blog.trendmicro.com Open in urlscan Pro
104.109.56.169 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Submission: On May 22 via api (May 22nd 2019, 11:44:09 am UTC) from US

Summary HTTP 149 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 41 IPs in 6 countries across 32 domains to perform 149 HTTP transactions. The main IP is 104.109.56.169, located in Netherlands and belongs to AKAMAI-ASN1, US. The main domain is blog.trendmicro.com.
TLS certificate: Issued by AffirmTrust Extended Validation CA - EV1 on September 11th 2018. Valid for: 2 years.

This is the only time blog.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
58	104.109.56.169 104.109.56.169	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	151.139.128.10 151.139.128.10	20446 () ()
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 () ()
8	150.70.178.131 150.70.178.131	16880 (AS2-TREND...) (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED)
2	184.31.90.101 184.31.90.101	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	107.23.133.35 107.23.133.35	14618 () ()
2	2a00:1450:400... 2a00:1450:4001:81e::2008	15169 () ()
2	159.122.87.153 159.122.87.153	36351 () ()
9	68.232.35.180 68.232.35.180	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 () ()
1	2a04:4e42:200... 2a04:4e42:200::729	54113 () ()
4	159.122.87.148 159.122.87.148	36351 () ()
1 3	199.255.34.6 199.255.34.6	36351 () ()
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 () ()
2	151.101.36.134 151.101.36.134	54113 () ()
1	129.33.139.56 129.33.139.56	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
1	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 () ()
2	172.217.16.130 172.217.16.130	15169 () ()
2	23.43.119.71 23.43.119.71	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a00:1450:400... 2a00:1450:4001:817::200e	15169 () ()
1	2a02:26f0:6c0... 2a02:26f0:6c00:18c::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	199.15.212.64 199.15.212.64	53580 (MARKETO) (MARKETO - MARKETO)
1	151.101.36.157 151.101.36.157	54113 () ()
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 () ()
1 2	172.217.18.102 172.217.18.102	15169 () ()
6	2606:4700::68... 2606:4700::6813:c797	13335 () ()
2	2a00:1450:400... 2a00:1450:4001:814::200a	15169 () ()
5	2606:4700::68... 2606:4700::6810:4ea6	13335 () ()
2	151.101.0.134 151.101.0.134	54113 () ()
1	192.28.144.124 192.28.144.124	53580 () ()
1	18.204.161.88 18.204.161.88	14618 () ()
3	2606:4700::68... 2606:4700::6810:a10d	13335 () ()
1	107.20.147.136 107.20.147.136	14618 () ()
1 1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 () ()
1 1	2a00:1450:400... 2a00:1450:4001:820::2004	15169 () ()
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 () ()
1	2a03:2880:f00... 2a03:2880:f006:15:face:b00c:0:2	32934 () ()
1	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 () ()
2	54.154.175.204 54.154.175.204	16509 () ()
1	104.244.42.197 104.244.42.197	13414 () ()
2 3	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 () ()
1 1	2a05:f500:10:... 2a05:f500:10:101::b93f:9101	14413 () ()
1	104.244.42.195 104.244.42.195	13414 () ()
149	41

58 104.109.56.169 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-56-169.deploy.static.akamaitechnologies.com

blog.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.139.128.10 (Dallas, United States)

ASN20446 (,)

cdn.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
k4z6w9b5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (,)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 150.70.178.131 (Japan)

ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US)
PTR: sjc1-te-ftp.trendmicro.com

documents.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.90.101 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-90-101.deploy.static.akamaitechnologies.com

libs.coremetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.23.133.35 (Ashburn, United States)

ASN14618 (,)
PTR: ec2-107-23-133-35.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81e::2008 (Frankfurt am Main, Germany)

ASN15169 (,)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.122.87.153 (Frankfurt am Main, Germany)

ASN36351 (,)
PTR: 99.57.7a9f.ip4.static.sl-reverse.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 68.232.35.180 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (,)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::729 (Ascension Island)

ASN54113 (,)

cdn.ravenjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 159.122.87.148 (Frankfurt am Main, Germany)

ASN36351 (,)
PTR: 94.57.7a9f.ip4.static.sl-reverse.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.255.34.6 (United States) 1 redirects

ASN36351 (,)

analytics.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (,)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.36.134 (Amsterdam, Netherlands)

ASN54113 (,)

trendlabs.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 129.33.139.56 (United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)

data.cmcore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (,)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.130 (United States)

ASN15169 (,)
PTR: zrh04s06-in-f130.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.43.119.71 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-119-71.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (,)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:18c::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.15.212.64 (United States)

ASN53580 (MARKETO - MARKETO, Inc., US)

resources.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.36.157 (Amsterdam, Netherlands)

ASN54113 (,)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (,)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.102 (United States) 1 redirects

ASN15169 (,)
PTR: fra16s42-in-f6.1e100.net

5427711.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6813:c797 (United States)

ASN13335 (,)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (,)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:4ea6 (United States)

ASN13335 (,)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.0.134 (United States)

ASN54113 (,)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN53580 (,)

945-cxd-062.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.204.161.88 (Ashburn, United States)

ASN14618 (,)
PTR: ec2-18-204-161-88.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:a10d (United States)

ASN13335 (,)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.147.136 (Ashburn, United States)

