URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Submission: On November 28 via api from IN — Scanned from DE

Summary

This website contacted 63 IPs in 3 countries across 50 domains to perform 260 HTTP transactions. The main IP is 23.203.87.70, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on May 17th 2022. Valid for: a year.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
50 23.203.87.70 16625 (AKAMAI-AS)
7 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
23 104.75.88.194 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
9 95.101.200.123 16625 (AKAMAI-AS)
2 34.96.102.137 396982 (GOOGLE-CL...)
1 35.201.125.192 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 34.111.194.12 396982 (GOOGLE-CL...)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
2 4 2600:9000:21f... 16509 (AMAZON-02)
2 2 35.201.70.94 15169 (GOOGLE)
1 35.190.5.192 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 184.24.170.43 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 2620:116:800d... 16509 (AMAZON-02)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 142.250.184.194 15169 (GOOGLE)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 104.17.71.206 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 52.71.88.40 14618 (AMAZON-AES)
1 199.232.136.157 54113 (FASTLY)
1 18.66.112.37 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 3 138.128.247.123 36007 (KAMATERA)
64 54.182.0.31 16509 (AMAZON-02)
10 184.24.7.242 16625 (AKAMAI-AS)
1 88.221.169.143 16625 (AKAMAI-AS)
2 2600:9000:225... 16509 (AMAZON-02)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2600:9000:223... 16509 (AMAZON-02)
2 34.111.78.58 396982 (GOOGLE-CL...)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 2 142.250.185.70 15169 (GOOGLE)
1 108.138.15.119 16509 (AMAZON-02)
2 2 68.67.153.60 29990 (ASN-APPNEX)
3 5 185.89.211.12 29990 (ASN-APPNEX)
2 2600:9000:225... 16509 (AMAZON-02)
2 99.86.4.95 16509 (AMAZON-02)
2 104.244.42.69 13414 (TWITTER)
1 104.244.42.3 13414 (TWITTER)
1 206.19.49.24 17225 (ATT-CERFN...)
1 2001:4860:480... 15169 (GOOGLE)
2 2a02:26f0:170... 20940 (AKAMAI-ASN1)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 192.28.144.124 15224 (OMNITURE)
2 34.237.225.32 14618 (AMAZON-AES)
2 3.221.131.160 14618 (AMAZON-AES)
2 52.59.125.199 16509 (AMAZON-02)
2 2a03:2880:f12... 32934 (FACEBOOK)
2 104.238.215.8 36007 (KAMATERA)
1 52.223.40.198 16509 (AMAZON-02)
1 1 95.101.27.26 20940 (AKAMAI-ASN1)
1 95.101.27.37 20940 (AKAMAI-ASN1)
1 2 2a02:26f0:480... 20940 (AKAMAI-ASN1)
2 54.147.21.139 ()
260 63
Apex Domain
Subdomains
Transfer
64 driftt.com
js.driftt.com — Cisco Umbrella Rank: 8907
846 KB
51 trendmicro.com
www.trendmicro.com
resources.trendmicro.com
4 MB
23 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 893
60 KB
12 6sc.co
j.6sc.co — Cisco Umbrella Rank: 9674
c.6sc.co — Cisco Umbrella Rank: 14002
ipv6.6sc.co — Cisco Umbrella Rank: 10534
b.6sc.co — Cisco Umbrella Rank: 6038
14 KB
8 bc0a.com
cdn.bc0a.com — Cisco Umbrella Rank: 15391
ixfd2-api.bc0a.com — Cisco Umbrella Rank: 37674
marvel-b1-cdn.bc0a.com — Cisco Umbrella Rank: 31146
marvel-processor.bc0a.com — Cisco Umbrella Rank: 74098
48 KB
8 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 1982
m.addthis.com — Cisco Umbrella Rank: 1994
api-public.addthis.com — Cisco Umbrella Rank: 4921
332 KB
7 idio.co
js.idio.co — Cisco Umbrella Rank: 84135
s.idio.co — Cisco Umbrella Rank: 72230
a.idio.co — Cisco Umbrella Rank: 69760
api.idio.co — Cisco Umbrella Rank: 236644
15 KB
7 google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 412
www.google-analytics.com — Cisco Umbrella Rank: 84
region1.google-analytics.com — Cisco Umbrella Rank: 1166
40 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 535
145 KB
5 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 577
4 KB
5 acsbapp.com
acsbapp.com — Cisco Umbrella Rank: 4819
cdn.acsbapp.com — Cisco Umbrella Rank: 5480
web1.acsbapp.com — Cisco Umbrella Rank: 6694
166 KB
4 akamaihd.net
trial-eum-clientnsv4-s.akamaihd.net — Cisco Umbrella Rank: 1998
kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net — Cisco Umbrella Rank: 2002
fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net
1 KB
4 doubleclick.net
5427711.fls.doubleclick.net Failed
googleads.g.doubleclick.net — Cisco Umbrella Rank: 64
9572106.fls.doubleclick.net — Cisco Umbrella Rank: 987112
3 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 563
www.linkedin.com — Cisco Umbrella Rank: 550
px4.ads.linkedin.com — Cisco Umbrella Rank: 5838
4 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 106
287 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 16
adservice.google.com — Cisco Umbrella Rank: 121
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 463
12 KB
3 b0e8.com
cdn.b0e8.com — Cisco Umbrella Rank: 13291
a1.b0e8.com — Cisco Umbrella Rank: 12573
22 KB
2 drift.com
bootstrap.api.drift.com
243 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 102
203 B
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 14464
453 B
2 google.de
www.google.de — Cisco Umbrella Rank: 3269
656 B
2 t.co
t.co — Cisco Umbrella Rank: 497
581 B
2 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 35229
467 B
2 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 28098
566 B
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1845
insight.adsrvr.org — Cisco Umbrella Rank: 887
3 KB
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1297
374 B
2 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 25966
apt.techtarget.com — Cisco Umbrella Rank: 31672
2 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 168
16 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 165
112 KB
2 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1294
pixel.quantserve.com — Cisco Umbrella Rank: 908
10 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 5289
6 KB
2 gstatic.com
fonts.gstatic.com
91 KB
2 go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1312
c.go-mpulse.net — Cisco Umbrella Rank: 559
50 KB
2 onetrust.io
cookies-data.onetrust.io — Cisco Umbrella Rank: 9738
84 B
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 5069
2 KB
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 93
55 KB
2 cludo.com
customer.cludo.com — Cisco Umbrella Rank: 23788
63 KB
1 akstat.io
684dd326.akstat.io — Cisco Umbrella Rank: 41596
204 B
1 addthisedge.com
v1.addthisedge.com — Cisco Umbrella Rank: 2423
1 KB
1 mktoresp.com
945-cxd-062.mktoresp.com — Cisco Umbrella Rank: 522778
318 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 665 Failed
724 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1212
448 B
1 moatads.com
z.moatads.com — Cisco Umbrella Rank: 570
1 KB
1 acsbap.com
acsbap.com — Cisco Umbrella Rank: 15337
472 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 822
15 KB
1 xg4ken.com
resources.xg4ken.com — Cisco Umbrella Rank: 5062
4 KB
1 bizographics.com
sjs.bizographics.com — Cisco Umbrella Rank: 45970
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 939
295 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 107
1 KB
260 50
Domain Requested by
64 js.driftt.com tags.tiqcdn.com
js.driftt.com
50 www.trendmicro.com www.trendmicro.com
23 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
7 b.6sc.co www.trendmicro.com
7 cdn.cookielaw.org www.trendmicro.com
cdn.cookielaw.org
5 secure.adnxs.com 3 redirects j.6sc.co
4 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
4 www.googletagmanager.com tags.tiqcdn.com
www.googletagmanager.com
4 marvel-b1-cdn.bc0a.com 2 redirects www.trendmicro.com
4 s7.addthis.com www.trendmicro.com
tags.tiqcdn.com
s7.addthis.com
3 api-public.addthis.com s7.addthis.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.trendmicro.com
2 bootstrap.api.drift.com js.driftt.com
2 cdn.acsbapp.com acsbap.com
2 www.facebook.com www.trendmicro.com
2 epsilon.6sense.com j.6sc.co
2 api.idio.co s.idio.co
2 a.idio.co www.trendmicro.com
2 www.google.de www.trendmicro.com
2 www.google.com 1 redirects www.trendmicro.com
2 ipv6.6sc.co j.6sc.co
2 c.6sc.co j.6sc.co
2 t.co www.trendmicro.com
2 s.idio.co js.idio.co
2 attr.ml-api.io www.trendmicro.com
2 s.ml-attr.com 2 redirects
2 9572106.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
2 a1.b0e8.com www.trendmicro.com
2 px.ads.linkedin.com 2 redirects
2 cdn.linkedin.oribi.io sjs.bizographics.com
2 acsbapp.com 1 redirects www.trendmicro.com
2 www.googleadservices.com tags.tiqcdn.com
www.googleadservices.com
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 marvel-processor.bc0a.com 2 redirects
2 fonts.gstatic.com fonts.googleapis.com
2 cookies-data.onetrust.io cdn.cookielaw.org
2 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
www.trendmicro.com
2 www.youtube.com www.trendmicro.com
www.youtube.com
2 customer.cludo.com www.trendmicro.com
1 fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net
1 trial-eum-clienttons-s.akamaihd.net 1 redirects
1 kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net
1 trial-eum-clientnsv4-s.akamaihd.net 1 redirects
1 684dd326.akstat.io s.go-mpulse.net
1 insight.adsrvr.org js.adsrvr.org
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 web1.acsbapp.com www.trendmicro.com
1 adservice.google.com 9572106.fls.doubleclick.net
1 945-cxd-062.mktoresp.com munchkin.marketo.net
1 pixel.quantserve.com www.trendmicro.com
1 region1.google-analytics.com www.googletagmanager.com
1 apt.techtarget.com www.trendmicro.com
1 analytics.twitter.com www.trendmicro.com
1 js.adsrvr.org www.googletagmanager.com
1 rules.quantcount.com secure.quantserve.com
1 px4.ads.linkedin.com www.trendmicro.com
1 www.linkedin.com 1 redirects
1 z.moatads.com s7.addthis.com
1 j.6sc.co tags.tiqcdn.com
1 acsbap.com 1 redirects
1 trk.techtarget.com tags.tiqcdn.com
1 js.idio.co tags.tiqcdn.com
1 static.ads-twitter.com tags.tiqcdn.com
1 resources.xg4ken.com tags.tiqcdn.com
1 c.go-mpulse.net s.go-mpulse.net
1 resources.trendmicro.com tags.tiqcdn.com
1 sjs.bizographics.com tags.tiqcdn.com
1 secure.quantserve.com tags.tiqcdn.com
1 cdn.b0e8.com www.trendmicro.com
1 s.go-mpulse.net www.trendmicro.com
1 ixfd2-api.bc0a.com cdn.bc0a.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cdn.bc0a.com tags.tiqcdn.com
1 fonts.googleapis.com www.trendmicro.com
0 5427711.fls.doubleclick.net Failed www.googletagmanager.com
260 79
Subject Issuer Validity Valid
www.trendmicro.com
Entrust Certification Authority - L1M
2022-05-17 -
2023-06-15
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.cludo.com
AlphaSSL CA - SHA256 - G2
2022-05-04 -
2023-06-05
a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
*.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2022-07-04 -
2023-08-05
a year crt.sh
cdn.bc0a.com
GTS CA 1D4
2022-10-28 -
2023-01-26
3 months crt.sh
onetrust.io
Cloudflare Inc ECC CA-3
2022-05-04 -
2023-05-04
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-01-12 -
2023-01-12
a year crt.sh
ixfd-api.bc0a.com
GTS CA 1D4
2022-10-27 -
2023-01-25
3 months crt.sh
akstat.io
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-04-15 -
2023-04-19
a year crt.sh
*.gstatic.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
marvel-cdn.bc0a.com
Amazon
2022-03-11 -
2023-04-09
a year crt.sh
cdn.b0e8.com
GTS CA 1D4
2022-10-31 -
2023-01-29
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1
2022-08-09 -
2023-09-09
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-09-06 -
2022-12-05
3 months crt.sh
www.googleadservices.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA
2022-09-08 -
2023-09-08
a year crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3
2022-06-17 -
2023-06-17
a year crt.sh
*.xg4ken.com
Go Daddy Secure Certificate Authority - G2
2022-09-19 -
2022-12-17
3 months crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
idio.co
R3
2022-11-27 -
2023-02-25
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-07-25 -
2023-07-25
a year crt.sh
drift.com
Amazon
2022-08-24 -
2023-09-21
a year crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
moatads.com
DigiCert TLS RSA SHA256 2020 CA1
2022-11-16 -
2023-11-18
a year crt.sh
linkedin.oribi.io
Amazon
2022-07-07 -
2023-08-06
a year crt.sh
quantserve.com
R3
2022-11-11 -
2023-02-09
3 months crt.sh
*.googleadservices.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
b0e8.com
GTS CA 1D4
2022-11-04 -
2023-02-02
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2022-11-25 -
2023-05-25
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2022-03-31 -
2023-05-02
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.techtarget.com
Thawte RSA CA 2018
2022-09-27 -
2023-10-28
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.6sense.com
Amazon
2022-05-31 -
2023-06-29
a year crt.sh
www.google.de
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.acsbapp.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1
2022-09-28 -
2023-10-05
a year crt.sh

This page contains 8 frames:

Primary Page: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Frame ID: 1B3CB08FB1AD75989A7C12E7AFEEC650
Requests: 187 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=3555319920798;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Frame ID: 9B88FEFC79F03AC15CEB6C13BFBB8172
Requests: 1 HTTP requests in this frame

Frame: https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Frame ID: D18222574741630CB07A985A20A302AC
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Frame ID: D27F69B285DB381C694956D6845EB8A3
Requests: 31 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Frame ID: 7A2A525DCDA9098FC108604DCE0D46E5
Requests: 33 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: A8AED9AA6AF070C993432A3A2CAA87EF
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 8A97693951C322A8F6E01ECADB3259B5
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&upid=803df29&upv=1.1.0
Frame ID: 61C6A0323A5CD4CB6B9998856FB0CE68
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Earth Preta Spear-Phishing Governments WorldwideFacebookTwitterPrintAddThis

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • backbone.*\.js

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • moatads\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

260
Requests

95 %
HTTPS

45 %
IPv6

50
Domains

79
Subdomains

63
IPs

3
Countries

6526 kB
Transfer

12511 kB
Size

54
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg HTTP 302
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg HTTP 307
  • https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
Request Chain 112
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/dist/js/app.js
Request Chain 124
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1669636685777%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen_us%252Fresearch%252F22%252Fk%252Fearth-preta-spear-phishing-governments-worldwide.html%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&liSync=true&e_ipv6=AQLvLmXZBBMBAAAAAYS-GgJS8ccqx67G6UYnok14uk7HL7oxunsUuGqm4n3XlRf2-W-NcAyZ
Request Chain 134
  • https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html HTTP 302
  • https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Request Chain 136
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Request Chain 155
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=TaKEY9OoNrCR9fgPlOmW0Ac&sscte=1&crd= HTTP 302
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=TaKEY9OoNrCR9fgPlOmW0Ac&random=3372604950&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=TaKEY9OoNrCR9fgPlOmW0Ac&random=3372604950&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Request Chain 178
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Request Chain 188
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=ptewnmgyd HTTP 302
  • https://kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net/eum/results.txt
Request Chain 189
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=ptewnmgyd HTTP 302
  • https://fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net/eum/results.txt

260 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request earth-preta-spear-phishing-governments-worldwide.html
www.trendmicro.com/en_us/research/22/k/
133 KB
29 KB
Document
General
Full URL
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5f833e21ff72666bbf269357d08626374325d27d25db5e25ae9cec8ef7e4df57
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
28737
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
content-type
text/html;charset=utf-8
date
Mon, 28 Nov 2022 11:58:04 GMT
link
<https://tags.tiqcdn.com>;rel="preconnect",<https://cdn.cookielaw.org>;rel="preconnect",<https://customer.cludo.com>;rel="preconnect",<https://marvel-b1-cdn.bc0a.com>;rel="preconnect",<https://cdn.bc0a.com>;rel="preconnect"
server
nginx
server-timing
cdn-cache; desc=HIT edge; dur=33
vary
Accept-Encoding
x-akamai-transformed
9 26360 0 pmb=mRUM,2
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-prod-a-01
Yes
x-prod-n-01
Yes
x-xss-protection
1;mode=block
OtAutoBlock.js
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/
26 KB
6 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9b43aa5cfd8cf2ca5a112086673538658a3f850d2553adf67cbee4fbd3cc782
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
7mWy6rIzulLyrbsRpGr7+g==
age
12339
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
5801
x-ms-lease-status
unlocked
last-modified
Wed, 11 May 2022 18:06:16 GMT
server
cloudflare
etag
0x8DA3378F17193AD
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e0eadeed-401e-0073-7479-65a825000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee001b8f5ca4-FRA
expires
Tue, 29 Nov 2022 11:58:04 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
bKkFjZE43AfZo3jm8gqLew==
age
45356
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
7151
x-ms-lease-status
unlocked
last-modified
Fri, 25 Nov 2022 09:17:45 GMT
server
cloudflare
etag
0x8DACEC5E9C800F3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
205f9382-f01e-0007-272b-012e63000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee001b975ca4-FRA
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
34 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Sat, 19 Nov 2022 16:59:39 GMT
server
Akamai Resource Optimizer
date
Mon, 28 Nov 2022 11:58:04 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1
x-prod-n-01
Yes
content-length
34051
x-xss-protection
1;mode=block
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
3 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Thu, 17 Nov 2022 19:45:38 GMT
server
Akamai Resource Optimizer
date
Mon, 28 Nov 2022 11:58:04 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1
x-prod-n-01
Yes
content-length
3224
x-xss-protection
1;mode=block
css
fonts.googleapis.com/
13 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a6dd608e607588b2cf3c87b17f36bcee05da7bbbc2b69bf352dec8c474185a12
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 28 Nov 2022 11:58:04 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 28 Nov 2022 11:58:04 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/
16 KB
3 KB
Stylesheet
General
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 21 Apr 2022 10:55:26 GMT
server
cloudflare
age
64251
etag
W/"0238c4e6e55d81:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
7712ee0049dd922f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-lb
4
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
265 KB
30 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
96fc226b557ea883b6f98c6cfdadf1edc0ff40336cb3434bd59d5e4262b5ee07
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Sat, 19 Nov 2022 00:37:55 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 28 Nov 2022 11:58:04 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
29999
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d4936094e7358ae2747b6a5d2c6a0c6fc5e9449e77e9c575e0788d6894624bc3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 21:04:52 GMT
server
AkamaiNetStorage
etag
"92b48b4c01a2d684d1da971246745feb:1666386292.334341"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
965
expires
Mon, 28 Nov 2022 12:03:04 GMT
logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
0
0

nav-cyber-risk-index.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/
0
0

search-script.js
customer.cludo.com/scripts/bundles/
333 KB
60 KB
Script
General
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc4d3c6e2e38f860df9cb1126fa0c5867bb149b574de56662928e02558c70328

