ca70387ee7b59eadffc8d41072d9f6bdd8d566b667d3552deb5