ASN14618 (,)
PTR: ec2-107-20-147-136.compute-1.amazonaws.com

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (,)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (,)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (,)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f006:15:face:b00c:0:2 (Ireland)

ASN32934 (,)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (,)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.154.175.204 (Dublin, Ireland)

ASN16509 (,)
PTR: ec2-54-154-175-204.eu-west-1.compute.amazonaws.com

api.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (,)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:f500:11:101::b93f:9005 (Ireland) 2 redirects

ASN14413 (,)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:10:101::b93f:9101 (Ireland) 1 redirects

ASN14413 (,)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (,)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
70	trendmicro.com 1 redirects blog.trendmicro.com www.trendmicro.com documents.trendmicro.com analytics.trendmicro.com resources.trendmicro.com	855 KB
9	tiqcdn.com tags.tiqcdn.com	35 KB
8	google-analytics.com ssl.google-analytics.com www.google-analytics.com	55 KB
6	cloudflare.com cdnjs.cloudflare.com	50 KB
6	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com	126 KB
6	stackpathcdn.com k4z6w9b5.stackpathcdn.com	232 KB
5	viglink.com cdn.viglink.com api.viglink.com	29 KB
5	disquscdn.com c.disquscdn.com	202 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com	3 KB
4	disqus.com trendlabs.disqus.com disqus.com	26 KB
3	doubleclick.net 2 redirects 5427711.fls.doubleclick.net googleads.g.doubleclick.net	1 KB
3	googleapis.com fonts.googleapis.com ajax.googleapis.com	75 KB
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	806 B
2	bing.com bat.bing.com	7 KB
2	marketo.net munchkin.marketo.net	6 KB
2	googleadservices.com www.googleadservices.com	10 KB
2	googletagmanager.com www.googletagmanager.com	52 KB
2	coremetrics.com libs.coremetrics.com	43 KB
2	shareaholic.net cdn.shareaholic.net www.shareaholic.net	5 KB
1	twitter.com analytics.twitter.com	495 B
1	t.co t.co	486 B
1	gstatic.com fonts.gstatic.com	9 KB
1	facebook.com graph.facebook.com	633 B
1	google.de www.google.de	109 B
1	google.com 1 redirects www.google.com	574 B
1	mktoresp.com 945-cxd-062.mktoresp.com	272 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	bizographics.com sjs.bizographics.com	5 KB
1	ytimg.com s.ytimg.com	8 KB
1	cmcore.com data.cmcore.com	326 B
1	youtube.com www.youtube.com	1 KB
1	ravenjs.com cdn.ravenjs.com	14 KB
149	32

	Domain	Requested by
57	blog.trendmicro.com	blog.trendmicro.com cdn.shareaholic.net
9	tags.tiqcdn.com	blog.trendmicro.com tags.tiqcdn.com
8	documents.trendmicro.com	blog.trendmicro.com cdn.shareaholic.net
6	cdnjs.cloudflare.com	k4z6w9b5.stackpathcdn.com
6	www.google-analytics.com	tags.tiqcdn.com www.google-analytics.com blog.trendmicro.com www.googletagmanager.com
6	dev.visualwebsiteoptimizer.com	blog.trendmicro.com dev.visualwebsiteoptimizer.com
6	k4z6w9b5.stackpathcdn.com	cdn.shareaholic.net k4z6w9b5.stackpathcdn.com blog.trendmicro.com
5	c.disquscdn.com	trendlabs.disqus.com
3	px.ads.linkedin.com	2 redirects
3	cdn.viglink.com	k4z6w9b5.stackpathcdn.com blog.trendmicro.com
3	analytics.trendmicro.com	1 redirects libs.coremetrics.com blog.trendmicro.com
2	api.viglink.com	cdn.viglink.com
2	disqus.com	trendlabs.disqus.com
2	ajax.googleapis.com	k4z6w9b5.stackpathcdn.com
2	5427711.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com blog.trendmicro.com
2	munchkin.marketo.net	tags.tiqcdn.com munchkin.marketo.net
2	www.googleadservices.com	tags.tiqcdn.com www.googleadservices.com
2	trendlabs.disqus.com	blog.trendmicro.com
2	ssl.google-analytics.com	blog.trendmicro.com
2	www.googletagmanager.com	blog.trendmicro.com tags.tiqcdn.com
2	libs.coremetrics.com	blog.trendmicro.com libs.coremetrics.com
1	analytics.twitter.com	static.ads-twitter.com
1	www.linkedin.com	1 redirects
1	t.co	blog.trendmicro.com
1	fonts.gstatic.com	blog.trendmicro.com
1	graph.facebook.com	ajax.googleapis.com
1	www.google.de	blog.trendmicro.com
1	www.google.com	1 redirects
1	googleads.g.doubleclick.net	1 redirects
1	partner.shareaholic.com	k4z6w9b5.stackpathcdn.com
1	analytics.shareaholic.com	cdn.ravenjs.com
1	945-cxd-062.mktoresp.com	munchkin.marketo.net
1	static.ads-twitter.com	tags.tiqcdn.com
1	resources.trendmicro.com	tags.tiqcdn.com
1	sjs.bizographics.com	tags.tiqcdn.com
1	s.ytimg.com	www.youtube.com
1	data.cmcore.com	libs.coremetrics.com
1	www.youtube.com	tags.tiqcdn.com
1	cdn.ravenjs.com	cdn.shareaholic.net
1	www.shareaholic.net	cdn.shareaholic.net
1	www.trendmicro.com	blog.trendmicro.com
1	fonts.googleapis.com	blog.trendmicro.com
1	cdn.shareaholic.net	blog.trendmicro.com
149	44

This site contains links to these domains. Also see Links.