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Tue, 22 Nov 2022 15:50:00 GMT
server
cloudflare
etag
W/"0c4e2138afed81:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
7712ee009a69922f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-lb
2
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
648 B
695 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
362
x-xss-protection
1;mode=block
x-prod-a-04
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=457
expires
Mon, 28 Nov 2022 12:05:42 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
409 B
613 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1
x-prod-n-01
Yes
content-length
281
x-xss-protection
1;mode=block
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=517
expires
Mon, 28 Nov 2022 12:06:42 GMT
Fig1_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
103 KB
103 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig1_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5afc897907a6a41ff6df1599d36ff15428aabcd18ec2c127e3d6433bd8a0c046
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=1, origin; dur=158
content-length
105251
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"19b23-5ee84c055020f"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1705
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:30 GMT
Fig2_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
39 KB
40 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig2_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
54fff93dac87a9b339c840c61576567a5d66f3fa293622b960b40b3568fdac0d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=75
content-length
40223
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:12 GMT
server
nginx
etag
"9d1f-5ee84c176f67e"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1694
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:19 GMT
Fig%203.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
55 KB
55 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig%203.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4083e7cc2bd654cb434173b1f2d2e4a4d3ed921463cab9f9db53d6cd81d89b0d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=74
x-prod-n-01
Yes
content-length
56199
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:23 GMT
server
nginx
etag
"db87-5ee84be893997"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1656
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:41 GMT
Fig4_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
305 KB
306 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig4_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e9d2b7b3b232077819c309fe934d0729553bcbf8efedc73f8893680f85eae0ce
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=657
content-length
311876
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:23 GMT
server
nginx
etag
"4c244-5ee84be8931c7"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:28:05 GMT
Fig5_Earth%20Preta.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
224 KB
224 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig5_Earth%20Preta.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9fe1d4e96151b5555ca0cdc337fe0a79da685073012bf44c085d10652f6a3d1c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=71
x-prod-n-01
Yes
content-length
228938
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"37e4a-5ee84c0550dc8"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1619
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:04 GMT
Fig6_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
925 KB
928 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig6_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fc7511106f98dfbf8e4c01929ed4e9c7aa92d28af790d0475d1850858e3315c6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=313
x-prod-n-01
Yes
content-length
947700
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:15 GMT
server
nginx
etag
"e75f4-5ee84c19f2473"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1750
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:15 GMT
Fig7_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
45 KB
45 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig7_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
608c3824218b6ac368b4324a2bbcde21a9270a794628ce4c1685705ef717c4ae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=82
x-prod-n-01
Yes
content-length
45569
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"b201-5ee84c05c8be6"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1669
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:54 GMT
Fig8_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
35 KB
35 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig8_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
085eaa8d4344efd512d4bad9154a62e79e9624f65b4300d0439b17cbadb809eb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=83
content-length
35399
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"8a47-5ee84c056bf68"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1708
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:33 GMT
Fig9_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
60 KB
60 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig9_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
25cb8008bc221f935a600a6ad4f05f7763bf1e0815cf449faaaa7a5dbfc98ba9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=163
content-length
61388
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"efcc-5ee84c0563e7e"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1643
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:28 GMT
Fig10_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
21 KB
21 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig10_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c2096a3a215956d59d342536e18ccf7ea1a068ef15ed7def02553fb5ffbbe0b0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=321
x-prod-n-01
Yes
content-length
21360
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"5370-5ee84c062dd36"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1706
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:31 GMT
Fig11_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
45 KB
46 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig11_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
edaa061b005c12f64391c7ad52524a677c55b645deeb1e4752b8250f2c46086d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=88
x-prod-n-01
Yes
content-length
46230
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"b496-5ee84c056946f"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1735
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:00 GMT
Fig12_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
232 KB
233 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig12_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
60f863144aaafb045985a2cfb559ec18c30f9eff6a4db0b37506c8e41eccaed0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=87
content-length
237212
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:13 GMT
server
nginx
etag
"39e9c-5ee84c1858170"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1653
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:38 GMT
Fig%2013_Earth%20Preta.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
301 KB
302 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig%2013_Earth%20Preta.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a8f3b9ec4cac22ff31bd07585db6642dc6968d247908e089a0a690f7ea66824a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=85
content-length
308445
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"4b4dd-5ee84c05e54f7"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1757
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:22 GMT
Fig14_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
23 KB
24 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig14_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
584d056c2e83aa9f513b29dc60d838c5648a961aeeae98f92d91a01cc004beda
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=83
x-prod-n-01
Yes
content-length
23942
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:13 GMT
server
nginx
etag
"5d86-5ee84c184a2c4"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1695
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:20 GMT
Fig15_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
595 KB
597 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig15_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c8b013334338314810637de10207057caa92a44fc9873b2671ab58eeffac1cae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=81
content-length
609397
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"94c75-5ee84c05e3d87"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1657
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:42 GMT
Fig16_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
27 KB
28 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig16_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2f7b4e90d6454c1684c68ebeeeaa7d0de65dac8c2b4dfe3afb7176ccca7d1b58
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=634
content-length
28106
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"6dca-5ee84c05e222e"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1636
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:21 GMT
Fig17_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
39 KB
40 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig17_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1e304e6c44573d42086563697648a39608f59e054ae64e554f2ca652c7800272
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=1, origin; dur=157
content-length
40246
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"9d36-5ee84c05d8dbb"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1730
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:55 GMT
Fig18_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
27 KB
27 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig18_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d1e82e9a4125dc85707996f27b9c6c7cd5b9434951ecd55094f723362fb0c067
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=82
content-length
27146
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"6a0a-5ee84c05de3ad"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1739
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:04 GMT
Fig19_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
61 KB
62 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig19_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
90775ce1333473bfef558cf5185a101a76f95926d3df98d2ea23b1cf583a2076
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=82
content-length
62762
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"f52a-5ee84c0574823"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1708
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:33 GMT
Fig20_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
21 KB
21 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig20_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4fc81379a071d67a2f0d4a3c6493fd35ad12a0da82c9af71b7ddebfdfa594c41
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=318
content-length
21489
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:12 GMT
server
nginx
etag
"53f1-5ee84c1778709"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1719
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:44 GMT
Fig21_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
13 KB
13 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig21_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6628992f1bc9650c2a0656562effc25b67770a255e3fe203414c7b0b5e992bef
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=69
x-prod-n-01
Yes
content-length
13034
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"32ea-5ee84c057ffbf"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1776
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:41 GMT
Fig22_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
12 KB
12 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig22_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d08ea2ef86069614fbd61038fa25056afa37aded9dba32e520f9adc1855b88b0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=88
content-length
12279
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"2ff7-5ee84c057ffbf"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1787
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:52 GMT
Fig%2023_Earth%20Preta.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
63 KB
63 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig%2023_Earth%20Preta.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
728a18b8f9f56a05d19f6300df7f4f293b8475ec836d05dbd90e7076b24c39b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=76
x-prod-n-01
Yes
content-length
64150
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"fa96-5ee84c05e31ce"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1798
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:28:03 GMT
Fig24_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
32 KB
33 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig24_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
72bafc393377ddc1bb9e6e7d5aefc22f2960d72819f7d1eba5c55d5a747329d9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=636
content-length
33220
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"81c4-5ee84c05def65"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1665
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:50 GMT
Fig25_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
35 KB
35 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig25_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3cff6771ba22d252432953dc6920c1965a54f1dac80726b559909e418ec638e2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=75
content-length
35578
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"8afa-5ee84c05cb2f7"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1738
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:03 GMT
Fig26_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
5 KB
5 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig26_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7eee4aa440a39e196f4963c5eab17795cb221fbc2c64230315f7db0edcd33910
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=157
x-prod-n-01
Yes
content-length
5211
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"145b-5ee84c05e7820"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1705
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:30 GMT
Fig27_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
15 KB
16 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig27_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
25852158b361f087b7980922d334f690245a451ef8d5e675e6bb016d5408ce71
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=81
x-prod-n-01
Yes
content-length
15751
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"3d87-5ee84c05e7820"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1719
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:44 GMT
Fig28_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
26 KB
27 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig28_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c8c8b8e936333bef64ff9515294435d940ddb43ddc9ec1306796a47a9e26d628
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=71
x-prod-n-01
Yes
content-length
26955
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"694b-5ee84c05c2a3c"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1617
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:25:02 GMT
Fig29_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
49 KB
49 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig29_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c024bfd3bdc21afe60cf23a40414b16f1c5b05c54f9215f846bf434be501fe05
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=70
content-length
49723
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"c23b-5ee84c05e7c08"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1688
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:13 GMT
Fig30_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
29 KB
29 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig30_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2b83e226cec74cec799506638ae8a6d4931ec355f02f08f8cd21f35be2f0bda5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=100
x-prod-n-01
Yes
content-length
29296
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"7270-5ee84c05f201b"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:28:05 GMT
Fig31_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
59 KB
59 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig31_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5f456fa011345f7182fcc8290931a1a4961f9b53efee21c4ab7a6ff26114246b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=77
x-prod-n-01
Yes
content-length
59987
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:54 GMT
server
nginx
etag
"ea53-5ee84c05e7c08"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1737
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:02 GMT
Fig32_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
13 KB
13 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig32_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c39b94db3a7747f5219df61354de85d653b6fbdbe11c2d3277f05825c810f2d7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=66
content-length
13420
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:13 GMT
server
nginx
etag
"346c-5ee84c18e6ec6"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:28:05 GMT
Fig33_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
63 KB
63 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig33_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
01344ea4f9f715dd46193c937c07e014657bd95feaf87b63fd64428413e74b82
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=92
x-prod-n-01
Yes
content-length
64301
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"fb2d-5ee84c05c68bd"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1756
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:27:21 GMT
Fig34_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
51 KB
51 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/Fig34_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f2587e91435153eca3e6e565d27c0a6f7bb7d328e91b9ca73d9529c1088ab8f0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=80
content-length
51766
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:46:53 GMT
server
nginx
etag
"ca36-5ee84c05c8be6"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1701
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:26 GMT
MITRE_Earth%20Preta.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/
77 KB
78 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/k/earth-preta-spear-phishing-governments-worldwide/MITRE_Earth%20Preta.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9eafa4081de1be9cd15a3d534b112e83d3b30ddb6023676edacf23c729626900
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=332
x-prod-n-01
Yes
content-length
78878
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:47:13 GMT
server
nginx
etag
"1341e-5ee84c1805135"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1723
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:26:48 GMT
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
18 KB
7 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
x-prod-n-02
Yes
date
Mon, 28 Nov 2022 11:58:04 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
6497
x-xss-protection
1;mode=block
last-modified
Wed, 16 Nov 2022 00:04:19 GMT
server
Akamai Resource Optimizer
etag
W/"48de-5ed8b31850fe4"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=72824
accept-ranges
bytes
expires
Tue, 29 Nov 2022 08:11:48 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
81 KB
23 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
x-prod-n-02
Yes
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
22997
x-xss-protection
1;mode=block
last-modified
Wed, 16 Nov 2022 02:41:11 GMT
server
Akamai Resource Optimizer
etag
W/"1457a-5ed890330fab4"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=80263
accept-ranges
bytes
expires
Tue, 29 Nov 2022 10:15:48 GMT
iframe_api
www.youtube.com/
992 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7028ce246826b7ed6bb35f54c2cd43b0c851b84278f8b8b64b03b95190e24356
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Mon, 28 Nov 2022 11:58:05 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
391 KB
101 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
8fa2affad47d95e0e6345419f542afcd62e9359d5db5e5b943fb2218b8955b8f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Tue, 22 Nov 2022 01:45:24 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 28 Nov 2022 11:58:05 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
102550
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
date
Mon, 28 Nov 2022 11:58:05 GMT
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
x-host
s7.addthis.com
content-length
116325
821060e3-3f9c-4a2f-8613-8e0db4841f79.json
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/821060e3-3f9c-4a2f-8613-8e0db4841f79.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c44bd059b9c622135be58769922c683d91de4f38676110fd00850bcc2935f44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
sSaSrWCLuhJ22ZvRvYoUZA==
age
32402
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1609
x-ms-lease-status
unlocked
last-modified
Wed, 11 May 2022 18:06:16 GMT
server
cloudflare
etag
0x8DA3378F14E3260
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
72afcb60-101e-00c1-4080-65535f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee011f889070-FRA
expires
Tue, 29 Nov 2022 11:58:04 GMT
j.php
dev.visualwebsiteoptimizer.com/
3 KB
2 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&f=1&r=0.8146598025082479
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
7063532428b5ced41620585d617d90fa5e6b54324a6762510503e03aa57d3574

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:04 GMT
content-encoding
gzip
via
1.1 google
server
gfra1
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, no-cache, must-revalidate
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
autopilot_sdk.js
cdn.bc0a.com/autopilot/f00000000017219/
46 KB
17 KB
Script
General
Full URL
https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.125.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
55a23478291e8e3095cc198af9ea9c2fe74284e2e10dcd73a985461cec632577

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-goog-meta-marvel_enabled
true
content-encoding
gzip
age
554
x-guploader-uploadid
ADPycdsximPSZnRnR0cRutBxJl6KqB-dlj5DMsEe92BZSzek1TbYE5guf-4Myg8dG3yuthN57LQovGzAabzBPaLffgN1hrs6GHr0
x-goog-meta-sdk_canonical_host
x-goog-meta-sdk_whitelist
x-goog-stored-content-encoding
gzip
x-goog-meta-publishingdate
2022-08-25 23:21:50
x-goog-meta-sdk_canonical_protocol
etag
"291f0921837a10fe276eb399927322e3"
vary
Accept-Encoding
x-goog-generation
1661469710703449
content-language
en
access-control-allow-origin
*
x-goog-meta-custom
true
access-control-expose-headers
Content-Type
x-goog-meta-marvel_test_mode
false
cache-control
public, max-age=3600
content-type
application/javascript
x-goog-meta-spa
false
expires
Mon, 28 Nov 2022 12:48:51 GMT
x-goog-meta-sdk_version
1.5.6
date
Mon, 28 Nov 2022 11:48:51 GMT
x-goog-meta-sdk_account_id
f00000000017219
x-goog-meta-sdk_request_parameters_case_sensitive
false
x-goog-meta-marvel_config_consistency_custom
{"data-url":"dataservice.tmok.tm/tc.png,trendmicro.scene7.com,0,.66,1&qlt=80,1.0&amp","data-dropsrcset":"true","data-customerid":"f00000000017219","data-ignorepath":"uat-author.we.trendmicro.com,uat.we.trendmicro.com,prod-author.we.trendmicro.com,qa-author.we.trendmicro.com,qa.we.trendmicro.com"}
x-goog-storage-class
MULTI_REGIONAL
x-goog-meta-marvel_customer_id
x-goog-meta-sdk_log_level
2
x-goog-metageneration
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15689
x-goog-meta-content_only
false
last-modified
Thu, 25 Aug 2022 23:21:50 GMT
server
UploadServer
x-goog-hash
crc32c=FtM7/Q==, md5=KR8JIYN6EP4nbrOZknMi4w==
x-goog-stored-content-length
15689
accept-ranges
bytes
x-goog-meta-disable_debug_elements
false
domaingroupcheck
cookies-data.onetrust.io/bannersdk/v1/ Frame
0
0
Preflight
General
Full URL
https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
domainid,location,url
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers
domainId, url, location, Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With
access-control-allow-methods
GET, HEAD, OPTIONS
access-control-allow-origin
*
cf-ray
7712ee01fb419199-FRA
content-length
0
content-type
application/json
date
Mon, 28 Nov 2022 11:58:05 GMT
server
cloudflare
vary
Accept-Encoding
domaingroupcheck
cookies-data.onetrust.io/bannersdk/v1/
17 B
84 B
XHR
General
Full URL
https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1aabe1212b2f9cb8f6a547454bd4e5f4773485e3e001b327e501ba3e0e77cc7

Request headers

location
cdn.cookielaw.org
Referer
https://www.trendmicro.com/
url
www.trendmicro.com
accept-language
de-DE,de;q=0.9
domainId
821060e3-3f9c-4a2f-8613-8e0db4841f79
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7712ee026c1c9199-FRA
access-control-allow-headers
Content-Type
content-length
17
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
295 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7712ee01fce69b82-FRA
access-control-allow-headers
Content-Type
0186103181
ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/
8 KB
2 KB
XHR
General
Full URL
https://ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/0186103181?client=js_sdk&client_version=1.5.6&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F107.0.5304.121%20Safari%2F537.36
Requested by
Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.194.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
12.194.111.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
d172f2ebf38a578b105a8f3679bd3d73ec09e4388da4413526314df191623397