Domain
www.trendmicro.com
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
feeds.trendmicro.com
docs.microsoft.com
go.trendmicro.com
www.trendmicro.com.au
www.trendmicro.co.nz
cn.trendmicro.com
jp.trendmicro.com
www.trendmicro.co.kr
tw.trendmicro.com
br.trendmicro.com
la.trendmicro.com
ca.trendmicro.com
www.trendmicro.fr
www.trendmicro.de
www.trendmicro.it
www.trendmicro.com.ru
www.trendmicro.es
www.trendmicro.co.uk

Subject Issuer	Validity	Valid
www.trendmicro.com AffirmTrust Extended Validation CA - EV1	`2018-09-11` - `2020-09-11`	2 years	crt.sh
apps.shareaholic.com Sectigo RSA Domain Validation Secure Server CA	`2019-05-03` - `2019-08-01`	3 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
*.trendmicro.com AffirmTrust Certificate Authority - OV1	`2018-06-20` - `2020-06-20`	2 years	crt.sh
*.coremetrics.com DigiCert SHA2 Secure Server CA	`2019-01-28` - `2020-04-28`	a year	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2018-06-27` - `2019-06-27`	a year	crt.sh
*.shareaholic.net Let's Encrypt Authority X3	`2019-05-02` - `2019-07-31`	3 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2017-06-30` - `2020-07-06`	3 years	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2020-05-13`	3 years	crt.sh
osff.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-15` - `2020-01-23`	8 months	crt.sh
analytics.trendmicro.com AffirmTrust Certificate Authority - OV1	`2017-05-05` - `2019-05-06`	2 years	crt.sh
*.google.com Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2018-03-28` - `2020-04-27`	2 years	crt.sh
data.cmcore.com DigiCert SHA2 High Assurance Server CA	`2018-05-14` - `2019-07-10`	a year	crt.sh
www.googleadservices.com Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2018-12-24` - `2020-03-24`	a year	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
resources.trendmicro.com AffirmTrust Certificate Authority - OV1	`2017-08-28` - `2019-08-29`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2018-08-16` - `2019-08-21`	a year	crt.sh
www.bing.com Microsoft IT TLS CA 5	`2017-07-20` - `2019-07-10`	2 years	crt.sh
*.doubleclick.net Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-02` - `2019-09-08`	6 months	crt.sh
ssl565697.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-17` - `2019-09-23`	6 months	crt.sh
*.mktoresp.com GeoTrust RSA CA 2018	`2018-02-05` - `2020-02-05`	2 years	crt.sh
shareaholic.com Amazon	`2018-08-14` - `2019-09-14`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-02` - `2019-09-08`	6 months	crt.sh
*.shareaholic.com Let's Encrypt Authority X3	`2019-05-14` - `2019-08-12`	3 months	crt.sh
www.google.de Google Internet Authority G3	`2019-04-30` - `2019-07-23`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-04-22` - `2019-07-21`	3 months	crt.sh
viglink.com Amazon	`2019-02-09` - `2020-03-09`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-03-07` - `2020-03-07`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2017-06-06` - `2019-06-11`	2 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-01-28` - `2020-01-28`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Frame ID: 99B6BFC6110F8D7978480488AF0C6CE2
Requests: 132 HTTP requests in this frame

Frame: https://cdn.ravenjs.com/3.26.4/raven.min.js
Frame ID: 1DA3E898167E513DCBFD7302071256C4
Requests: 14 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F
Frame ID: 624CF74E9A2C09EEDB6ED089945FB65B
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=trendlabs&t_i=84881%20https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2F%3Fp%3D84881&t_u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&t_e=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam&t_d=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&t_t=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam&s_o=default
Frame ID: BBB61C63F1AEE5E52500A584C5AB8759
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: 1843EC0AC3391A8334C94ECA409F8F23
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: AFC1FBEE0EF1D57D21FF37F5DEC9E893
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast/i

Disqus (Comment Systems) Expand

Overall confidence: 100%
Detected patterns

env /^DISQUS/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

script /munchkin\.marketo\.net\/munchkin\.js/i
env /^Munchkin$/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /^\/\/tags\.tiqcdn\.com\//i

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^twemoji$/i

VigLink (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

env /^(?:vglnk(?:$|_)|vl_(?:cB|disable)$)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

149
Requests

99 %
HTTPS

47 %
IPv6

32
Domains

44
Subdomains

41
IPs

6
Countries

1849 kB
Transfer

5129 kB
Size

13
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.trendmicro.com/
Title: Trend Micro

Search URL Search Domain Scan URL

URL: https://twitter.com/trendmicrorsrch

Search URL Search Domain Scan URL

URL: http://www.facebook.com/trendmicro

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/trend-micro

Search URL Search Domain Scan URL

URL: http://www.youtube.com/user/TrendMicroInc

Search URL Search Domain Scan URL

URL: http://feeds.trendmicro.com/Anti-MalwareBlog

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010
Title: MS17-010

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/spam/683/trickbot-strikes-via-new-spam-wave
Title: fake payment notifications

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/evolving-trickbot-adds-detection-evasion-and-screen-locking-features
Title: detection evasion and screen-locking

Search URL Search Domain Scan URL

URL: http://go.trendmicro.com/sem/sem/www.trendmicro.com/us/business/xgen/index.html
Title: XGen™ security

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/forHome/products.html
Title: Trend Micro™ Security

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/us/business/complete-user-protection/index.html
Title: Trend Micro™ Smart Protection Suites

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/small-business/worry-free.html
Title: Trend Micro Worry-Free™ Business Security

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/business/products/network.html?utm_campaign=VURL:www.trendmicro.com&utm_medium=VURL&utm_source=/us/business/cyber-security/index.html
Title: Trend Micro Network Defense

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/security-intelligence/enterprise-ransomware/index.html
Title: ENTERPRISE »

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/security-intelligence/small-business-ransomware/index.html
Title: SMALL BUSINESS»

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/home/consumer-ransomware/index.html
Title: HOME»

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/security/research-and-analysis/predictions/2019
Title: Read our security predictions for 2019.

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/security-101-business-process-compromise
Title: read our Security 101: Business Process Compromise.

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/home/index.html
Title: Home and Home Office

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/business/index.html
Title: For Business

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/security-intelligence/index.html
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/about-us/index.html
Title: About Trend Micro

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com.au/au/home/index.html
Title: Australia

Search URL Search Domain Scan URL

URL: http://www.trendmicro.co.nz/nz/home/index.html
Title: New Zealand

Search URL Search Domain Scan URL

URL: http://cn.trendmicro.com/cn/home/index.html
Title: 中国

Search URL Search Domain Scan URL

URL: http://jp.trendmicro.com/jp/home/index.html
Title: 日本

Search URL Search Domain Scan URL

URL: http://www.trendmicro.co.kr/index.html
Title: 대한민국

Search URL Search Domain Scan URL

URL: http://tw.trendmicro.com/tw/home/index.html
Title: 台灣

Search URL Search Domain Scan URL

URL: http://br.trendmicro.com/br/home/index.html
Title: Brasil

Search URL Search Domain Scan URL

URL: http://la.trendmicro.com/la/home/index.html
Title: México

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/index.html
Title: United States

Search URL Search Domain Scan URL

URL: http://ca.trendmicro.com/ca/home/index.html
Title: Canada

Search URL Search Domain Scan URL

URL: http://www.trendmicro.fr/
Title: France

Search URL Search Domain Scan URL

URL: http://www.trendmicro.de/
Title: Deutschland / Österreich / Schweiz

Search URL Search Domain Scan URL

URL: http://www.trendmicro.it/
Title: Italia

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com.ru/
Title: Россия

Search URL Search Domain Scan URL

URL: http://www.trendmicro.es/
Title: España

Search URL Search Domain Scan URL

URL: http://www.trendmicro.co.uk/
Title: United Kingdom / Ireland

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/about-us/legal-policies/privacy-statement/index.html
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: http://www.trendmicro.com/us/about-us/legal-policies/index.html
Title: Legal Policies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82

https://analytics.trendmicro.com/cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&tid=6&cg=MalwareBlog-Post&rnd=1558528697599&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=May&pv_a7=2019 HTTP 302
https://analytics.trendmicro.com/cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&tid=6&cg=MalwareBlog-Post&rnd=1558528697599&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=May&pv_a7=2019&cvdone=p

Request Chain 108

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F HTTP 302
https://5427711.fls.doubleclick.net/activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F

Request Chain 131

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=9jXlXO7BOsbi3wPQpamACA&sscte=1&crd=&gtd= HTTP 302
https://www.google.com/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&cdct=2&is_vtc=1&ocp_id=9jXlXO7BOsbi3wPQpamACA&random=841703132&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&cdct=2&is_vtc=1&ocp_id=9jXlXO7BOsbi3wPQpamACA&random=841703132&resp=GooglemKTybQhCsO&ipr=y

Request Chain 143

https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=js&s=1 HTTP 302
https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=js&s=1&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1558525434076%26pid%3D8866%26url%3Dhttps%253A%252F%252Fblog.trendmicro.com%252Ftrendlabs-security-intelligence%252Ftrickbot-watch-arrival-via-redirection-url-in-spam%252F%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=js&s=1&cookiesTest=true&liSync=true

149 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/ 82 KB
21 KB 867ms
427ms Document
text/html 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8afe2513e82340e2b7a1640928467e4114e26f40e8aed1c889432a9b99f25596

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Host: blog.trendmicro.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx
Content-Type: text/html; charset=UTF-8
Content-Length: 21308
Pragma: no-cache
X-UA-Compatible: IE=edge
X-Pingback: https://blog.trendmicro.com/trendlabs-security-intelligence/xmlrpc.php
Link: <https://blog.trendmicro.com/trendlabs-security-intelligence/?p=84881>; rel=shortlink
Vary: Accept-Encoding
Content-Encoding: gzip
X-Cacheable: YES
X-Varnish: 426453620
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1;mode=block
X-Dispatcher: Yes
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Date: Wed, 22 May 2019 11:43:49 GMT
Connection: keep-alive