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-be-pop
BRU-1-302
date
Mon, 28 Nov 2022 11:57:56 GMT
content-encoding
br
via
1.1 google
server
bws/1.0
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
KL7L2-AE63W-6L875-PUGB2-GU2BB
s.go-mpulse.net/boomerang/
205 KB
49 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/KL7L2-AE63W-6L875-PUGB2-GU2BB
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:586::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
last-modified
Fri, 28 Oct 2022 16:06:24 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
x-n
S
timing-allow-origin
*
content-length
50393
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
99 KB
21 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5e90294a34f40c10c13b80c266bc93f6e569009c37b09762bab41104f1ecd457

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 21:04:52 GMT
server
AkamaiNetStorage
etag
"dee30b16ead3e107beb0f56a0ae167ff:1666386292.657867"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
20874
expires
Mon, 28 Nov 2022 12:03:05 GMT
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/
24 KB
14 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 09 Dec 2021 18:07:24 GMT
server
nginx
date
Mon, 28 Nov 2022 11:58:05 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-font-ttf
cache-control
public, max-age=749
server-timing
cdn-cache; desc=HIT, edge; dur=1
x-prod-n-01
Yes
content-length
14370
x-xss-protection
1;mode=block
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/
44 KB
44 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 26 Nov 2022 16:15:31 GMT
x-content-type-options
nosniff
age
157354
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44856
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:20:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 26 Nov 2023 16:15:31 GMT
logo-desktop.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
5 KB
6 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:bc00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id
hdcOBxe33mrcHvAl.WGp5zXvLxpIZI.5
date
Mon, 28 Nov 2022 00:22:57 GMT
via
1.1 a10d58b5ce965502cc34c5b27682fe22.cloudfront.net (CloudFront)
x-amz-request-id
DAGT1ER0CKE18VX8
x-amz-cf-pop
FRA2-C2
age
41709
x-cache
Hit from cloudfront
content-length
5310
x-amz-id-2
AVlCBqjbSBe3kIgYR7les+JbcZDhRYXibiNMXFal/zyXRq1lcGxW1fxgNAjgeVOhL3zyCt9ISdE=
x-amz-expiration
expiry-date="Fri, 25 Oct 2024 00:00:00 GMT", rule-id="delete-old-images"
last-modified
Fri, 28 Jan 2022 19:12:56 GMT
server
AmazonS3
etag
"52561d918e54912574b9ed5bb5993edb"
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
0Gw1KfxiIt6tnFrGKiqRSTltleH5bNInlGW1lGJWru7txSnlyqkjnA==
nav-cyber-risk-index.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/
Redirect Chain
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
  • https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
27 KB
27 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
336ed2f40837f4d988e5f5e348ab7861b11ab0c760254e3eacd37aff33b66a81
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:58:05 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
27352
x-xss-protection
1;mode=block
last-modified
Mon, 28 Nov 2022 09:44:14 GMT
server
nginx
etag
"6ad8-5ee84b6dd9a0a"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=231
accept-ranges
bytes
expires
Mon, 28 Nov 2022 12:01:56 GMT

Redirect headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:04 GMT
via
1.1 google
x-content-type-options
nosniff
x-frame-options
DENY
location
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
0
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/
72 KB
72 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Mon, 28 Nov 2022 11:58:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=250
server-timing
cdn-cache; desc=HIT, edge; dur=8
content-length
73259
x-xss-protection
1;mode=block
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 21 Nov 2022 18:54:08 GMT
x-content-type-options
nosniff
age
579837
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47952
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:22:41 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 21 Nov 2023 18:54:08 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.34.0/
348 KB
83 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e88dafe889a514ea8b9b07747f53d08b66a473b7caa78645b4aa2167563651e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ywzctmjVIapkx83Pz3a+AQ==
age
42959
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
84671
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:35 GMT
server
cloudflare
etag
0x8DA3822B5C4CCF6
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
d89fe3b5-901e-0071-140d-6aaadf000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee02a9345ca4-FRA
utag.69.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.48.202006041752
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e687349ef50927f263497a200ed021ebaa6d13850a8b9a0a19de3d2260729d69

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:14 GMT
server
AkamaiNetStorage
etag
"5a5fb4e9111a2b14d5b5876eb2258fd7:1632240614.594178"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1005
expires
Tue, 13 Dec 2022 11:58:05 GMT
dict.en_us.json
www.trendmicro.com/libs/cq/i18n/
14 KB
4 KB
XHR
General
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en_us.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-content-type-options
nosniff
server
nginx
date
Mon, 28 Nov 2022 11:58:05 GMT
etag
"b91bea50244aae0b72b630e6c7e2791f"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json;charset=utf-8
cache-control
public, max-age=288
server-timing
cdn-cache; desc=HIT, edge; dur=1
x-prod-n-01
Yes
content-length
4080
x-xss-protection
1;mode=block
earth-preta-spear-phishing-governments-worldwide.disruptor.html
www.trendmicro.com/en_us/research/22/k/
497 B
891 B
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.disruptor.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ab83d390c5a330c4e24f70cadbd0562b2731c597f489f33b542cdad7324073f7
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-prod-n-02
Yes
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
x-prod-a-01
Yes
x-content-type-options
nosniff
content-encoding
gzip
server
nginx
date
Mon, 28 Nov 2022 11:58:05 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/html;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=28
content-length
358
x-xss-protection
1;mode=block
x-akamai-transformed
9 358 0 pmb=mRUM,2
earth-preta-spear-phishing-governments-worldwide.notifications.html
www.trendmicro.com/en_us/research/22/k/
2 KB
1 KB
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.notifications.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.203.87.70 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-203-87-70.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a6e03b0e32ba6f8e660e18d971582f7b518bf576ab157a935bb315b5441902e4
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-prod-n-02
Yes
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
x-prod-a-01
Yes
x-content-type-options
nosniff
content-encoding
gzip
server
nginx
date
Mon, 28 Nov 2022 11:58:05 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/html;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=20
content-length
682
x-xss-protection
1;mode=block
x-akamai-transformed
9 682 0 pmb=mRUM,2
utag.138.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.138.js?utv=ut4.48.202010201643
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
62e37140e90c20b8021e84f22588bff6f0789e2ac60bd107b21017d0acd41b51

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"fe1348f92b91321140f39aae7ca068de:1632240611.865646"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1008
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
24 KB
6 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.48.202210071302
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a112f5ad8a0efbb4605e340343335f673baa91f0d818d75b2fcf8f6f03898d29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Fri, 07 Oct 2022 13:02:51 GMT
server
AkamaiNetStorage
etag
"955c88ad1dc45ae529a3846657dace1c:1665147771.429537"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
5886
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b8a34dec51d1542d219b92e8425cae1fcd3f55c26f8d9cb67d2a9e7c2e79543d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"df2edd1ac891eacf5b6ba635cc9a59eb:1632240611.664523"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1706
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8f37c9815fbb866d0417ebe23f74ccbf507ea03f969260f576cfd4bbd9da2a28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:12 GMT
server
AkamaiNetStorage
etag
"c184aaf7bc67f12bab7821647c2a3235:1632240612.296587"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1024
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.22.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.22.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d90e0559dfab1d9ad441137a378eb4ab5a53e4b5103d0293dc558197bfb93bd2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:19 GMT
server
AkamaiNetStorage
etag
"5b1c9d86c6089e24314a2b9fa0b97913:1632240619.494572"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1229
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.9.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e348f721442e051780e0a89843aaad43dbe518d051cad5ce5b6816397a8fc773

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:21 GMT
server
AkamaiNetStorage
etag
"aa9516dc0bc8d1f409640e8bce32c4d4:1632240621.08215"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1392
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.43.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c7a2cccb0b1fc37d2a9e142f920f5c9e640d12a262eb181abab41e81cd12be61

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:16 GMT
server
AkamaiNetStorage
etag
"ddd833e52fd9dadb9f3f123c1c3899f7:1632240616.251282"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
924
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.48.201608171750
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3ee9ec06bbfa8bb6e040e6edc9718c1905b557f3e9e988398b70d378096d02f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:17 GMT
server
AkamaiNetStorage
etag
"d30dc4298bf51cb89a8006ff7c576208:1632240617.067512"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1454
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.79.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
1 KB
1011 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.79.js?utv=ut4.48.202209211819
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8a2ddfc3ec0269c7c979608073574c3eadec9932afc4a660dc0af4a1e6ce2e3b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:17 GMT
server
AkamaiNetStorage
etag
"e3edb58cc720a93d9d13440ce0dfa4dc:1632240617.258721"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
782
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.115.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
10 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.48.202109201636
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0e1a25f94e38ff616b88e4917d4ed2ee83bfdddd4358f92a82e7d87a09ff9b2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:16 GMT
server
AkamaiNetStorage
etag
"8a244bdc8d96727c0cd96abe81761b34:1632240616.040797"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
3245
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.99.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
10 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.99.js?utv=ut4.48.201709111706
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a1019d01046c662a58fa0b369f4f6f67428e15d6501de94b1d4b3a3b8925d54f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:15 GMT
server
AkamaiNetStorage
etag
"dca3384138b255c3c0a60afe6d75194b:1632240615.256807"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2503
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.117.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.48.202109291943
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
6cf98f8e68625661d1727e1c02fb5bfb8583f865f8834518b4723873dfbe9722

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:22 GMT
server
AkamaiNetStorage
etag
"56e0bd0a021d82315367abad98387f41:1632240622.162245"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
974
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.124.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.124.js?utv=ut4.48.202009171637
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c67a98460c2dbd3d301997c6b0cda7919f33d554f8b084f14f3759012299e148

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:14 GMT
server
AkamaiNetStorage
etag
"6f7b1fa653e43c64c2821de2bfefb8d6:1632240614.821376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1216
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.127.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.48.201905291644
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cff36a8c3e27d13c9df7ce018399b3b59c5bb70de2b59bb38ba6daaf6aef5ac0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:18 GMT
server
AkamaiNetStorage
etag
"88edc44ec40b8a9fd70c73388cc23538:1632240618.574449"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
970
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.144.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.144.js?utv=ut4.48.202101191804
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
455995299358961f1a9ade799587a2e03c86f1c2177f885742a03706b7e0c94a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:23 GMT
server
AkamaiNetStorage
etag
"8c835bba0a472164830a5312363c5013:1632240623.134748"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
870
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.145.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.48.202108241956
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f795b85773aeeb4d69eb8d36e82f9106344b4a5edf011f9cb22eb4d4e146f3e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:15 GMT
server
AkamaiNetStorage
etag
"d1220ca3cd0299455402f6faf7c5e8e8:1632240615.012675"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1778
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.151.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.48.202109071517
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
bd701a68dddee2555a381f41190b0b2137d435b7e8a79af86d520425633c7f46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"a75cf0ef4ef7b4ebf26c805084a1ccc2:1632240611.460542"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1067
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.171.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
13 KB
4 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.171.js?utv=ut4.48.202203161827
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9a9b32b9a635111a54aa24bd29d8e0b65b406777e1e69f310584b02357857738

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Wed, 16 Mar 2022 18:27:45 GMT
server
AkamaiNetStorage
etag
"5f465c0d368080806396d5a0459c1077:1647455265.289734"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
3677
expires
Tue, 13 Dec 2022 11:58:05 GMT
utag.181.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.181.js?utv=ut4.48.202210212104
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e658c733c8ab21f617f9c28424180c31127843e0ca1597a243c9fc3b4c8a38a4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 21:04:52 GMT
server
AkamaiNetStorage
etag
"806d2e0cbde438f671cb774b0b3cb780:1666386292.899175"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1344
expires
Tue, 13 Dec 2022 11:58:05 GMT
conv_v3.js
cdn.b0e8.com/
67 KB
22 KB
Script
General
Full URL
https://cdn.b0e8.com/conv_v3.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.5.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.5.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
960d1f95f71be9bc4c13e06c200762c60cdc944d3289687f9d9faa6cf7b17506

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:21:14 GMT
content-encoding
gzip
age
2211
x-guploader-uploadid
ADPycdsHhtW2iP__iVTwbHR7_myenQ6CrQq6C8AlaWrFiG_l6y1ItheQlx4QlzG5nSSW_IETaYtjks0D77265DfoWvmnI8YGjlhv
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21573
last-modified
Wed, 23 Mar 2022 23:53:55 GMT
server
UploadServer
etag
"0acedbfc86d9cc291bf807c3fe3ea666"
vary
Accept-Encoding
x-goog-hash
crc32c=lWvUnQ==, md5=Cs7b/IbZzCkb+AfD/j6mZg==
x-goog-generation
1648079635204763
content-language
en
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
21573
accept-ranges
bytes
content-type
application/javascript
expires
Mon, 28 Nov 2022 12:21:14 GMT
v.gif
dev.visualwebsiteoptimizer.com/
35 B
214 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=DF68B6219968C96B89E70203CFDB2A1F5&h=a9f8b896ec1f71f33ca9d52440c3577b&t=false&r=0.6214702682246787
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:05 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
www-widgetapi.js
www.youtube.com/s/player/4eb6b35d/www-widgetapi.vflset/
161 KB
53 KB
Script
General
Full URL
https://www.youtube.com/s/player/4eb6b35d/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47879e9a46a232ac6fa8931b17f3dbe8a09ea02497c2394abf2e45c431b9b5ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 10:43:01 GMT
content-encoding
br
x-content-type-options
nosniff
age
4504
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54014
x-xss-protection
0
last-modified
Mon, 21 Nov 2022 01:17:16 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 28 Nov 2023 10:43:01 GMT
gtm.js
www.googletagmanager.com/
387 KB
90 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4cd4692515d498d3a3a0092684ce30d83f6c5e175ff861d3ae8fe709740e82d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
92531
x-xss-protection
0
last-modified
Mon, 28 Nov 2022 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 28 Nov 2022 11:58:05 GMT
en.json
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/241ca2a9-f5a7-4b39-9481-69784d1c195e/
218 KB
39 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/241ca2a9-f5a7-4b39-9481-69784d1c195e/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adeaebb429d938d9796d62c756b3846dee391cd6735875b9740366b2e12a5cc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
RKzLrqncn7iWJtAuc6FZ5w==
age
11482
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
39363
x-ms-lease-status
unlocked
last-modified
Wed, 11 May 2022 18:06:23 GMT
server
cloudflare
etag
0x8DA3378F563BCA7
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
816b9cb7-201e-0063-427c-659ec3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee03ed319070-FRA
expires
Tue, 29 Nov 2022 11:58:05 GMT
gtm.js
www.googletagmanager.com/
124 KB
48 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b2f668f1b31e119ced53c8c2414d0b609b2f052bbf8470af8e19e56844800eb5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49037
x-xss-protection
0
last-modified
Mon, 28 Nov 2022 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 28 Nov 2022 11:58:05 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.24.170.43 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-170-43.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Sep 2022 01:18:39 GMT
Server
AkamaiNetStorage
ETag
"92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
728
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.48.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:51:04 GMT
last-modified
Tue, 27 Sep 2022 22:01:05 GMT
server
Golfe2
age
421
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Mon, 28 Nov 2022 13:51:04 GMT
quant.js
secure.quantserve.com/
25 KB
10 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:5ed4:8d5d:fed7:f5ef , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
275094aa5d73cd24d848e78f0c41c33d9fd61a09d97b9976e5e707dfd24ada00

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
etag
"nAbmxtqHqaYrwBiADJAeFg=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Mon, 05 Dec 2022 11:58:05 GMT
fbevents.js
connect.facebook.net/en_US/
103 KB
28 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d5c905d7ce4679b183eb11f7c6811682ddffbf0f037590360ae2b1a84a51ef1b
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 28 Nov 2022 11:58:05 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27340
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
Tx/d+C/xObuUsKwIc21QQRHjunHfgkx7kcGWrc/Xls/Nrzyy6JuCyaJxfyHeseXJBbjlXlFKKpKRFLKdGamlbQ==
x-fb-trip-id
917726464
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/
41 KB
15 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.48.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
4f0fa35c5a44677cc0a678f03795032aa862275dc29e978a84a2ee41ef267c10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15190
x-xss-protection
0
server
cafe
etag
16595884479219046262
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 28 Nov 2022 11:58:05 GMT
insight.min.js
sjs.bizographics.com/
13 KB
5 KB
Script
General
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.48.201510262117
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
641153b2ad78e5d095645419060a4ea0854b1b3ec5ff27e99644c9f8d461610c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Thu, 17 Nov 2022 18:52:45 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=16534
accept-ranges
bytes
content-length
4581
addthis_widget.js
s7.addthis.com/js/250/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/250/addthis_widget.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.79.js?utv=ut4.48.202209211819
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
date
Mon, 28 Nov 2022 11:58:05 GMT
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
x-host
s7.addthis.com
content-length
116410
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/
2 KB
1 KB
Script
General
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 15 Oct 2022 02:17:06 GMT
server
cloudflare
age
18
etag
"4835db-6f3-5eb0956c35e41"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
7712ee063cd0996c-FRA
content-length
695
expires
Mon, 28 Nov 2022 11:59:05 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 28 Nov 2022 11:15:54 GMT
last-modified
Tue, 27 Sep 2022 22:01:05 GMT
server
Golfe2
age
2531
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20039
expires
Mon, 28 Nov 2022 13:15:54 GMT
config.json
c.go-mpulse.net/api/
1 KB
967 B
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=KL7L2-AE63W-6L875-PUGB2-GU2BB&d=www.trendmicro.com&t=5565456&v=1.720.0&sl=0&si=35cf6459-21b1-49b9-9461-5f3a6595543e-rm23wt&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=807181
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/KL7L2-AE63W-6L875-PUGB2-GU2BB
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:981::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9719cef05e4ed37ab3fef49dc297464322062d32382d8275ba599d12f40bb840