GET
H2 200 shareaholic.js Show response
cdn.shareaholic.net/assets/pub/ 6 KB
3 KB 100ms
29ms Script
application/javascript 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: cf89f407e2db31d4f94b32bc3819bd2481bcdf2d75eaed98d4a79277b650d3ea

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
last-modified: Fri, 17 May 2019 19:30:25 GMT
server: nginx
x-amz-request-id: 9585D4716D840605
etag: "affe7f1ed22ec8a07c0d34074038480b"
x-hw: 1558525429.cds067.lo4.hn,1558525429.cds098.lo4.c
content-type: application/javascript
status: 200
cache-control: max-age=900, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2492
x-amz-id-2: xi/NwiCWH42UvgedhwNcIMRqIM9Z/fQCkf73wZjiK35asbT92oHzDL0RAAGg5P0q8xr/BR9oWDE=

GET
H/1.1 200
OK widget.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/yet-another-related-posts-plugin/style/ 771 B
825 B 22ms
14ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/yet-another-related-posts-plugin/style/widget.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1210b2986220f5f6e6f416d87911e6655eed292f81a8219d8506f57c5d4353a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 384
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:43:50 GMT
Server: nginx
ETag: "303-58825d9a64efa-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158158043
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK styles.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/feedburner-email-subscription/css/ 513 B
683 B 38ms
15ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/feedburner-email-subscription/css/styles.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

08f91baa9280e9a089f3e8b1dae667c4d69cc8268c59105e324847402332e4fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 242
X-XSS-Protection: 1;mode=block
Last-Modified: Wed, 13 Jan 2016 23:32:09 GMT
Server: nginx
ETag: "201-5293f9429d040-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153892
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK style.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/ 70 KB
15 KB 52ms
14ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/style.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ee290666f02ac90c3e4bb57b767b7a32149599fa59ad1b8120208b74e79237ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 14526
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "11660-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153893
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK dynamicCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/ 16 KB
4 KB 66ms
13ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ed8103aa39e3d6156b0fca9caf6fc88473686048f495b08df443a5995e4c33fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Pragma: no-cache
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Varnish: 426449604
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 3184
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK responsiveCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/ 21 KB
3 KB 69ms
14ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/responsiveCss.php?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c005667a560305e72f76e6464a0cd95c7dbe9a35da6cffebe3617fbd1496faf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Pragma: no-cache
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Varnish: 426448791
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 2860
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK customCss.php
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/ 20 KB
5 KB 159ms
103ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bf724439f2f8fd287feb12f58c2e382886601ae7ace43215778dfd3d75435210

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Pragma: no-cache
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Varnish: 426448129
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 4709
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK style.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/css/dist/block-library/ 30 KB
5 KB 71ms
15ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/css/dist/block-library/style.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f42551c6cb1f3a2597f99bdb1b458a5224c04d14de425efc4c1f543bbc1a2570

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 5112
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:38:02 GMT
Server: nginx
ETag: "79d7-58825c4f010eb-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153900
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK fancybox.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fancybox-for-wordpress/assets/css/ 18 KB
4 KB 71ms
15ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fancybox-for-wordpress/assets/css/fancybox.css?ver=1.3.4

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2cc892aff2bd38e775ab3dbf8f6e197a2c46b5989c697172b6046393dc01b17d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3805
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:40:32 GMT
Server: nginx
ETag: "489d-58825cddcae09-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158216568
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK wpp.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wordpress-popular-posts/public/css/ 1 KB
972 B 71ms
15ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wordpress-popular-posts/public/css/wpp.css?ver=4.2.2

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

951c201eceb26489dc9b4cc8ea4e408ae957410ea32b0fc7d4845d851886739f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 531
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:43:46 GMT
Server: nginx
ETag: "4c1-58825d96c13df-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158156082
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK twitter-feed.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wp-to-twitter/css/ 2 KB
953 B 80ms
13ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wp-to-twitter/css/twitter-feed.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

196b0d1013a5fb1985890e13453ab76df8bdcee3d57893e84afa3f3e58eacf52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sun, 05 May 2019 15:43:47 GMT
Server: nginx
X-Cacheable: YES
ETag: "6ce-58825d98151af-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 424160029
Connection: keep-alive
Content-Type: text/css
Vary: Accept-Encoding
Content-Length: 535
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK layerslider.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/css/ 4 KB
1 KB 82ms
13ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/css/layerslider.css?ver=3.5.0

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b4c068f566d4557dac74a849284e07c1da7fb80e8a23812f99016eb1aee15186

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 957
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:34 GMT
Server: nginx
ETag: "101b-5205c9517d380-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839978640
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK frs.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/css/ 8 KB
2 KB 86ms
14ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/css/frs.css?ver=2.3.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

96543b22a94e2ad5bcc8f7c80665280ec6dfcddef0d839bb69d73674468b4459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1667
X-XSS-Protection: 1;mode=block
Last-Modified: Mon, 14 Aug 2017 09:38:36 GMT
Server: nginx
ETag: "1f79-556b36d461f00-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839978651
Accept-Ranges: bytes
Content-Type: text/css

GET
H/1.1 200
OK frs-position.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/css/ 3 KB
894 B 85ms
13ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/css/frs-position.css?ver=2.3.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7f5d20386c62bc7957520cfe679927bf480d6ca275e7d1b05f08994bca59b6ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 454
X-XSS-Protection: 1;mode=block
Last-Modified: Mon, 14 Aug 2017 09:38:36 GMT
Server: nginx
ETag: "c84-556b36d461f00-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839978668
Accept-Ranges: bytes
Content-Type: text/css