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:05 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
647
ktag.js
resources.xg4ken.com/js/v2/
9 KB
4 KB
Script
General
Full URL
https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EB
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.48.202109291943
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.71.88.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-71-88-40.compute-1.amazonaws.com
Software
nginx /
Resource Hash
6269bafb85bd4d4fed6589655f7e0b8b612397226168098f95d3507848075f6d
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
content-encoding
gzip
last-modified
Mon, 14 Nov 2022 12:23:07 GMT
server
nginx
etag
"6372332b-dd8"
content-type
application/javascript
cache-control
max-age=86400, public
content-length
3544
x-xss-protection
1; mode=block
expires
Tue, 29 Nov 2022 11:58:06 GMT
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-hhn11537-HHN
3083.js
js.idio.co/
24 KB
5 KB
Script
General
Full URL
https://js.idio.co/3083.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.144.js?utv=ut4.48.202101191804
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-37.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e413ce2260c8c306af69d83e5696a29d82a010e043a24894aee8611e181d01c3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sun, 27 Nov 2022 15:41:43 GMT
content-encoding
gzip
via
1.1 da9380f22ff2303fc2fd4652bf7ec7ba.cloudfront.net (CloudFront)
last-modified
Tue, 30 Aug 2022 15:10:28 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P5
age
73034
etag
W/"07d24c8a03eeb3b1ce8ca0b70905197d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400
x-amz-cf-id
kI6SykOTi2CSVmcTrSA7H1yAHyhQ6-xKA755zh9B5bIO7Gvjx3dnCg==
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.48.201905291644
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Fri, 18 Nov 2022 19:04:35 GMT
server
cloudflare
age
124
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
cf-ray
7712ee05bc299213-FRA
expires
Mon, 28 Nov 2022 12:06:00 GMT
app.js
acsbapp.com/apps/app/dist/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/dist/js/app.js
427 KB
139 KB
Script
General
Full URL
https://acsbapp.com/apps/app/dist/js/app.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
138.128.247.123 New York, United States, ASN36007 (KAMATERA, US),
Reverse DNS
Software
/
Resource Hash
e7bd8851b07a73755dbbd07fe9def642394581ebab2171e38173dacbfc062aa0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
content-encoding
br
last-modified
Tue, 01 Nov 2022 18:06:07 GMT
etag
"6aab4-6361600f-af3ebb833015feec;br"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
142347
expires
Tue, 29 Nov 2022 11:58:06 GMT

Redirect headers

location
https://acsbapp.com/apps/app/dist/js/app.js
date
Mon, 28 Nov 2022 11:58:06 GMT
content-length
707
content-type
text/html
js
www.googletagmanager.com/gtag/
211 KB
74 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
23816f3bbf0affff2c32eb91da22f840f51ba0efa615f040f10cb9ff3f831005
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
75987
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 28 Nov 2022 11:58:05 GMT
sv2uuh4gw3ms.js
js.driftt.com/include/1669636800000/
211 KB
60 KB
Script
General
Full URL
https://js.driftt.com/include/1669636800000/sv2uuh4gw3ms.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.48.202109071517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
0a4a68011410d87295e6c0beca23809f99ad75b1151922daa40a7e1a28d7521a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id
IYTe_K3dVGydwXyIHNPaLqOnCwVXn.vj
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Mon, 28 Nov 2022 11:58:06 GMT
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Tue, 22 Nov 2022 16:34:02 GMT
server
istio-envoy
etag
W/"c50e8c520371fc3b49567eb9c2c215cc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0D3salUybywHG2d4UqLD-QdA_1ai2Cv2Dd9g3D3w7xWQiBY9CGVoIQ==
6si.min.js
j.6sc.co/
30 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
aca17711b2bcab8335b7bd9c2880033b2aa69a0e9f33ce2e1a507dbb0f9cade3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 29 Sep 2022 20:55:46 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63360652-7700"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
9869
expires
Mon, 28 Nov 2022 11:58:05 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
216 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202210212104&cb=1669636685441
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

unused62
8096267
date
Mon, 28 Nov 2022 11:58:05 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Mon, 28 Nov 2022 12:08:05 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.34.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ae30f6f2162279a812bf9e00efd0c985e20e76efece9444125b410f3a6822a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
e9t+XAucPzqMmpjFA11lKw==
age
35696
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2959
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:25 GMT
server
cloudflare
etag
0x8DA3822AFD03491
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
ee22fbf2-701e-00f8-6913-6a13fb000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7712ee04ae989070-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.34.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
/wtHD+oYY7dZRzCx50GZrQ==
age
35696
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:39 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
4b133ec1-d01e-0150-4a13-6a81bb000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7712ee04ae9a9070-FRA
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.221.169.143 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-169-143.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
B402EDC6F7271ED7
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45437
accept-ranges
bytes
content-length
948
x-amz-id-2
3ZiQcYtRTuh4WJ4BUq+mWoVqgQk4EdHwIkUrSZre2GxPFo/4IUZsv5aBqLknQUvSl0wjR3iM+HQ=
__utm.gif
ssl.google-analytics.com/r/
35 B
54 B
Image
General
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2125946150&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&utmhid=469689630&utmr=-&utmp=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&utmht=1669636685691&utmac=UA-29051577-12&utmcc=__utma%3D44797537.147826248.1669636686.1669636686.1669636686.1%3B%2B__utmz%3D44797537.1669636686.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1982704594&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
243552383039605
connect.facebook.net/signals/config/
293 KB
84 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/243552383039605?v=2.9.89&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
979f4f46b0dd74ac9c73f06b349ad5a153b5b35c8ea8c9b696042a8779aad36b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 28 Nov 2022 11:58:06 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
/FjjXOlaUCG7qz5j95VaA0i6r6GjzJ98VYY0wtiLEyhhjo8na9jArP5ahSpAmuF2l1RFjnxo+iq15drkjIrJWg==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/svg+xml
token
cdn.linkedin.oribi.io/partner/8866/domain/trendmicro.com/
36 B
374 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/8866/domain/trendmicro.com/token
Requested by
Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 28 Nov 2022 11:12:14 GMT
content-encoding
gzip
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
2751
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
m8Ssv4XFYICDdOwg_nJPmEgpy8vcYrl2icLAiWX5RlhgHcKgiyTteg==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1669636685777%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&l...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&...
0
482 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&liSync=true&e_ipv6=AQLvLmXZBBMBAAAAAYS-GgJS8ccqx67G6UYnok14uk7HL7oxunsUuGqm4n3XlRf2-W-NcAyZ
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 2D74B296B1C340C19453CBA0B7EDBED3 Ref B: FRAEDGE1722 Ref C: 2022-11-28T11:58:06Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type
application/javascript
x-li-fabric
prod-lor1
x-cache
CONFIG_NOCACHE
x-li-proto
http/2
content-length
0
x-li-uuid
AAXuhpWeRj+nPDGGH5rOyw==

Redirect headers

date
Mon, 28 Nov 2022 11:58:05 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: B65F3AA3361D426AB7CC187E6F8951A9 Ref B: FRAEDGE1814 Ref C: 2022-11-28T11:58:06Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1669636685777&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&liSync=true&e_ipv6=AQLvLmXZBBMBAAAAAYS-GgJS8ccqx67G6UYnok14uk7HL7oxunsUuGqm4n3XlRf2-W-NcAyZ
x-cache
CONFIG_NOCACHE
x-li-proto
http/2
content-length
0
x-li-uuid
AAXuhpWY6rN7RyZRUDqDEA==
token
cdn.linkedin.oribi.io/partner/8866/domain/trendmicro.com/ Frame
0
0
Preflight
General
Full URL
https://cdn.linkedin.oribi.io/partner/8866/domain/trendmicro.com/token
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:1000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
1800
age
36940
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length
0
date
Mon, 28 Nov 2022 01:42:25 GMT
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-id
V-N7VM0JRbqDemtMnSfFC8rhmgdUSR2upGiP-CXL7TI3ljN6F4VrSQ==
x-amz-cf-pop
FRA60-P3
x-cache
Hit from cloudfront
rules-p-yyb3JEF9Pm8ey.js
rules.quantcount.com/
3 B
448 B
Script
General
Full URL
https://rules.quantcount.com/rules-p-yyb3JEF9Pm8ey.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:c800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sun, 27 Nov 2022 16:20:43 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
age
70683
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 21:25:15 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
WZru4o6HmbScfReY621ZLuHJqEUmxmZpzJgnA5YIxURRNTyAoiS0Lw==
/
www.googleadservices.com/pagead/conversion/1015287688/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1015287688/?random=1669636685788&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
d862d22e990db6cb0a8b8ebaeb72672fb81a00976795b1e9c5299683ca1930f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1105
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
brightedge3.php
a1.b0e8.com/
35 B
226 B
Image
General
Full URL
https://a1.b0e8.com/brightedge3.php?id=f00000000017219&p_id=8R2N244P4J44RR6R8RLJR8LRAAAAAAAAAH&bf=a83b221a0f685a62ec2a8e8cefb35509&url=https%3A//www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html&ref=&bn=1&bv=3.44&title=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&metadesc=&metakeywords=apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports&s_id=PR2N244P4J44R6L2JJ6JR8LRAAAAAAAAAH
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.78.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.78.111.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-be-pop
BRU-1-301
date
Mon, 28 Nov 2022 11:58:05 GMT
via
1.1 google
last-modified
Wed, 23 Jun 2021 22:46:15 GMT
server
bws/1.0
etag
"60d3b9b7-23"
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
brightedge3.php
a1.b0e8.com/
35 B
98 B
Image
General
Full URL
https://a1.b0e8.com/brightedge3.php?id=f00000000017219&p_id=8R2N244P4J44RR6R8RLJR8LRAAAAAAAAAH&bf=a83b221a0f685a62ec2a8e8cefb35509&url=https%3A//www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html&ref=&bn=2&bv=3.44&title=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&metadesc=&metakeywords=apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports&s_id=PR2N244P4J44R6L2JJ6JR8LRAAAAAAAAAH
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.78.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.78.111.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-be-pop
BRU-1-301
date
Mon, 28 Nov 2022 11:58:05 GMT
via
1.1 google
last-modified
Wed, 23 Jun 2021 22:46:15 GMT
server
bws/1.0
etag
"60d3b9b7-23"
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
js
www.googletagmanager.com/gtag/
212 KB
74 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8f717815d9a168a0ad2cb680e73cd52b451a8e03a33dbb843598d981e16dd393
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
75951
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 28 Nov 2022 11:58:05 GMT
activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=3555319920798;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;...
5427711.fls.doubleclick.net/ Frame 9B88
0
0

bat.js
bat.bing.com/
38 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
492f3de5b6bff06f8b26f61d37e2e565f8f31e00315600c73d9caa85713e8c29
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 28 Nov 2022 11:58:05 GMT
last-modified
Wed, 09 Nov 2022 21:23:50 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 431C29B3C1B74F06AE842D95F7838384 Ref B: FRA31EDGE0808 Ref C: 2022-11-28T11:58:05Z
etag
"077538f81f4d81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11421
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1669636685861&cv=11&fst=1669636685861&bg=ffffff&guid=ON&async=1&gtm=2wgb90&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&auid=2020846386.1669636686&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9063949de0f63d0b210d8edb7835819b123383066bf962db016c1a78e52c6472
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:05 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
920
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishi...
9572106.fls.doubleclick.net/ Frame D182
Redirect Chain
  • https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phis...
  • https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch...
565 B
313 B
Document
General
Full URL
https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f6.1e100.net
Software
cafe /
Resource Hash
2d96c60752d726559a15b164df4b2067399904d732330bdf6f49215614b3dcda
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
br
content-length
288
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Nov 2022 11:58:06 GMT
expires
Mon, 28 Nov 2022 11:58:06 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 28 Nov 2022 11:58:06 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-15-119.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Sun, 27 Nov 2022 23:31:36 GMT
Content-Encoding
gzip
Via
1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-P7
Age
44790
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
e2GV0_8jxGo5U_q1EAK4Vaa2Orxc8pOeFnxORcYrTnb8CpusqWyXyw==
/
attr.ml-api.io/
Redirect Chain
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
0
234 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
2600:9000:2251:b800:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:07 GMT
via
1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
gO85RbESHiJ2zVeRVzw8d2Lu4PPREGsaW5IUgRh6A3E4z9nEyCDzAg==
content-length
0
apigw-requestid
cT5MagXWoAMESGg=

Redirect headers

Pragma
no-cache
Date
Mon, 28 Nov 2022 11:58:07 GMT
AN-X-Request-Uuid
19e533f9-217a-42a7-bbef-d32036e36270
Server
nginx/1.21.3
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Connection
keep-alive
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.24.170.43 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-170-43.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Wed, 08 Mar 2023 11:58:05 GMT
ia.js
s.idio.co/
2 KB
2 KB
Script
General
Full URL
https://s.idio.co/ia.js
Requested by
Host: js.idio.co
URL: https://js.idio.co/3083.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-95.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
dd21acbddbfa634e9870ed1b19093b0eb7bbe8636d4de590e2aadb23ead5cb3e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 07:20:51 GMT
content-encoding
gzip
via
1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
last-modified
Wed, 05 Aug 2020 11:08:42 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
23697
x-amz-server-side-encryption
AES256
etag
W/"46727094ad49ed02b04a5f128b993736"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
x-amz-cf-id
gDkt8Nae4i4LazJZRunjpp6GawyhVTJlpMjRzq_gmHZ-atZXmfc3kg==
ip.js
s.idio.co/
12 KB
5 KB
Script
General
Full URL
https://s.idio.co/ip.js
Requested by
Host: js.idio.co
URL: https://js.idio.co/3083.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-95.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0f8c26695e4fe2f4397e1a08c7b39633b2811b38d9023d42d3be32a27d23caa2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:56:49 GMT
content-encoding
gzip
via
1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
last-modified
Wed, 05 Aug 2020 11:08:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
106
x-amz-server-side-encryption
AES256
etag
W/"667295c9be42d098b9271c04e336acee"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=300
x-amz-cf-id
GEsHimaJ92uVqc7RBohZxQrdBe6aNt6tDfQriw_UQ_NVJuTjQIVPyw==
adsct
t.co/i/
43 B
378 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=cb2e11c8-88f6-447f-8607-d02868e5aba7&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=8687c56c-c161-4229-9de4-1928ed60c503&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuwoi&type=javascript&version=2.3.29
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-response-time
103
date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
d833199de399e1fc
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
6af01a8df655053f5df25927036f63e483fcc5574772068506e92b49b8fbb857
content-length
43
adsct
analytics.twitter.com/i/
0
0

adsct
t.co/1/i/
43 B
203 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=5&eci=3&event=%7B%7D&event_id=add3cc0e-35ef-44e4-8071-3d5debcdce5e&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=8687c56c-c161-4229-9de4-1928ed60c503&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.29
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-response-time
107
date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4a03024aea7608f0
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
6af01a8df655053f5df25927036f63e483fcc5574772068506e92b49b8fbb857
content-length
43
adsct
analytics.twitter.com/1/i/
43 B
724 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=5&eci=3&event=%7B%7D&event_id=add3cc0e-35ef-44e4-8071-3d5debcdce5e&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=8687c56c-c161-4229-9de4-1928ed60c503&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.29
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-response-time
111
date
Mon, 28 Nov 2022 11:58:05 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
dd9bcfbc2c69ef53
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
77d6ccbb07abc12a0bc27b709f51052fc10ab1866d98a74e353617872b1ba686
content-length
43
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:43:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
874
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1129
x-xss-protection
0
last-modified
Thu, 30 Dec 2021 12:48:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 28 Nov 2022 12:43:32 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
884 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:14:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2621
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 28 Nov 2022 12:14:25 GMT
activity.gif
apt.techtarget.com/activity/
43 B
324 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=1279657&version=2.1.1&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&r=1669636685916
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:06 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
Server
Apache/2.4.6 (CentOS)
ETag
"2b-5850384029cff"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=70
Content-Length
43
collect
region1.google-analytics.com/g/
0
349 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4502MK3B94&gtm=2oeb90&_p=469689630&gdid=dYmQxMT&cid=147826248.1669636686&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1669636685&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&dt=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getuidj
secure.adnxs.com/
11 B
702 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 28 Nov 2022 11:58:06 GMT
AN-X-Request-Uuid
5055117c-6086-477c-aa01-7a9244d66e4e
Server
nginx/1.21.3
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.trendmicro.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
204 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
20 B
257 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:1700:1b1::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
3992ccb3af03535e9a36522b5bdab5c153ee264de529da6bb1eea9fcfa654abc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:1338:92::11
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
20
expires
Mon, 28 Nov 2022 11:58:06 GMT
getuidj
secure.adnxs.com/
11 B
702 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 28 Nov 2022 11:58:06 GMT
AN-X-Request-Uuid
f5dbd3a0-0b75-4e85-9159-670d7132059d
Server
nginx/1.21.3
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.trendmicro.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
204 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
20 B
257 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:1700:1b1::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
3992ccb3af03535e9a36522b5bdab5c153ee264de529da6bb1eea9fcfa654abc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:1338:92::11
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
20
expires
Mon, 28 Nov 2022 11:58:06 GMT
pixel;r=1558976221;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;uht=2;fpan=1;fpa=P0-1907756525-166...
pixel.quantserve.com/
35 B
371 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=1558976221;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;uht=2;fpan=1;fpa=P0-1907756525-1669636685779;pbc=;ns=0;ce=1;qjs=1;qv=48c6ea86-20221121114006;cm=;gdpr=0;ref=;d=trendmicro.com;dst=0;et=1669636685999;tzo=0;ogl=url.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-govern%2Ctitle.Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%2Csite_name.Trend%20Micro%2Cimage.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fcontent%2Fdam%2Ftrendmicro%2Fglobal%2Fen%2Fresearch%2Fthumbnails%2F%2Clocale.en_US;ses=60902b61-6e2d-4680-bf12-274d4380fbdd
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:5ed4:8d5d:fed7:f5ef , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTy...
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1...
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=16...
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=TaKEY9OoNrCR9fgPlOmW0Ac&random=3372604950&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/1015287688/?random=2127891923&cv=9&fst=1669636685788&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=TaKEY9OoNrCR9fgPlOmW0Ac&random=3372604950&resp=GooglemKTybQhCsO&ipr=y&prhg=0
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
945-cxd-062.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1669636686006&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1669636686005-20353&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:07 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
bd026664-5f53-4cce-b4e3-89774f3a3f0e
26044208.js
bat.bing.com/p/action/
0
120 B
Script
General
Full URL
https://bat.bing.com/p/action/26044208.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 28 Nov 2022 11:58:05 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D2EA560BE4954F6B9A15D0EDC4E1645B Ref B: FRA31EDGE0808 Ref C: 2022-11-28T11:58:06Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/
0
176 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=26044208&tm=gtm002&Ver=2&mid=d25fe839-2668-4032-9a0d-fad1d305a8c3&sid=eb419e606f1311edb9eda113163c6b0a&vid=eb41db406f1311ed8d5bfde04b7e783a&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&kw=apt%20%26%20targeted%20attacks,endpoints,research,articles,%20news,%20reports&p=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&r=&lt=821&evt=pageLoad&sv=1&rn=582262
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 28 Nov 2022 11:58:05 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 88CD72D1800E4605A7E7395DD9744224 Ref B: FRA31EDGE0808 Ref C: 2022-11-28T11:58:06Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j98&a=469689630&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&ul=en-us&de=UTF-8&dt=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.147826248.1669636686.1669636686.1669636686.1&_utmz=44797537.1669636686.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1669636686041&_u=aSBCCAIrBAAAACAMIg~&cid=147826248.1669636686&tid=UA-44592531-1&_gid=1172575233.1669636686&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&cd2=Nick%20Dai%7CSr.%20Threat%20Researcher%2CVickie%20Su%7CThreats%20Analyst%2CSunny%20Lu%7CThreats%20Analyst&cd3=2022-11-18&z=1556896298
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
ia.gif
a.idio.co/
26 B
239 B
Image
General
Full URL
https://a.idio.co/ia.gif?r=&s=9bb59192-ea59-414f-b05a-d82befcba472&x%5Bidio_visitor_id%5D%5B0%5D=36c2968e-27ca-46e7-83c6-4340a854ccd2&c=trendmicro&d=3083&a=consume&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&l=1669636686087&z=0.464258135528244
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.237.225.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-237-225-32.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:06 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
26
Content-Type
image/gif
content
api.idio.co/1.0/users/idio_visitor_id:36c2968e-27ca-46e7-83c6-4340a854ccd2/
10 KB
2 KB
Script
General
Full URL
https://api.idio.co/1.0/users/idio_visitor_id:36c2968e-27ca-46e7-83c6-4340a854ccd2/content?include_topics&callback=idio.check0&key=NYGS8MZWQDN1HR1R6U5P&session[]=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&session[]=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&rpp=1&record=pending
Requested by
Host: s.idio.co
URL: https://s.idio.co/ip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.221.131.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-131-160.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b70269a88a926a47d1d82d504e73b281bfc28223658595e834a82075bcd48a06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:06 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Content-Length
2319
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf8
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A11%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A05%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/
530 B
453 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.125.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-125-199.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ced9af3ad54bedceec4434d4225eb3fcdcdd51ffb441abf157fc07eb2e00b312

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
Authorization
Token f0978075a275d14104571cd0b3e9919c9748869b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
content-length
266
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.125.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-125-199.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.trendmicro.com
access-control-max-age
1800
date
Mon, 28 Nov 2022 11:58:06 GMT
server
nginx
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&rl=&if=false&ts=1669636686180&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1669636686179.2043431441&it=1669636685722&coo=false&rqm=GET
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 28 Nov 2022 11:58:06 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.google.com/pagead/1p-user-list/929919117/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/929919117/?random=1669636685861&cv=11&fst=1669633200000&bg=ffffff&guid=ON&async=1&gtm=2wgb90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&fmt=3&is_vtc=1&random=3809625905&rmt_tld=0&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/929919117/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/929919117/?random=1669636685861&cv=11&fst=1669633200000&bg=ffffff&guid=ON&async=1&gtm=2wgb90&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tiba=Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide&fmt=3&is_vtc=1&random=3809625905&rmt_tld=1&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=*;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;...
adservice.google.com/ddm/fls/z/ Frame D182
42 B
494 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=*;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Requested by
Host: 9572106.fls.doubleclick.net
URL: https://9572106.fls.doubleclick.net/activityi;dc_pre=CLyYzazp0PsCFYJOwgodaIIKXA;src=9572106;type=trend002;cat=globa0;ord=5149625461452;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://9572106.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:06 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
config.json
cdn.acsbapp.com/cache/app/trendmicro.com/
159 B
346 B
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/trendmicro.com/config.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.238.215.8 New York, United States, ASN36007 (KAMATERA, US),
Reverse DNS
mail.shweeng.com
Software
/
Resource Hash
5a6aa9f7b3632094df7ea361aba29c2e7d3f7455dc4b3d81de22408e6a30b34d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
last-modified
Mon, 28 Nov 2022 11:56:03 GMT
etag
"9f-6384a1d3-684d718a718431bb;;;"
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
159
expires
Tue, 29 Nov 2022 11:58:06 GMT
/
www.facebook.com/tr/
0
18 B
Image
General
Full URL
https://www.facebook.com/tr/?id=243552383039605&ev=Microdata&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&rl=&if=false&ts=1669636686687&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%2C%22meta%3Akeywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%7D&cd[OpenGraph]=%7B%22article%3Apublished_time%22%3A%222022-11-18%22%2C%22article%3Atag%22%3A%22apt%20%26%20targeted%20attacks%22%2C%22article%3Asection%22%3A%22research%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html%22%2C%22og%3Atitle%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%2C%22og%3Asite_name%22%3A%22Trend%20Micro%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.trendmicro.com%2Fcontent%2Fdam%2Ftrendmicro%2Fglobal%2Fen%2Fresearch%2Fthumbnails%2F22%2FEarth_Preta%2520Spear-Phishing_Governments_Worldwide_641.jpg%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmtealium&ec=1&o=30&fbp=fb.1.1669636686179.2043431441&it=1669636685722&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 28 Nov 2022 11:58:06 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
priority
u=3,i
eb7b819c-4cce-446e-b0d2-d3820c509c95
api.idio.co/1.0/recommendations/
25 B
259 B
Script
General
Full URL
https://api.idio.co/1.0/recommendations/eb7b819c-4cce-446e-b0d2-d3820c509c95?pending=false&_method=patch&key=NYGS8MZWQDN1HR1R6U5P
Requested by
Host: s.idio.co
URL: https://s.idio.co/ip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.221.131.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-131-160.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4f0174da434c9da57c0541730ddbc365915ba5e0290128ed9c1854fdd7eb4344

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:06 GMT
Content-Encoding
gzip
Server
nginx
Connection
keep-alive
Content-Length
45
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf8
cover-apt41-new-subgroup-earth-longzhi.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/22/
22 KB
22 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/22/cover-apt41-new-subgroup-earth-longzhi.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:bc00:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c9a3b18c0119b53d9c674b87100cc411f4d3df584937b8e6ea774f61be820abc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id
jUxCu.KumXmjFJzxi5t7KcJ6NWiDfsyH
date
Mon, 28 Nov 2022 03:57:30 GMT
via
1.1 a10d58b5ce965502cc34c5b27682fe22.cloudfront.net (CloudFront)
x-amz-request-id
CVDHYQWZ43QZD1J4
x-amz-cf-pop
FRA2-C2
age
28837
x-cache
Hit from cloudfront
content-length
22270
x-amz-id-2
gkpu/h0az9hhGwYhZ70U99GjC2x1TaAD2eqvT/ck60EAkXiqXarLCNVYO67lBKNh/nVQ/MJ7IDI=
x-amz-expiration
expiry-date="Wed, 06 Aug 2025 00:00:00 GMT", rule-id="delete-old-images"
last-modified
Wed, 09 Nov 2022 12:01:19 GMT
server
AmazonS3
etag
"4f9022ff1bb4cbe6b816e9c3e3047360"
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
hbaTcjdjONMJbGEDJgaMm3MjOWogGHrkVpHKoiVT7Ecv93VRDYY50Q==
ia.gif
a.idio.co/
26 B
239 B
Image
General
Full URL
https://a.idio.co/ia.gif?r=&s=9bb59192-ea59-414f-b05a-d82befcba472&x%5Bidio_visitor_id%5D%5B0%5D=36c2968e-27ca-46e7-83c6-4340a854ccd2&x%5Bmarketo_id%5D%5B0%5D=_mch-trendmicro.com-1669636686005-20353&c=trendmicro&d=3083&a=identify&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&l=1669636686898&z=0.224128381745065
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.237.225.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-237-225-32.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:06 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
26
Content-Type
image/gif
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A05%20GMT%22%2C%22timeSpent%22%3A%221037%22%2C%22totalTimeSpent%22%3A%221037%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:07 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
en.build.json
cdn.acsbapp.com/cache/app/
238 KB
25 KB
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/en.build.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.238.215.8 New York, United States, ASN36007 (KAMATERA, US),
Reverse DNS
mail.shweeng.com
Software
/
Resource Hash
03f7fce5e0936a5f59921e0482c73abb8a474d4a53749e0f141727bebbb1719a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:06 GMT
content-encoding
br
last-modified
Sun, 06 Nov 2022 16:24:03 GMT
etag
"3b8a8-6367dfa3-ede8b48c2a22d3f6;br"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
25891
expires
Tue, 29 Nov 2022 11:58:06 GMT
logomono.svg
web1.acsbapp.com/apps/app/dist/media/
4 KB
1 KB
Image
General
Full URL
https://web1.acsbapp.com/apps/app/dist/media/logomono.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
138.128.247.123 New York, United States, ASN36007 (KAMATERA, US),
Reverse DNS
Software
/
Resource Hash
eded00575f65de726a63f811022d119ed582721233e74343735cad53930c2a76

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:07 GMT
content-encoding
br
last-modified
Mon, 26 Sep 2022 21:02:04 GMT
etag
"1034-6332134c-7705bf7dfc5e498d;br"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
1210
expires
Tue, 28 Nov 2023 11:58:07 GMT
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
0
233 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Server
2600:9000:2251:b800:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:07 GMT
via
1.1 5b6e22c950501920595c86fc25834582.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
_EuqSVosu_BwFiePGbhkH1J_Iayq5D26OiCJQKTCWQW109e2Y3KNEA==
content-length
0
apigw-requestid
cT5MfjI2oAMEaxw=

Redirect headers

Pragma
no-cache
Date
Mon, 28 Nov 2022 11:58:07 GMT
AN-X-Request-Uuid
226680b8-b12c-4238-8d66-5c970e7a5c8c
Server
nginx/1.21.3
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=4248843737583356065
Connection
keep-alive
X-Proxy-Origin
80.255.7.106; 80.255.7.106; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
core
js.driftt.com/ Frame D27F
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1669636800000/sv2uuh4gw3ms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3df1caa518a23d4a674e208e52851a6c423b319e9d0509ef5119272bb409619d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 28 Nov 2022 11:58:08 GMT
etag
W/"4065185079fdbb4e354b89e495ccd1e5"
last-modified
Tue, 22 Nov 2022 16:33:53 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-id
rtf7_XOSnLLpG0gOmC1TYKJTZFCFygsLbxZdgPNi7dJGstsCjQc9Lg==
x-amz-cf-pop
BOM52-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
gSnTG0FuzGZRFSAPBBsba8Zxq.ktLEhc
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
19
chat
js.driftt.com/core/ Frame 7A2A
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1669636800000/sv2uuh4gw3ms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3df1caa518a23d4a674e208e52851a6c423b319e9d0509ef5119272bb409619d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 28 Nov 2022 11:58:08 GMT
etag
W/"4065185079fdbb4e354b89e495ccd1e5"
last-modified
Tue, 22 Nov 2022 16:33:53 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-id
9N8S6l55AnKU-TcgdOAVACLHHGUGZ6ASnhlXwaNi87iE1xGF9TzC9g==
x-amz-cf-pop
BOM52-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
gSnTG0FuzGZRFSAPBBsba8Zxq.ktLEhc
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
13
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/
5 KB
1 KB
Script
General
Full URL
https://v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:08 GMT
content-encoding
gzip
etag
1901189993--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=56, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
1129
300lo.json
m.addthis.com/live/red_lojson/
88 B
248 B
Script
General
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=6384a24d4bd164db&bkl=0&bl=1&pdt=224&sid=6384a24d4bd164db&pub=ra-57bc9d0c3028a052&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.trendmicro.com&fp=en_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2Cnews%2Creports&colc=1669636687952&jsl=12321&uvs=6384a24dea94d5d4000&skipb=1&callback=addthis.cbs.jsonp__3616749309785090
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4deb19daa5e042aee3e7a6542f11feacc85a91d032426a271dac209a49d8cefc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:09 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
88
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame A8AE
0
0

sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 8A97
71 KB
26 KB
Document
General
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=86313600
content-encoding
gzip
content-length
26421
content-type
text/html
date
Mon, 28 Nov 2022 11:58:07 GMT
etag
W/"5f971164-11adc"
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
p3p
CP="NON ADM OUR DEV IND COM STA"
server
nginx/1.15.8
strict-transport-security
max-age=15724800; includeSubDomains
timing-allow-origin
*
vary
Accept-Encoding
x-host
s7.addthis.com
up
insight.adsrvr.org/track/ Frame 61C6
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&upid=803df29&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Mon, 28 Nov 2022 11:58:08 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
/
684dd326.akstat.io/
0
204 B
Ping
General
Full URL
https://684dd326.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/KL7L2-AE63W-6L875-PUGB2-GU2BB
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:586::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 28 Nov 2022 11:58:08 GMT
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Mon, 28 Nov 2022 11:58:08 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A06%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%222043%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:08 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
results.txt
kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net/eum/
Redirect Chain
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=ptewnmgyd
  • https://kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Server
95.101.27.37 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-27-37.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:08 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin
*
Date
Mon, 28 Nov 2022 11:58:08 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0
results.txt
fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net/eum/
Redirect Chain
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=ptewnmgyd
  • https://fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Server
2a02:26f0:480:f::213:7ee3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date
Mon, 28 Nov 2022 11:58:08 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin
*
Date
Mon, 28 Nov 2022 11:58:08 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/
263 KB
76 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
date
Mon, 28 Nov 2022 11:58:08 GMT
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
shares-post.json
api-public.addthis.com/url/serviceapi/
2 B
311 B
XHR
General
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
date
Mon, 28 Nov 2022 11:58:08 GMT
surrogate-key
sFbt=https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
last-modified
Mon, 28 Nov 2022 11:00:00 GMT
server
nginx/1.15.8
content-type
application/json
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
shares.json
api-public.addthis.com/url/
34 B
337 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&callback=_ate.cbs.rcb_9nxe0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
952355082de2fb5bb5a70f29b5f2291dd73341a35ef1d55af0d4adeba3655be2
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
last-modified
Mon, 28 Nov 2022 11:58:08 GMT
server
nginx/1.15.8
date
Mon, 28 Nov 2022 11:58:08 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
54
shares.json
api-public.addthis.com/url/
34 B
337 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&callback=_ate.cbs.rcb_37900
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.200.123 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-200-123.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
b8c7ad718ad8601879cbc0cb576146442725099bdb53d9007664944952ae186d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
last-modified
Mon, 28 Nov 2022 11:58:08 GMT
server
nginx/1.15.8
date
Mon, 28 Nov 2022 11:58:08 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
54
runtime~main.bad93b5f.js
js.driftt.com/core/assets/js/ Frame D27F
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c7d804b72efc14f38f31f36d27208604ce426c1fcc0d75bc5cd8da0dbcb33c25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
n_PRuVLxRQIA6djMS7198.h2vKp52lgj
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501855
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Tue, 22 Nov 2022 15:50:01 GMT
server
istio-envoy
etag
W/"17a37f5fbc0c33a281c525023061be48"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LQ80h09fIqrflwqpMpNqgMJpLJSA8X3mYQF081WhrdKsNFQxdqbkng==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sun, 13 Nov 2022 01:58:17 GMT
x-amz-version-id
acMzK5HdpE1P7Uh5SmbAEDvBqfV.mpmw
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1331991
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:23 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RmwckvVA2rKyFEjxWkkP-bT2SPOhl_7pK_vl1W9G_wqbz2vzgS_PDA==
main~493df0b3.d3ac7d8e.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.d3ac7d8e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
7ad9ef3a4bc35c8e26b515b58bfa16be478746a7716c91b69c5d53222986f959
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
p2Wfqc_BW7bJ3Kg8GylVOALOUvCgBDRT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008390
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:34 GMT
server
nginx
etag
W/"f953d4d3bced33e843c6d5f9a6da145f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
6YCSJW1FjdNIBp8XJMTcBhneoV_Kc_TJGrag0P0YTlrd7SxLRSPMVw==
49.b6336d11.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
1cb2a3ed712d8fcfa64505237ae54ffe9f2f5d293f371f40871d830891568b88
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 08:55:00 GMT
x-amz-version-id
qjU4EJI6pAjSlG9D7ONy4jT0WBN.eVeC
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1998188
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 04 Nov 2022 15:44:33 GMT
server
nginx
etag
W/"8004ba5ba9fc99e5c559490658a3863f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
07LFM38g0dVSI-tpA2tZ3D1H9vD99UylsxmESjygQ-iMwqx1NY2cPw==
33.ae4de0a0.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.ae4de0a0.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
_VQGkTLf0OtKYb1tKqpjd1Z7bDY6G0FI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008390
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:33 GMT
server
nginx
etag
W/"db0cd5b66c52523e10b87a0c8a2db182"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WE5WUbCn7Aa0DjSfpegF99DmD6d9LdUY2wcrWbILQAfHteMIn6dnyg==
23.60057654.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.60057654.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
489eb2769765657c9325f65117f5c7b87ffc4eab547622608c12c8f6fd60df1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
BMr1uvJd8zlBRohUgZGzy1qf9gBNqCxl
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008389
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"0e963aeeee70e63f5078955e6db860f3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Fu5GX2IceUFD7d8p3DGAKHJWAMdZ9bY1I6xNTqenmkOfs-ekV1OHHg==
18.2ab31195.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
17 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.2ab31195.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
a0da3cdc4c400e5e5030c733b68bff8fddc8c4c82c2432330fa8cb858b16bd85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:40 GMT
x-amz-version-id
FUwCDfBpg.kXMhnNezwZo37Fa0N89x76
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008388
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"09e4a870348ecb960c5807c49bbf0c16"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MuPRHKswe_otz0Ne7lw6zHnfAAx41YEehvreZTAklr1sqWiQghPoIA==
40.5fa801cd.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.5fa801cd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
759a08226cc8d5a5a89c64b7f814457ee6191384f30e4dc9cd123aaf279003fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 22:59:08 GMT
x-amz-version-id
6XoIvKiBYScNWeFfgRYaim_qDycbjZf9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2120340
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 03 Nov 2022 18:22:53 GMT
server
nginx
etag
W/"e7d37d5ffc01767c10d8677c65ead60b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3GM2L5nSJKqltrMNHxRIqZ47d4WMn4_tbDUodnu0D067YhYhbpEdTQ==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
74 KB
75 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 13 Jul 2022 08:31:01 GMT
x-amz-version-id
v9WZS4Xw2HNUrP2n3tHAlzyzG14xdi4T
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
BOM52-C1
age
11935627
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
75961
last-modified
Mon, 11 Jul 2022 14:16:17 GMT
server
nginx
etag
"6d77a76055d81227033363af2f18caf8"
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wW_TQs-VxwPDWhQMWkBT7fSry7Yorxa9JL1QAi9l_a3QDc_PNn1OKg==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 01:12:53 GMT
x-amz-version-id
LzlaU0Vnd12Cs3jxCUINybAdyqEMAn7y
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2630715
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 28 Oct 2022 15:57:21 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aOIBkMZ91mYJTrMWxuFyqyWCwYUwLRG8aeE4VJf0KrV6vFolRrgJQQ==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 22:59:07 GMT
x-amz-version-id
5cwATwXgaPqoNOup_2mDyjDfJxxMocKs
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2120341
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 03 Nov 2022 18:22:51 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
INC5ZAHq12wyQ39lZYR6Ts32XZBQ-otchp124CM0MbeGutxHjmkocw==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:00:04 GMT
x-amz-version-id
PUOEVU3e62m9brOKYhNwQmXhyOdWWoBZ
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2217484
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 01 Nov 2022 17:39:37 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
6BTa2hGV617Lo8uXSyU-3iJTKw8zXGcSNdm37ElVkBvwoaxw-wKWfQ==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
R787YdraJzJ1d6oSpmcp9pT0mwhOzzUG
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008389
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mUA-lowrxIV9_wuyM_H4BoayRBn84N2suMMjG_4006mdWpHprzS18A==
47.9d4808ed.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/47.9d4808ed.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
20997bd3984886e845f5a5e0d036f9808a5e30051f219705ef4e6ef1ef1b0f55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 09 Nov 2022 00:36:52 GMT
x-amz-version-id
4a44m.ts2j6I9ESCZqlGkzr9tHWW3id0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1682476
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 07 Nov 2022 15:08:07 GMT
server
nginx
etag
W/"dfc66008c702c40fea0587f735010013"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
E0AmhKT1RVXfpmYbDTqW08VNY5Pm-LSv2Q5-ld50HTd_Y_O7fhw01w==
38.5941b51c.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/38.5941b51c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
62eb2106959f57e67d6a5209dc51af437b7b61a4256fd93b1a822e4d606ef9ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
yOObLyWPPKglSJBgJ.0gbeho8i3spFHh
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008391
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:33 GMT
server
nginx
etag
W/"aa24724b97a516c589a05bc577d15db9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
G2C5gJ7QzI-I-qtQwA0qpLTn7y4N5IJHNcoPZIUCcDjmcT4vvjIz9A==
28.190877b8.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
13 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.190877b8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
vmuZ04dEZxcbHgU_aAKVyz80dcT0jOsF
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:21 GMT
server
nginx
etag
W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
N-LShPtnydNLP2RXB_wKj7RwoVMEhzDYY8yu73Ss4opyWrqolqwi5A==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
WyBP9FKCLVLo1PW891J9HpRIm7fixo3N
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:21 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
w7IEmrzjA936KZ2r3jwk-6tDMniz_G5b0w7h6wAdwqDeTLZqi-3mUQ==
9.7980313a.chunk.css
js.driftt.com/core/assets/css/ Frame D27F
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.7980313a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
mzm476FibAm1Qjw9LluE_kk_JVDGZMMz
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:19 GMT
server
nginx
etag
W/"97ab5d7bf24ef1c4f1e14801b9a510ed"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0TrTMNQMiOAzoLahdcu3zbn83K1s395-DOUaujwtRBafFo-SrNKXZw==
9.cc859315.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
78 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cc859315.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d8bda1b0af6b698fff3f612170c79a39e2fb3ed9c4d5acd8edb34c24b746d4d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 14 Nov 2022 20:02:04 GMT
x-amz-version-id
DbHa5NGznlWoo7NhUiJ3GTlZi3VjXZvj
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1180565
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 19:29:21 GMT
server
nginx
etag
W/"eae19071cebafe967627e045c973da82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y-wBvzj5xHrKU-nr-SsGTPFzsR-PEb-zC8kHY-C-ms-l7jxrkwaNUg==
15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame D27F
24 B
664 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
b_uRVfexj4sGnCJQ75xQaqi5vlpu5.N8
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
BOM52-C1
age
1406955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Wed, 09 Nov 2022 18:21:18 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FW-hU0wd3tya8jUDr_er20k2c0hPDd_umad04P8AOuQipE3VJAZbBQ==
15.9c69efb8.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
82 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.9c69efb8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
73e0e291c869fcab0c397de6a43ca086f33820ffc5405c4b1a7f95f40f25b5c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 17 Nov 2022 14:06:26 GMT
x-amz-version-id
qgmad2rgNUS4tU4bZd1R7AwtJqEMZnuS
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
942703
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 16 Nov 2022 21:57:13 GMT
server
nginx
etag
W/"47a1057175198df86943c8e03c67f387"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
u11o9X8YM_VkfyZSRp_M4VuwA49z90bHcx6eYYvmdxm8McoXP0n8cg==
24.c311b76f.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
49 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.c311b76f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c693b88392df16bddd61b639994f2244b8924383119ff366da38b211815a6614
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
m3vfbPRXwvqh5sXW_HgcLSjtz.EYCGKz
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501856
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Tue, 22 Nov 2022 15:49:58 GMT
server
istio-envoy
etag
W/"2267a7227af1d3df5470a1fc927f7f91"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-8_FIayX6CiwxIghbx3b5RmKEJlpT977EYxwSup-ZjCSRgAIO9Lmsw==
17.7c368973.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
39 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.7c368973.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2e99b0db1588a43579a468efa40eed92abfba98328fe75930bee8d1f18b79f1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
.ciJlv6CDNKqoDIAfGkQgLA7XWJsAxtb
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501856
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
14
last-modified
Tue, 22 Nov 2022 15:49:57 GMT
server
istio-envoy
etag
W/"8197d68864746fb8599945f4b32725d8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
F-NZCwdsFqYsow1Zsq8Ci7zgCn5hEyNdh85AUV3w1OxknZAZyIe3kw==
runtime~main.bad93b5f.js
js.driftt.com/core/assets/js/ Frame 7A2A
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c7d804b72efc14f38f31f36d27208604ce426c1fcc0d75bc5cd8da0dbcb33c25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
n_PRuVLxRQIA6djMS7198.h2vKp52lgj
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501856
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Tue, 22 Nov 2022 15:50:01 GMT
server
istio-envoy
etag
W/"17a37f5fbc0c33a281c525023061be48"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
yKLetsBIXCgI-HSTpS7N0hvefhqPAy3-eeTDdN9vCpKCC8rHpSOz9w==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sun, 13 Nov 2022 01:58:17 GMT
x-amz-version-id
acMzK5HdpE1P7Uh5SmbAEDvBqfV.mpmw
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1331992
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:23 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KSsc6C6gMIfjlZ7h33QRxC_w89uuc_aSoIW7nQqcDSd-QxneHAqZpQ==
main~493df0b3.d3ac7d8e.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.d3ac7d8e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
7ad9ef3a4bc35c8e26b515b58bfa16be478746a7716c91b69c5d53222986f959
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
p2Wfqc_BW7bJ3Kg8GylVOALOUvCgBDRT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008391
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:34 GMT
server
nginx
etag
W/"f953d4d3bced33e843c6d5f9a6da145f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-tD1bHvuzaN-qpQzWMJuCjN87_BZBLiNzIAGTRLK_xyIM1Yro4Pvbg==
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A07%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223044%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:09 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 15 Nov 2022 16:51:20 GMT
x-amz-version-id
.n2iX_EgWFHLX0LxbMMujzNwsOwKewi8
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1105609
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:31 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jNbUp_4iLD7acofRBMAPl3GNP0ZTPIkUgE_ha5rtXzC6C9BbB1LIcA==
26.2d4cdbd1.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
34 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.2d4cdbd1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
71e905aff9bad1d3b5a783336fcdd013cc97beb8985e4cd2cf7d195925a48211
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 03:53:08 GMT
x-amz-version-id
6yKWd8c1F8P.VhOFO6btcVgD6FG8YlPN
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2016301
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 04 Nov 2022 15:44:32 GMT
server
nginx
etag
W/"c55d27c90bd5affbf7c7047151ac3b6a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YPJeALV6Lb12OCWyDEgvXXg7cR__X6O4Rpx4JJTT99Y06Kn4lTuAEQ==
27.9bf46b67.chunk.css
js.driftt.com/core/assets/css/ Frame D27F
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/27.9bf46b67.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 07:25:20 GMT
x-amz-version-id
zUUy7ljjsqDjwemIF83LSBrLT78exEEm
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1053169
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:30 GMT
server
nginx
etag
W/"4f21faf2ba450e5fcdf7eda90813e185"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
qumRqmu2p6PkaJhDa2MI9OqRWr7IJNKyCFFLcyZZFZeZLClzSpjulQ==
27.7659dd6f.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
14 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.7659dd6f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
08d58eea55ad5fe4d16a05e54bf4d5a6c7039ded3276585ed2c8d0d6e4e3118a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:53:12 GMT
x-amz-version-id
CWkfCNKHUJeXJHEQsozij2aH6ZiHVN5D
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008296
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:33 GMT
server
nginx
etag
W/"d7b61d1b01a22d82018c40d322ce7053"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Hu1HxBH1drCkjKxAOVCkuukM9CfKKOk_NEzCIMiEXLV7Fh9oVzYLdg==
19.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame D27F
365 B
1006 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/19.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 01:12:53 GMT
x-amz-version-id
BpFoFtnY47gxmgehcZMde4G0zH29pyH6
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
BOM52-C1
age
2630716
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Fri, 28 Oct 2022 15:57:18 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Nuw-ja78t5vvQVCDfs69UTKtAIxWgIOh2vthRnybN0r0zPfvLTiYUw==
19.390436cb.chunk.js
js.driftt.com/core/assets/js/ Frame D27F
91 KB
26 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.390436cb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
14b1387a04f18b3807a637d7b856207b0a7188e9fff311474dd2b8ce486a28c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=03f1b54d-0f97-4cc5-959c-645331cd88dd&sessionStarted=1669636687.927&campaignRefreshToken=2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56&hideController=false&pageLoadStartTime=1669636684741&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 14 Nov 2022 20:02:04 GMT
x-amz-version-id
pi85TMGSx5c201S__pgE17eXzrOfbC7T
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1180565
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 19:29:19 GMT
server
nginx
etag
W/"e769e6a1f3a8bd1b184c977ffa6e3e9a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3Cz3qqeioiP_XOMttWxEM7xDCA9nubKdD9By06uzmcmXBHEO7KRLSA==
49.b6336d11.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
1cb2a3ed712d8fcfa64505237ae54ffe9f2f5d293f371f40871d830891568b88
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 08:55:00 GMT
x-amz-version-id
qjU4EJI6pAjSlG9D7ONy4jT0WBN.eVeC
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1998189
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 04 Nov 2022 15:44:33 GMT
server
nginx
etag
W/"8004ba5ba9fc99e5c559490658a3863f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
DU2fCnHF3LsY2lHMrqZ7L9SBHXeS9yUSgYxZL7M_wfqsMTZ3ZTW3wQ==
33.ae4de0a0.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.ae4de0a0.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
_VQGkTLf0OtKYb1tKqpjd1Z7bDY6G0FI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008391
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:33 GMT
server
nginx
etag
W/"db0cd5b66c52523e10b87a0c8a2db182"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
E0JN3W07eVs8blloKMMkfeT7Z0D4OiIHLdP8LCrWjkf9WYInGVABwA==
23.60057654.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.60057654.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
489eb2769765657c9325f65117f5c7b87ffc4eab547622608c12c8f6fd60df1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
BMr1uvJd8zlBRohUgZGzy1qf9gBNqCxl
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008390
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"0e963aeeee70e63f5078955e6db860f3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pX_Nq8VZ861brisq4rEtskb3t8TNTbkG6BqSVsPpW61orcgn4YwsAQ==
18.2ab31195.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
17 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.2ab31195.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
a0da3cdc4c400e5e5030c733b68bff8fddc8c4c82c2432330fa8cb858b16bd85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:40 GMT
x-amz-version-id
FUwCDfBpg.kXMhnNezwZo37Fa0N89x76
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008389
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"09e4a870348ecb960c5807c49bbf0c16"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Kk6hmSagmRJGofkXTNlIHR0Mjuj8ubjT5XTQzGvK1LVOcLfvnnZuqw==
40.5fa801cd.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.5fa801cd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
759a08226cc8d5a5a89c64b7f814457ee6191384f30e4dc9cd123aaf279003fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 22:59:08 GMT
x-amz-version-id
6XoIvKiBYScNWeFfgRYaim_qDycbjZf9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2120342
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 03 Nov 2022 18:22:53 GMT
server
nginx
etag
W/"e7d37d5ffc01767c10d8677c65ead60b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1Mf5ldRtciQxghSuNgyMaDZD-iDNRUDLwXXMalU__SIGk2vuMYCrDg==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
74 KB
75 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 13 Jul 2022 08:31:01 GMT
x-amz-version-id
v9WZS4Xw2HNUrP2n3tHAlzyzG14xdi4T
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
BOM52-C1
age
11935629
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
75961
last-modified
Mon, 11 Jul 2022 14:16:17 GMT
server
nginx
etag
"6d77a76055d81227033363af2f18caf8"
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
v6HioIK59Ai28TTdLDiOXrUYlvyi5rVFl855ZVhgwbtkhdtI3SNX2g==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 29 Oct 2022 01:12:53 GMT
x-amz-version-id
LzlaU0Vnd12Cs3jxCUINybAdyqEMAn7y
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2630717
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 28 Oct 2022 15:57:21 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ZIJkmBKyijdBa5Wv4_YEKZ-klF6zvaKE5jJnHwdFbdyc8LOD2q2vSA==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 03 Nov 2022 22:59:07 GMT
x-amz-version-id
5cwATwXgaPqoNOup_2mDyjDfJxxMocKs
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2120343
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 03 Nov 2022 18:22:51 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aDSEYdqiUZhwOejYmheYAEP0iRN3VCSNQEpPLp38Qfu-gh-K9TEvNw==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 02 Nov 2022 20:00:04 GMT
x-amz-version-id
PUOEVU3e62m9brOKYhNwQmXhyOdWWoBZ
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2217486
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 01 Nov 2022 17:39:37 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
g81xGatf0Uk_7qC4C7CrIi28xGnN1gX41PW49wjI-PJ2or5A5vT63Q==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
R787YdraJzJ1d6oSpmcp9pT0mwhOzzUG
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008391
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:32 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
8D6zLfqy-4COQfIVGm1VLzPTi-jhcA8ELV2yEy_Ppr705KP86UFN9g==
47.9d4808ed.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/47.9d4808ed.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
20997bd3984886e845f5a5e0d036f9808a5e30051f219705ef4e6ef1ef1b0f55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 09 Nov 2022 00:36:52 GMT
x-amz-version-id
4a44m.ts2j6I9ESCZqlGkzr9tHWW3id0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1682477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 07 Nov 2022 15:08:07 GMT
server
nginx
etag
W/"dfc66008c702c40fea0587f735010013"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
q8VSEoG5fSCyH3Mw9pQ72CXJO9X4DXxh0hJtiZjghsqp24WZOfEeUw==
38.5941b51c.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/38.5941b51c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
62eb2106959f57e67d6a5209dc51af437b7b61a4256fd93b1a822e4d606ef9ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:51:38 GMT
x-amz-version-id
yOObLyWPPKglSJBgJ.0gbeho8i3spFHh
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008392
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:33 GMT
server
nginx
etag
W/"aa24724b97a516c589a05bc577d15db9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hGSlKuEECYsIdUEmyrpXf_EF7fUzeVIPtpXKsNCcNQbxRjnn0xie4A==
28.190877b8.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
13 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.190877b8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
vmuZ04dEZxcbHgU_aAKVyz80dcT0jOsF
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406956
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:21 GMT
server
nginx
etag
W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
56KsYkznX17U0nMFLy78ecXqDt-wgGGoJb3UwsAEeJeSZv9jpjOfww==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
WyBP9FKCLVLo1PW891J9HpRIm7fixo3N
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406956
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:21 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zexCZ8Z7uELfzMnQzB8iVXq08SgngPiru0qjRRR3QV_Tdi0GDdMTeA==
9.7980313a.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.7980313a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
mzm476FibAm1Qjw9LluE_kk_JVDGZMMz
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406956
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:19 GMT
server
nginx
etag
W/"97ab5d7bf24ef1c4f1e14801b9a510ed"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3DDBcuSBSFeZ8u9ELb0P3QEKh80MtkJny38u1NRaFCEB4DxV5QKEJw==
9.cc859315.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
78 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cc859315.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d8bda1b0af6b698fff3f612170c79a39e2fb3ed9c4d5acd8edb34c24b746d4d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 14 Nov 2022 20:02:04 GMT
x-amz-version-id
DbHa5NGznlWoo7NhUiJ3GTlZi3VjXZvj
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1180566
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 19:29:21 GMT
server
nginx
etag
W/"eae19071cebafe967627e045c973da82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xXpL2efd9_uqSSH9fa9rbr47uG4rr2AQeWLkLoSMaKwFerdA-zWCGA==
15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
24 B
664 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:54 GMT
x-amz-version-id
b_uRVfexj4sGnCJQ75xQaqi5vlpu5.N8
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
BOM52-C1
age
1406956
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Wed, 09 Nov 2022 18:21:18 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Mi2Mfgbh7YYM7ddw5AIP3PAuUtXcETgQrG7sVhIFPetofTcgo8XcRQ==
15.9c69efb8.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
82 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.9c69efb8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
73e0e291c869fcab0c397de6a43ca086f33820ffc5405c4b1a7f95f40f25b5c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Thu, 17 Nov 2022 14:06:26 GMT
x-amz-version-id
qgmad2rgNUS4tU4bZd1R7AwtJqEMZnuS
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
942704
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 16 Nov 2022 21:57:13 GMT
server
nginx
etag
W/"47a1057175198df86943c8e03c67f387"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
nnkTLBIpAdnxckOwCL72Lae8ell3dh4EMwdetf3pfqALeAC1Ky97kQ==
24.c311b76f.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
49 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.c311b76f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c693b88392df16bddd61b639994f2244b8924383119ff366da38b211815a6614
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
m3vfbPRXwvqh5sXW_HgcLSjtz.EYCGKz
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501857
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
24
last-modified
Tue, 22 Nov 2022 15:49:58 GMT
server
istio-envoy
etag
W/"2267a7227af1d3df5470a1fc927f7f91"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
dSi36wtZQoryi-geJdCRaqHOzSa-ZQLaPBmxoOVmqjUBvrgWHf1yLw==
17.7c368973.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
39 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.7c368973.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2e99b0db1588a43579a468efa40eed92abfba98328fe75930bee8d1f18b79f1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 16:33:53 GMT
x-amz-version-id
.ciJlv6CDNKqoDIAfGkQgLA7XWJsAxtb
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
501857
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
14
last-modified
Tue, 22 Nov 2022 15:49:57 GMT
server
istio-envoy
etag
W/"8197d68864746fb8599945f4b32725d8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XchC4hNoX8k5-ly43mm_x657tybG6CP6-KxqjVccy6f-kIxJK_s17A==
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A08%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224046%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:10 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
35.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/35.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 31 Oct 2022 22:20:53 GMT
x-amz-version-id
yA9qSElif0U39lSKtVPr3BJx6cl9ZFUU
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
2381837
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 31 Oct 2022 16:19:34 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
NMma1hcO0bCeAIbWPgP4i2-UHsaf2nnXf-ljQlJLTOa_CjSPlKBEXQ==
35.438351b2.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.438351b2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d3c4b1d1abee7af1529758460c464a8721f281dfc899159dc36f521534d53fc6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:55 GMT
x-amz-version-id
UJVCjyERyWGac9uOggkZFw3yVKS8eHjo
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406954
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:21 GMT
server
nginx
etag
W/"6d42b26d199471df6876d34dd3714424"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rgcSVXA4gVxD8CMDLPn-3rExQFplUk6Yp3lrooGyXOoYXu4_pwB1Hg==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Tue, 15 Nov 2022 16:51:20 GMT
x-amz-version-id
.n2iX_EgWFHLX0LxbMMujzNwsOwKewi8
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1105610
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:31 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2pK4h5N3-gqZxhCfdjn3BDmLI6u0ngWmg2laC18ybEmJ-W6rpN0YeA==
3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:56 GMT
x-amz-version-id
6eDD8hJAoclD6yRsTxOCYDa1IzjcvXMP
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406954
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:19 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jOn4g5ok08sMWEW6urA2S79mpS2mK1yamGn63mi1x0Omz3HZ94FDFA==
3.f50b964b.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
54 KB
15 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 05 Nov 2022 22:40:42 GMT
x-amz-version-id
RXpQv1cCTlcHkQzuMABgqU1Q6KjkPwW6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1948648
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 04 Nov 2022 15:44:33 GMT
server
nginx
etag
W/"1ac37bf2b93050f29058b66a9ad43e10"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hfkbunG4rxMxTI7MUBc3mXiTlhAopcPU8aWjQgaZKa7BoF7bF1aofg==
1.fbdab3a3.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
43 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.fbdab3a3.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
b22a1ebdf9aecea6f73860db0e9d184d96d28d85196efd42cfae5d8d0f103571
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Wed, 16 Nov 2022 19:53:13 GMT
x-amz-version-id
iVsnuH_KAsO76vRKhRAA96taCjeLUFd0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1008297
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 23:58:30 GMT
server
nginx
etag
W/"6eae9d8917505f7858dc56cf0731728a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bkqbG4KWjNB93_M48Tc3z1gMpUgu7VLQGnJSjZTw4gsYM1DksBQoXQ==
1.850e66da.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
73 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.850e66da.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
721c262f4a94e7285dc57669e73dfcc1da0b33608e9d4815f4a061ae3dd98754
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 05:08:56 GMT
x-amz-version-id
aELTu1HN9KyOpfcoYXIU00YiayceWnNt
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1406954
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:20 GMT
server
nginx
etag
W/"3598824ae2c8be769415b4f4aeaa0a4a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WKV2CvULr1fSzWM-HbwgA0zMsvy3zJq0VBxXTwvz1xtZaz8SP1mZXg==
32.a3318c5e.chunk.css
js.driftt.com/core/assets/css/ Frame 7A2A
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/32.a3318c5e.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Sun, 13 Nov 2022 00:36:36 GMT
x-amz-version-id
OjBtUtaiWefkb9_ava0Q77VTyOwFymTS
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1336894
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 09 Nov 2022 18:21:19 GMT
server
nginx
etag
W/"b06e02b360914b25e58305b1b9b954dc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
86sBPoKByC_dj6CM6XLKBCBx5S6TSwDDeJ_yH7EtWtVb4svs_QwKxA==
32.02c90ef9.chunk.js
js.driftt.com/core/assets/js/ Frame 7A2A
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.02c90ef9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.bad93b5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.182.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-182-0-31.bom52.r.cloudfront.net
Software
nginx /
Resource Hash
968aa77906b12777060a2d8c5794c27a2642ae106bda2363c9a868749d83bc6f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1669636684741
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 14 Nov 2022 20:02:04 GMT
x-amz-version-id
vskaoU6oW1dARdkYPWcbY4P9fXvvzxt_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fff88c69e824ee122b5a11efb3a8c1da.cloudfront.net (CloudFront)
x-amz-cf-pop
BOM52-C1
age
1180566
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 14 Nov 2022 19:29:19 GMT
server
nginx
etag
W/"6e002280f8027b708a93eadf26041ce7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Sd5RLaafH8FUkUl0Oh6Eq-_-8dBwmc_d7uec_C-Dab7FMecYjB2dSA==
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame D27F
146 B
243 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 -, , ASN (),
Reverse DNS
Software
istio-envoy /
Resource Hash
ce7dc91291f13d36243e5d6238b7a71e5f5adc6adc1e8394991b3eefd140da0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 28 Nov 2022 11:58:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
27fb704a2422880
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
9
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
146
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 -, , ASN (),
Reverse DNS
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Mon, 28 Nov 2022 11:58:11 GMT
requestid
driftfddd08548fdaeee600cc4039049
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=fced4ef9-3360-47f2-8cda-438aff90d7d7&session=ff566eb7-0b5e-4a66-8e25-e676cdc45747&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2028%20Nov%202022%2011%3A58%3A09%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225048%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3A%22apt%20%26%20targeted%20attacks%2Cendpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%22%2C%22title%22%3A%22Earth%20Preta%20Spear-Phishing%20Governments%20Worldwide%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&pageViewId=8da569c6-2a87-4d7c-8050-c291ca2c156d&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-7-242.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 11:58:11 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/images/navigation/nav-cyber-risk-index.jpg
Domain
5427711.fls.doubleclick.net
URL
https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=3555319920798;gtm=2wgb90;auiddc=2020846386.1669636686;u1=%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html?
Domain
analytics.twitter.com
URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=cb2e11c8-88f6-447f-8607-d02868e5aba7&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=8687c56c-c161-4229-9de4-1928ed60c503&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuwoi&type=javascript&version=2.3.29
Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