GET
H2 200 css
fonts.googleapis.com/ 10 KB
845 B 21ms
15ms Stylesheet
text/css 2a00:1450:4001:824::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C700italic%2C400%2C700&ver=2.3.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

ESF /

Resource Hash

476a2655428d2b968d291f986787023860b0645b3ab6c4e3b66b445e186b2ca2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 22 May 2019 11:43:49 GMT
server: ESF
access-control-allow-origin: *
date: Wed, 22 May 2019 11:43:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Wed, 22 May 2019 11:43:49 GMT

GET
H/1.1 200
OK jquery.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/ 95 KB
33 KB 99ms
17ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/jquery.js?ver=1.12.4

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

fa055f2f7c5b735dbbb71954f434aed79925bc00ff2ffbc3ecfc4a790689a723

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 33766
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:38:02 GMT
Server: nginx
ETag: "17b9f-58825c4ed1340-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158194385
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery-migrate.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/ 23 KB
8 KB 100ms
14ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 7813
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:38:02 GMT
Server: nginx
ETag: "5bdb-58825c4ecd4bf-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158257925
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK superfish.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 3 KB
2 KB 101ms
15ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/superfish.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

62d9012a3badacfbf2c47ba8f9e83f5d33b66d05e7b25b54dd60dc07f01a58fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1342
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "c03-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153903
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK verticalMenu.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 2 KB
1 KB 100ms
15ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/verticalMenu.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

86321c43556c304568daf15b1660cc91f90db686ee291c5f5da81522cd809ff1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 609
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "7d3-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153905
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.tools.tabs.min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 3 KB
2 KB 111ms
13ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/jquery.tools.tabs.min.js?ver=1.2.5

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9609588bc37c441a77b4a59833d9356028c573f4b26615a64f5143e4a197939b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1326
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "ba9-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839979573
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.imgpreload.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 2 KB
2 KB 114ms
13ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/jquery.imgpreload.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1fa0c6a60241076bfa896030442753f3880bf99ba73ddb6eb24dccad0bfc075c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1125
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "89d-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153907
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.colorbox-min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 9 KB
5 KB 116ms
14ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/jquery.colorbox-min.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c24b44e8c7234bd170abd96909ce1668bb22d31635b8c99aeedaacf958969c76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 4193
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "25ec-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153908
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.isotope.min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 16 KB
5 KB 116ms
15ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/jquery.isotope.min.js?ver=1.5.19

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7a3c6d22de397f163b11ae6e13db851b720abb639b0d158e1308a7ef02dfb97d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 5011
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "3e0e-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839979575
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.easing.1.3.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 7 KB
2 KB 124ms
14ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/jquery.easing.1.3.js?ver=1.3

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

238b3b15fd1f306b170ab1b3af0c3e051f68642d487454544505d9c49d3f93bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1898
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "1c34-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839979583
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK custom.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 10 KB
4 KB 125ms
15ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/custom.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

31895b039ea1a0252fda10656dbcef19e8647014d00e77f08e32a9db2abbe832

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3295
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:35 GMT
Server: nginx
ETag: "2970-5205c952715c0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153909
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK customJs.php Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/ 399 B
710 B 214ms
100ms Script
text/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/js/customJs.php?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

aa16d08aa19b9af5effe3381d0ba38f1a675c362bd62b2db8d012d35e3db3510

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Pragma: no-cache
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Varnish: 426447799
Cache-Control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Length: 252
X-XSS-Protection: 1;mode=block

GET
H/1.1 200
OK frs.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/ 54 KB
9 KB 132ms
16ms Script
application/x-javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/frs.js?ver=2.3.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

49476f91ae0265b8a2db95ab66cf22d5abd7be374f7ec574443867ccab5ff638

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8295
X-XSS-Protection: 1;mode=block
Last-Modified: Mon, 14 Aug 2017 09:38:36 GMT
Server: nginx
ETag: "d7d5-556b36d461f00-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839464637
Accept-Ranges: bytes
Content-Type: application/x-javascript

GET
H/1.1 200
OK jquery.touchSwipe.min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/ 11 KB
4 KB 135ms
19ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/jquery.touchSwipe.min.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

0c6ef976b32b0f9158ce1211ed5d75bc3197e5a1802a70749e186fba11b78498

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3673
X-XSS-Protection: 1;mode=block
Last-Modified: Mon, 14 Aug 2017 09:38:36 GMT
Server: nginx
ETag: "2a32-556b36d461f00-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158153912
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK imagesloaded.min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/ 7 KB
3 KB 153ms
24ms Script
application/x-javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fluid-responsive-slideshow/js/imagesloaded.min.js?ver=2.3.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a9667d16d28f3a6a1b777fbdc7775a0ea43cfd5da93cfac4c948a240a398656f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 2380
X-XSS-Protection: 1;mode=block
Last-Modified: Mon, 14 Aug 2017 09:38:36 GMT
Server: nginx
ETag: "1b6c-556b36d461f00-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839464643
Accept-Ranges: bytes
Content-Type: application/x-javascript

GET
H/1.1 200
OK frontend.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/stop-user-enumeration/frontend/js/ 232 B
623 B 153ms
24ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.3.20