309 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| OneTrustStub function| OptanonWrapper function| $ function| jQuery object| matched object| browser object| Granite object| maxy_pathnames number| settings_timer number| _vwo_settings_timer object| _vwo_code object| BEJSSDKObserver function| jsElementReady object| BEJSSDK object| BEIXF object| BOOMR_mq string| BOOMR_API_key object| BOOMR object| utag_data function| Cludo object| CludoSearch string| cludo_language function| Sly function| webpackJsonpjwplayer function| jwplayer function| id function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| articleFolioObject object| disruptorPanel object| folioMessage number| globalBodyScroll function| toggleFilterListNav function| hideSearchBar function| setFocus object| searchButton object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight object| overview function| jumpScroll object| promotionalContent object| savedArticles object| readingTimeCall object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| researchUtilityMenu object| bsModal string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href number| len undefined| linkName object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange object| CludoSearchInstances object| $navSticky undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| _qevents function| fbq function| _fbq string| _bizo_data_partner_id object| addthis_config string| GoogleAnalyticsObject function| ga function| ktag function| twq object| techtargetic string| gtagRename function| gtag function| drift undefined| driftt object| _6si object| Optanon object| OneTrust object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportGELProtoQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ function| initializeFPJSLibrary function| detectIE object| _bright3 function| beLinkBlockCallback boolean| ie_version undefined| style undefined| select object| scriptTag string| org_id object| betrack object| showLogs string| domain object| domainPath object| timeout string| sessionTmeout boolean| bf_e_org object| bf_e_org_list number| bf_i object| bf object| goal object| goalvalue number| maximum_custom_variables number| maximum_custom_metrics object| customdimension_value object| custommetric_value number| maximum_conversions object| conversion_count_value object| conversion_value_value boolean| disableTrack object| deferCallback object| useCustomLinkBlockStyles object| showLinkBlock object| JSON3 function| isSameSiteNoneCompatible function| shouldSendSameSiteNone number| c_begin function| Fingerprint2 function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| _gat object| gaGlobal function| lintrk boolean| _already_called_lintrk function| quantserve function| __qc object| ezt object| _qoptions object| google_tag_manager function| GooglemKTybQhCsO function| google_trackConversion object| google_tag_data object| GooglebQhCsO string| cookie_str number| s_expire string| cookie_set_string number| c_end function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| deferUntil function| DateFormat function| speificTag function| descriptionSentenceLimter function| homepageWidget1 function| homepageWidget2 function| stickyScrolling function| detailPageWidget function| flyinBar string| templateHomepage boolean| idioSet object| _ipc object| _iaq object| regeneratorRuntime object| twttr object| gaplugins object| gaData number| c_start boolean| __@@##MUH object| MunchkinTracker function| ttd_dom_ready function| TTDUniversalPixelApi function| UET function| UET_init function| UET_push object| ueto_7f19efa256 object| uetq object| idio boolean| _storagePopulated object| Ktag_Constants object| Ktag_Toggles object| Ktag_Amp_Helpers object| Ktag_Helpers object| Ktag_Functions function| setup function| _toConsumableArray function| _0x106c function| _nonIterableSpread function| _iterableToArray function| _arrayWithoutHoles function| _typeof function| _0xb6d8 function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray object| AJS object| AccessiBe object| acsb object| acsbJS object| EJSEventListeners object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked function| EJSCustomEvent object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id number| BOOMR_onload object| whichUl object| addthis_share object| oattr object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks

54 Cookies

Domain/Path Name / Value
.trendmicro.com/ Name: AKA_A2
Value: A
.youtube.com/ Name: YSC
Value: hHk-m0LYOvk
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: p9RWW_7ddxU
.trendmicro.com/ Name: utag_main
Value: v_id:0184be19fda400714afbcc44683c03074006406c00b08$_sn:1$_se:1$_ss:1$_st:1669638485221$ses_id:1669636685221%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/ Name: _c1Ref
Value: /en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
.trendmicro.com/ Name: _vwo_uuid_v2
Value: DF68B6219968C96B89E70203CFDB2A1F5|a9f8b896ec1f71f33ca9d52440c3577b
.trendmicro.com/ Name: __utma
Value: 44797537.147826248.1669636686.1669636686.1669636686.1
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: __utmz
Value: 44797537.1669636686.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1669636686
.techtarget.com/ Name: __cf_bm
Value: 6dB_PmkS1gXPMgZrsV8bE7_.nGRqTqQaxElROcfy3xw-1669636685-0-ARgTCUGeXr6yeMnqQOP3iYEVyUTvbvNZc3V7uD9pA5XVfyj6pJmLoyOlJFqXQXYLEJUf7oaYV99I/YS0v31HLsQ=
.trendmicro.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Mon+Nov+28+2022+11%3A58%3A05+GMT%2B0000+(GMT)&version=6.34.0&hosts=&consentId=0deef327-404e-4059-853b-60cb7dead2d6&interactionCount=0&landingPath=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F22%2Fk%2Fearth-preta-spear-phishing-governments-worldwide.html&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A0%2CC0004%3A0
.trendmicro.com/ Name: BE_CLA3
Value: p_id%3D8R2N244P4J44RR6R8RLJR8LRAAAAAAAAAH%26bf%3Da83b221a0f685a62ec2a8e8cefb35509%26bn%3D2%26bv%3D3.44%26s_expire%3D1669723085817%26s_id%3DPR2N244P4J44R6L2JJ6JR8LRAAAAAAAAAH
.resources.trendmicro.com/ Name: __cf_bm
Value: PXRHWMf4gYLEGfuWHO3Zq134RG.tzvi3VsSIqKy1F7A-1669636685-0-ASakQmVI9LAKN9SGIlLVyhhHXNBrmIKhPcag7PwWHAz6oYaCk7GXWed/2yoRF8+hVoPXel6OsIuhtZmxV3zS2e0=
.trendmicro.com/ Name: _gcl_au
Value: 1.1.2020846386.1669636686
.trendmicro.com/ Name: _gid
Value: GA1.2.1172575233.1669636686
.trendmicro.com/ Name: _ga_4502MK3B94
Value: GS1.1.1669636685.1.0.1669636685.0.0.0
.trendmicro.com/ Name: _ga
Value: GA1.1.147826248.1669636686
.www.trendmicro.com/ Name: ln_or
Value: d
.trendmicro.com/ Name: _mkto_trk
Value: id:945-CXD-062&token:_mch-trendmicro.com-1669636686005-20353
.bing.com/ Name: MUID
Value: 2AFD672AF1CC6013066B7540F06061C7
.trendmicro.com/ Name: _uetsid
Value: eb419e606f1311edb9eda113163c6b0a
.trendmicro.com/ Name: _uetvid
Value: eb41db406f1311ed8d5bfde04b7e783a
.trendmicro.com/ Name: is
Value: 9bb59192-ea59-414f-b05a-d82befcba472
.trendmicro.com/ Name: iv
Value: 36c2968e-27ca-46e7-83c6-4340a854ccd2
.linkedin.com/ Name: UserMatchHistory
Value: AQKjXVrZO0BrzAAAAYS-GgCePj3bwF8pXG4CVTUwqbym-lkPIaDk8epTYV5HipCWTMbPgrQ8AB668Q
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIgY1_htRkTuwAAAYS-GgCerjaaS5uTx0VQAyc8CmAwAkohH0DhhSt9MaVmmHCL7jxIuN192DFN4jBZ9JkbeQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&58061edb-0dea-4920-8867-cb640d7bbab1"
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2378:u=1:x=1:i=1669636685:t=1669723085:v=2:sig=AQHQUfu3EpAwGvRNCKb-ulooygIfpiCg"
www.trendmicro.com/ Name: _gd_visitor
Value: fced4ef9-3360-47f2-8cda-438aff90d7d7
www.trendmicro.com/ Name: _gd_session
Value: ff566eb7-0b5e-4a66-8e25-e676cdc45747
www.trendmicro.com/ Name: _an_uid
Value: 0
.quantserve.com/ Name: mc
Value: 6384a24e-1ecda-fc441-dee83
.trendmicro.com/ Name: __qca
Value: P0-1907756525-1669636685779
.trendmicro.com/ Name: _fbp
Value: fb.1.1669636686179.2043431441
.t.co/ Name: muc_ads
Value: fe352908-2a3b-4568-adbc-a1bd8048cbec
.doubleclick.net/ Name: IDE
Value: AHWqTUmaq6wYzpBLyWhhBSA9PRi2eKaJq3JLU3VZv09qqWqikcYqXFTF8f07QxIW2t8
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&2022112811580691126347-9af8-4989-8f09-e3ffaa0bad8eAQGyZkb8R4BoI3L4mMeQQNtb2TPsoAyU"
.linkedin.com/ Name: li_gc
Value: MTswOzE2Njk2MzY2ODY7MjswMjG0kIXawYIWE4H4E1KBeGVoyvclGJIxOovuiAJ/dT6nWQ==
.twitter.com/ Name: guest_id_marketing
Value: v1%3A166963668628886803
.twitter.com/ Name: guest_id_ads
Value: v1%3A166963668628886803
.twitter.com/ Name: personalization_id
Value: "v1_2cnoe8va91cJEdFCyO/CLw=="
.twitter.com/ Name: guest_id
Value: v1%3A166963668628886803
.6sc.co/ Name: 6suuid
Value: 94f010023f5700004ea28463be01000078951100
.adnxs.com/ Name: uuid2
Value: 4248843737583356065
www.trendmicro.com/ Name: drift_campaign_refresh
Value: 2956d6b2-bccd-4e9f-b9ac-2a9ed8e61e56
www.trendmicro.com/ Name: __atuvc
Value: 1%7C48
www.trendmicro.com/ Name: __atuvs
Value: 6384a24dea94d5d4000
.www.trendmicro.com/ Name: RT
Value: "z=1&dm=www.trendmicro.com&si=e3b79f5d-c505-48ce-a629-438b69c27592&ss=lb0qkmw5&sl=1&tt=2no&bcn=%2F%2F684dd326.akstat.io%2F&ld=2nq"
.addthis.com/ Name: uvc
Value: 1%7C48
.addthis.com/ Name: loc
Value: MDAwMDBFVURFU04yMzExMTkyNzAwODAwMDBDSA==

2 Console Messages

Source Level URL
Text
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
684dd326.akstat.io
945-cxd-062.mktoresp.com
9572106.fls.doubleclick.net
a.idio.co
a1.b0e8.com
acsbap.com
acsbapp.com
adservice.google.com
analytics.twitter.com
api-public.addthis.com
api.idio.co
apt.techtarget.com
attr.ml-api.io
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.go-mpulse.net
cdn.acsbapp.com
cdn.b0e8.com
cdn.bc0a.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
connect.facebook.net
cookies-data.onetrust.io
customer.cludo.com
dev.visualwebsiteoptimizer.com
epsilon.6sense.com
fiaqjiathaajekqce3yajaaab5ryjisq-ptewnm-c388ad267-clienttons-s.akamaihd.net
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
insight.adsrvr.org
ipv6.6sc.co
ixfd2-api.bc0a.com
j.6sc.co
js.adsrvr.org
js.driftt.com
js.idio.co
kd7qo2s7munruy4eujia-ptewnm-89ce44106-clientnsv4-s.akamaihd.net
m.addthis.com
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
munchkin.marketo.net
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
resources.trendmicro.com
resources.xg4ken.com
rules.quantcount.com
s.go-mpulse.net
s.idio.co
s.ml-attr.com
s7.addthis.com
secure.adnxs.com
secure.quantserve.com
sjs.bizographics.com
ssl.google-analytics.com
static.ads-twitter.com
t.co
tags.tiqcdn.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
trk.techtarget.com
v1.addthisedge.com
web1.acsbapp.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
z.moatads.com
5427711.fls.doubleclick.net
analytics.twitter.com
s7.addthis.com
www.trendmicro.com
104.17.71.206
104.238.215.8
104.244.42.3
104.244.42.69
104.75.88.194
108.138.15.119
13.107.42.14
138.128.247.123
142.250.184.194
142.250.185.70
18.66.112.37
184.24.170.43
184.24.7.242
185.89.211.12
192.28.144.124
199.232.136.157
2001:4860:4802:32::36
206.19.49.24
23.203.87.70
2600:9000:21f3:bc00:0:f267:a5c0:93a1
2600:9000:223c:c800:6:44e3:f8c0:93a1
2600:9000:2251:1000:2:53b2:240:93a1
2600:9000:2251:b800:12:3734:2a40:93a1
2606:4700:10::ac43:1b98
2606:4700::6810:9540
2606:4700::6812:1a55
2606:4700::6812:1ec
2606:4700::6812:c9f
2620:116:800d:21:5ed4:8d5d:fed7:f5ef
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:802::200a
2a00:1450:4001:80e::2008
2a00:1450:4001:80f::2008
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:827::2004
2a00:1450:4001:828::2003
2a00:1450:4001:828::200e
2a00:1450:4001:831::200e
2a02:26f0:1700:1b1::1c91
2a02:26f0:3500:586::11a6
2a02:26f0:3500:981::11a6
2a02:26f0:480:f::213:7ec6
2a02:26f0:480:f::213:7ee3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a06:98c1:3120::3
3.221.131.160
34.111.194.12
34.111.78.58
34.237.225.32
34.96.102.137
35.190.5.192
35.201.125.192
35.201.70.94
52.223.40.198
52.59.125.199
52.71.88.40
54.147.21.139
54.182.0.31
68.67.153.60
88.221.169.143
95.101.200.123
95.101.27.26
95.101.27.37
99.86.4.95
01344ea4f9f715dd46193c937c07e014657bd95feaf87b63fd64428413e74b82
03f7fce5e0936a5f59921e0482c73abb8a474d4a53749e0f141727bebbb1719a
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
085eaa8d4344efd512d4bad9154a62e79e9624f65b4300d0439b17cbadb809eb
08d58eea55ad5fe4d16a05e54bf4d5a6c7039ded3276585ed2c8d0d6e4e3118a
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0a4a68011410d87295e6c0beca23809f99ad75b1151922daa40a7e1a28d7521a
0c44bd059b9c622135be58769922c683d91de4f38676110fd00850bcc2935f44
0e1a25f94e38ff616b88e4917d4ed2ee83bfdddd4358f92a82e7d87a09ff9b2d
0f8c26695e4fe2f4397e1a08c7b39633b2811b38d9023d42d3be32a27d23caa2
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
14b1387a04f18b3807a637d7b856207b0a7188e9fff311474dd2b8ce486a28c0
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
1cb2a3ed712d8fcfa64505237ae54ffe9f2f5d293f371f40871d830891568b88
1e304e6c44573d42086563697648a39608f59e054ae64e554f2ca652c7800272
20997bd3984886e845f5a5e0d036f9808a5e30051f219705ef4e6ef1ef1b0f55
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
23816f3bbf0affff2c32eb91da22f840f51ba0efa615f040f10cb9ff3f831005
25852158b361f087b7980922d334f690245a451ef8d5e675e6bb016d5408ce71
25cb8008bc221f935a600a6ad4f05f7763bf1e0815cf449faaaa7a5dbfc98ba9
275094aa5d73cd24d848e78f0c41c33d9fd61a09d97b9976e5e707dfd24ada00
2b83e226cec74cec799506638ae8a6d4931ec355f02f08f8cd21f35be2f0bda5
2d96c60752d726559a15b164df4b2067399904d732330bdf6f49215614b3dcda
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e99b0db1588a43579a468efa40eed92abfba98328fe75930bee8d1f18b79f1d
2f7b4e90d6454c1684c68ebeeeaa7d0de65dac8c2b4dfe3afb7176ccca7d1b58
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
336ed2f40837f4d988e5f5e348ab7861b11ab0c760254e3eacd37aff33b66a81
3992ccb3af03535e9a36522b5bdab5c153ee264de529da6bb1eea9fcfa654abc
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3cff6771ba22d252432953dc6920c1965a54f1dac80726b559909e418ec638e2
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3df1caa518a23d4a674e208e52851a6c423b319e9d0509ef5119272bb409619d
3ee9ec06bbfa8bb6e040e6edc9718c1905b557f3e9e988398b70d378096d02f8
4083e7cc2bd654cb434173b1f2d2e4a4d3ed921463cab9f9db53d6cd81d89b0d
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
455995299358961f1a9ade799587a2e03c86f1c2177f885742a03706b7e0c94a
47879e9a46a232ac6fa8931b17f3dbe8a09ea02497c2394abf2e45c431b9b5ac
489eb2769765657c9325f65117f5c7b87ffc4eab547622608c12c8f6fd60df1b
492f3de5b6bff06f8b26f61d37e2e565f8f31e00315600c73d9caa85713e8c29
4cd4692515d498d3a3a0092684ce30d83f6c5e175ff861d3ae8fe709740e82d9
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96
4deb19daa5e042aee3e7a6542f11feacc85a91d032426a271dac209a49d8cefc
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
4f0174da434c9da57c0541730ddbc365915ba5e0290128ed9c1854fdd7eb4344
4f0fa35c5a44677cc0a678f03795032aa862275dc29e978a84a2ee41ef267c10
4fc81379a071d67a2f0d4a3c6493fd35ad12a0da82c9af71b7ddebfdfa594c41
54fff93dac87a9b339c840c61576567a5d66f3fa293622b960b40b3568fdac0d
55a23478291e8e3095cc198af9ea9c2fe74284e2e10dcd73a985461cec632577
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
584d056c2e83aa9f513b29dc60d838c5648a961aeeae98f92d91a01cc004beda
5a6aa9f7b3632094df7ea361aba29c2e7d3f7455dc4b3d81de22408e6a30b34d
5afc897907a6a41ff6df1599d36ff15428aabcd18ec2c127e3d6433bd8a0c046
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e90294a34f40c10c13b80c266bc93f6e569009c37b09762bab41104f1ecd457
5f456fa011345f7182fcc8290931a1a4961f9b53efee21c4ab7a6ff26114246b
5f833e21ff72666bbf269357d08626374325d27d25db5e25ae9cec8ef7e4df57
608c3824218b6ac368b4324a2bbcde21a9270a794628ce4c1685705ef717c4ae
60f863144aaafb045985a2cfb559ec18c30f9eff6a4db0b37506c8e41eccaed0
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
6269bafb85bd4d4fed6589655f7e0b8b612397226168098f95d3507848075f6d
62e37140e90c20b8021e84f22588bff6f0789e2ac60bd107b21017d0acd41b51
62eb2106959f57e67d6a5209dc51af437b7b61a4256fd93b1a822e4d606ef9ce
641153b2ad78e5d095645419060a4ea0854b1b3ec5ff27e99644c9f8d461610c
6628992f1bc9650c2a0656562effc25b67770a255e3fe203414c7b0b5e992bef
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
6cf98f8e68625661d1727e1c02fb5bfb8583f865f8834518b4723873dfbe9722
7028ce246826b7ed6bb35f54c2cd43b0c851b84278f8b8b64b03b95190e24356
7063532428b5ced41620585d617d90fa5e6b54324a6762510503e03aa57d3574
71e905aff9bad1d3b5a783336fcdd013cc97beb8985e4cd2cf7d195925a48211
721c262f4a94e7285dc57669e73dfcc1da0b33608e9d4815f4a061ae3dd98754
728a18b8f9f56a05d19f6300df7f4f293b8475ec836d05dbd90e7076b24c39b8
72bafc393377ddc1bb9e6e7d5aefc22f2960d72819f7d1eba5c55d5a747329d9
73e0e291c869fcab0c397de6a43ca086f33820ffc5405c4b1a7f95f40f25b5c1
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
759a08226cc8d5a5a89c64b7f814457ee6191384f30e4dc9cd123aaf279003fd
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7ad9ef3a4bc35c8e26b515b58bfa16be478746a7716c91b69c5d53222986f959
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7eee4aa440a39e196f4963c5eab17795cb221fbc2c64230315f7db0edcd33910
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8a2ddfc3ec0269c7c979608073574c3eadec9932afc4a660dc0af4a1e6ce2e3b
8ae30f6f2162279a812bf9e00efd0c985e20e76efece9444125b410f3a6822a6
8f37c9815fbb866d0417ebe23f74ccbf507ea03f969260f576cfd4bbd9da2a28
8f717815d9a168a0ad2cb680e73cd52b451a8e03a33dbb843598d981e16dd393
8fa2affad47d95e0e6345419f542afcd62e9359d5db5e5b943fb2218b8955b8f
9063949de0f63d0b210d8edb7835819b123383066bf962db016c1a78e52c6472
90775ce1333473bfef558cf5185a101a76f95926d3df98d2ea23b1cf583a2076
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
952355082de2fb5bb5a70f29b5f2291dd73341a35ef1d55af0d4adeba3655be2
960d1f95f71be9bc4c13e06c200762c60cdc944d3289687f9d9faa6cf7b17506
968aa77906b12777060a2d8c5794c27a2642ae106bda2363c9a868749d83bc6f
96fc226b557ea883b6f98c6cfdadf1edc0ff40336cb3434bd59d5e4262b5ee07
9719cef05e4ed37ab3fef49dc297464322062d32382d8275ba599d12f40bb840
979f4f46b0dd74ac9c73f06b349ad5a153b5b35c8ea8c9b696042a8779aad36b
9a9b32b9a635111a54aa24bd29d8e0b65b406777e1e69f310584b02357857738
9eafa4081de1be9cd15a3d534b112e83d3b30ddb6023676edacf23c729626900
9fe1d4e96151b5555ca0cdc337fe0a79da685073012bf44c085d10652f6a3d1c
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0da3cdc4c400e5e5030c733b68bff8fddc8c4c82c2432330fa8cb858b16bd85
a1019d01046c662a58fa0b369f4f6f67428e15d6501de94b1d4b3a3b8925d54f
a112f5ad8a0efbb4605e340343335f673baa91f0d818d75b2fcf8f6f03898d29
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a6dd608e607588b2cf3c87b17f36bcee05da7bbbc2b69bf352dec8c474185a12
a6e03b0e32ba6f8e660e18d971582f7b518bf576ab157a935bb315b5441902e4
a8f3b9ec4cac22ff31bd07585db6642dc6968d247908e089a0a690f7ea66824a
a9b43aa5cfd8cf2ca5a112086673538658a3f850d2553adf67cbee4fbd3cc782
ab83d390c5a330c4e24f70cadbd0562b2731c597f489f33b542cdad7324073f7
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aca17711b2bcab8335b7bd9c2880033b2aa69a0e9f33ce2e1a507dbb0f9cade3
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
adeaebb429d938d9796d62c756b3846dee391cd6735875b9740366b2e12a5cc4
b22a1ebdf9aecea6f73860db0e9d184d96d28d85196efd42cfae5d8d0f103571
b2f668f1b31e119ced53c8c2414d0b609b2f052bbf8470af8e19e56844800eb5
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b70269a88a926a47d1d82d504e73b281bfc28223658595e834a82075bcd48a06
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b8a34dec51d1542d219b92e8425cae1fcd3f55c26f8d9cb67d2a9e7c2e79543d
b8c7ad718ad8601879cbc0cb576146442725099bdb53d9007664944952ae186d
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
bd701a68dddee2555a381f41190b0b2137d435b7e8a79af86d520425633c7f46
c024bfd3bdc21afe60cf23a40414b16f1c5b05c54f9215f846bf434be501fe05
c2096a3a215956d59d342536e18ccf7ea1a068ef15ed7def02553fb5ffbbe0b0
c39b94db3a7747f5219df61354de85d653b6fbdbe11c2d3277f05825c810f2d7
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c67a98460c2dbd3d301997c6b0cda7919f33d554f8b084f14f3759012299e148
c693b88392df16bddd61b639994f2244b8924383119ff366da38b211815a6614
c7a2cccb0b1fc37d2a9e142f920f5c9e640d12a262eb181abab41e81cd12be61
c7d804b72efc14f38f31f36d27208604ce426c1fcc0d75bc5cd8da0dbcb33c25
c8b013334338314810637de10207057caa92a44fc9873b2671ab58eeffac1cae
c8c8b8e936333bef64ff9515294435d940ddb43ddc9ec1306796a47a9e26d628
c9a3b18c0119b53d9c674b87100cc411f4d3df584937b8e6ea774f61be820abc
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cc4d3c6e2e38f860df9cb1126fa0c5867bb149b574de56662928e02558c70328
ce7dc91291f13d36243e5d6238b7a71e5f5adc6adc1e8394991b3eefd140da0d
ced9af3ad54bedceec4434d4225eb3fcdcdd51ffb441abf157fc07eb2e00b312
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
cff36a8c3e27d13c9df7ce018399b3b59c5bb70de2b59bb38ba6daaf6aef5ac0
d08ea2ef86069614fbd61038fa25056afa37aded9dba32e520f9adc1855b88b0
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d172f2ebf38a578b105a8f3679bd3d73ec09e4388da4413526314df191623397
d1aabe1212b2f9cb8f6a547454bd4e5f4773485e3e001b327e501ba3e0e77cc7
d1e82e9a4125dc85707996f27b9c6c7cd5b9434951ecd55094f723362fb0c067
d3c4b1d1abee7af1529758460c464a8721f281dfc899159dc36f521534d53fc6
d4936094e7358ae2747b6a5d2c6a0c6fc5e9449e77e9c575e0788d6894624bc3
d5c905d7ce4679b183eb11f7c6811682ddffbf0f037590360ae2b1a84a51ef1b
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
d862d22e990db6cb0a8b8ebaeb72672fb81a00976795b1e9c5299683ca1930f8
d8bda1b0af6b698fff3f612170c79a39e2fb3ed9c4d5acd8edb34c24b746d4d5
d90e0559dfab1d9ad441137a378eb4ab5a53e4b5103d0293dc558197bfb93bd2
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd21acbddbfa634e9870ed1b19093b0eb7bbe8636d4de590e2aadb23ead5cb3e
e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab
e348f721442e051780e0a89843aaad43dbe518d051cad5ce5b6816397a8fc773
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e413ce2260c8c306af69d83e5696a29d82a010e043a24894aee8611e181d01c3
e658c733c8ab21f617f9c28424180c31127843e0ca1597a243c9fc3b4c8a38a4
e687349ef50927f263497a200ed021ebaa6d13850a8b9a0a19de3d2260729d69
e7bd8851b07a73755dbbd07fe9def642394581ebab2171e38173dacbfc062aa0
e88dafe889a514ea8b9b07747f53d08b66a473b7caa78645b4aa2167563651e7
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e9d2b7b3b232077819c309fe934d0729553bcbf8efedc73f8893680f85eae0ce
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
edaa061b005c12f64391c7ad52524a677c55b645deeb1e4752b8250f2c46086d
eded00575f65de726a63f811022d119ed582721233e74343735cad53930c2a76
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9
f2587e91435153eca3e6e565d27c0a6f7bb7d328e91b9ca73d9529c1088ab8f0
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f795b85773aeeb4d69eb8d36e82f9106344b4a5edf011f9cb22eb4d4e146f3e1
fc7511106f98dfbf8e4c01929ed4e9c7aa92d28af790d0475d1850858e3315c6
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a