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 169
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:43:36 GMT
Server: nginx
ETag: "e8-58825d8d2fe1e-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158155637
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.fancybox.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fancybox-for-wordpress/assets/js/ 156 KB
38 KB 155ms
18ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/fancybox-for-wordpress/assets/js/jquery.fancybox.js?ver=1.3.4

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2f1ea72b2b51bf4c7a64c95eec7d53291d1f060a175b73a8194d12eac0f0a993

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 38943
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:40:32 GMT
Server: nginx
ETag: "27134-58825cddc5fe8-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158275391
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK wpp-4.2.0.min.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wordpress-popular-posts/public/js/ 1 KB
1 KB 151ms
14ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9fd7bfa229eec86e2b02fdcf85e49e5b2699a2d9cd53ee36b4df53513d1da1f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 581
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:43:46 GMT
Server: nginx
ETag: "47b-58825d96c043f-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158155638
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK layerslider.kreaturamedia.jquery.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/js/ 25 KB
10 KB 168ms
16ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/js/layerslider.kreaturamedia.jquery.js?ver=3.5.0

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bb15e076783b6ba0f44ce382e8a5a06775cb11f2f3f84f5067f3567188016c61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 9464
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:33 GMT
Server: nginx
ETag: "62ef-5205c95089140-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839979597
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK jquery-easing-1.3.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/js/ 8 KB
2 KB 173ms
20ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/framework/plug-ins/LayerSlider/js/jquery-easing-1.3.js?ver=1.3.0

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d2bc9c513d50deb617981195a91d357c004688ae7a90962da29814385e168dea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 2005
X-XSS-Protection: 1;mode=block
Last-Modified: Tue, 22 Sep 2015 21:21:33 GMT
Server: nginx
ETag: "2071-5205c95089140-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839979598
Accept-Ranges: bytes
Content-Type: application/javascript

GET
H/1.1 200
OK date-stamp.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/date-stamp/ 1 KB
902 B 81ms
13ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/date-stamp/date-stamp.css

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

09f9269176e86a07cd9f52f45c0d75cdf6b02180c71bcb1bb2c01ee33a0c3bd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 456
X-XSS-Protection: 1;mode=block
Last-Modified: Wed, 15 Dec 2010 02:34:31 GMT
Server: nginx
ETag: "598-49769c6e37bc0-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 839978690 839974591
Content-Type: text/css
X-Cache-Hits: 11

GET
H2 200 ransomware-solutions-blog-template-style.css
www.trendmicro.com/vinfo/cloudlink/styles/ 4 KB
1 KB 83ms
19ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/cloudlink/styles/ransomware-solutions-blog-template-style.css

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1b6a8ba260c8eb344ad40fadccadc8dd6752ed67318153676309febd6d83eb34

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding
content-length: 1061
x-prod-n-02: Yes
last-modified: Wed, 27 Jul 2016 05:50:13 GMT
server: nginx
date: Wed, 22 May 2019 11:43:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css
x-xss-protection: 1;mode=block
cache-control: max-age=1
etag: W/"4cb788becae7d11:0"
expires: Wed, 22 May 2019 11:43:50 GMT

GET
H/1.1 200
OK twitter.jpg
documents.trendmicro.com/images/TEx/blogicons/ 2 KB
2 KB 830ms
161ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/twitter.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: d1695d8985b2411104b59085fcf35de39255e29ea68064e26bd3fb67116bbe42

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:49 GMT
ETag: "eea373fe4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:47:39 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 2201

GET
H/1.1 200
OK fb.jpg
documents.trendmicro.com/images/TEx/blogicons/ 2 KB
2 KB 991ms
159ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/fb.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: be23dbb4ef534fb2fbdf640c70e9ebce16ddd32eff4235784b99bbed85696cf6

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:49 GMT
ETag: "fe5bc941e4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:47:44 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 2257

GET
H/1.1 200
OK in.jpg
documents.trendmicro.com/images/TEx/blogicons/ 2 KB
3 KB 821ms
159ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/in.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 5e62e5f7ea3ee74d6430ce302b0c61d95e93d43a80a449447c64ba791065202c

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "64623f46e4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:47:51 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 2416

GET
H/1.1 200
OK youtube.jpg
documents.trendmicro.com/images/TEx/blogicons/ 2 KB
2 KB 832ms
163ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/youtube.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 90b34033918608d698be777640ea1c2a7e33e64229e10ae75cde40b8f4ac1ded

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "3ef9f4be4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:48:00 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 2171

GET
H/1.1 200
OK rss.jpg
documents.trendmicro.com/images/TEx/blogicons/ 2 KB
2 KB 840ms
161ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/rss.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 1bc4f47bd64d3c1a5f131b2241ac870c4a497a59237b3187d35eeff93ccba167

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "849f1973e4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:49:07 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 2258

GET
H2 200 blog-logo-2018.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/10/ 47 KB
48 KB 29ms
27ms Image
image/jpeg 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/10/blog-logo-2018.jpg

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

aa05b14bf4b4344109b83cb7e5d26a20591c298ded57d8168911f820bd2ec8fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Oct 2018 03:39:37 GMT
server: nginx
x-cacheable: YES
etag: "3e8eb2faff966a96e05fed40b9365e28"
x-frame-options: SAMEORIGIN
x-varnish: 839234835 839233515
status: 200
content-type: image/jpeg
content-length: 48628
x-xss-protection: 1;mode=block
x-cache-hits: 5

GET
H2 200 rootkit-feature-200x200.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/11/ 8 KB
8 KB 44ms
44ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/11/rootkit-feature-200x200.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

cebf053025b29c7ec4b3d6ef4e032f805b317cf4d023fc4a721f3042bcfdec36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 13 Nov 2018 08:08:52 GMT
server: nginx
x-cacheable: YES
etag: "201ef4c60471e940682137ea898674e3"
x-frame-options: SAMEORIGIN
x-varnish: 2154091721 2154086396
status: 200
content-type: image/png
content-length: 7848
x-xss-protection: 1;mode=block
x-cache-hits: 1

GET
H2 200 trickbot-spam-email-redirection-URL-fig-1.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 68 KB
68 KB 30ms
29ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-spam-email-redirection-URL-fig-1.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

31ca4c789d99d42ac7d3eb051c9693b3078fbc2aa3e3229dd23f0fbf6617413e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:49:31 GMT
server: nginx
x-cacheable: YES
etag: "759b1aeeb9cccf70d85b939c1403e5bc"
x-frame-options: SAMEORIGIN
x-varnish: 425892835 425892247
status: 200
content-type: image/png
content-length: 69391
x-xss-protection: 1;mode=block
x-cache-hits: 2

GET
H2 200 trickbot-redirection-notice-fig-2.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 71 KB
72 KB 53ms
52ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-redirection-notice-fig-2.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

90ce2e62e6733486cafcf39e399da0a91bc36f9ad180043e270737eb0b3ff0a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:49:29 GMT
server: nginx
x-cacheable: YES
etag: "c05bc8cb948b0f735240ccebbb5660ca"
x-frame-options: SAMEORIGIN
x-varnish: 425892248
status: 200
content-type: image/png
content-length: 72912
x-xss-protection: 1;mode=block

GET
H2 200 trickbot-malicious-site-order-review-fig-3.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 156 KB
157 KB 44ms
44ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-malicious-site-order-review-fig-3.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c50d0c28e2a468835879ee766fb71c9e505225351cc258991c7adbf1ba3909d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:49:27 GMT
server: nginx
x-cacheable: YES
etag: "4c4246fd5c70e4f3582c8b38a0e44dd8"
x-frame-options: SAMEORIGIN
x-varnish: 425892249
status: 200
content-type: image/png
content-length: 159899
x-xss-protection: 1;mode=block

GET
H2 200 trickbot-deobfuscated-script-fig-4.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 27 KB
28 KB 43ms
43ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-deobfuscated-script-fig-4.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

721ec8a676333627a985bfa6fb6968d2c097f7922e7f31048118467a77ed91a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:54:55 GMT
server: nginx
x-cacheable: YES
etag: "9e6f229ee111525bd5da1ddca29b554a"
x-frame-options: SAMEORIGIN
x-varnish: 425892251
status: 200
content-type: image/png
content-length: 28122
x-xss-protection: 1;mode=block

GET
H2 200 trickbot-processes-fig-5.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 20 KB
20 KB 38ms
29ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-processes-fig-5.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6e4a8bebbc429e5ff771f80299086e45b667ea5bb69f06d31e6b1c0561b836da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:49:23 GMT
server: nginx
x-cacheable: YES
etag: "5551c036c07fc698d772fdd504db945a"
x-frame-options: SAMEORIGIN
x-varnish: 425892250
status: 200
content-type: image/png
content-length: 20047
x-xss-protection: 1;mode=block

GET
H2 200 trickbot-modules-fig-6.png
blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/ 32 KB
32 KB 36ms
35ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2019/05/trickbot-modules-fig-6.png

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b661ad65228149bf1c614c44313818e661b4a7a1935f164bdd53ded0f37184cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 16 May 2019 09:49:22 GMT
server: nginx
x-cacheable: YES
etag: "963490ce9edb95f75a212cddc9987b39"
x-frame-options: SAMEORIGIN
x-varnish: 425892252
status: 200
content-type: image/png
content-length: 32560
x-xss-protection: 1;mode=block

GET
H/1.1 200
OK say-no-to-ransomware.jpg
documents.trendmicro.com/images/TEx/articles/ 46 KB
46 KB 314ms
158ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/articles/say-no-to-ransomware.jpg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: e3ac5c56d0c3a6005ee7a9226a3470acd9acbfa64244cddabb899140c8a8f5d4

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "43faf2fca4b1d11:0"
Last-Modified: Thu, 19 May 2016 08:03:54 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 47342

GET
H2 200 twemoji.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/ 25 KB
8 KB 27ms
27ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/twemoji.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7bbd355b4ca50ea670a75269add0ab1d071fb030fb26ab868917078535e78c99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
status: 200
vary: Accept-Encoding
content-length: 7617
x-xss-protection: 1;mode=block
last-modified: Sun, 05 May 2019 15:38:02 GMT
server: nginx
etag: "64d9-58825c4ec57bd-gzip"
x-frame-options: SAMEORIGIN
x-varnish: 2158153885
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 wp-emoji.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/ 9 KB
4 KB 20ms
20ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/wp-emoji.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
status: 200
vary: Accept-Encoding
content-length: 3424
x-xss-protection: 1;mode=block
last-modified: Sun, 05 May 2019 15:38:02 GMT
server: nginx
etag: "22d2-58825c4ec57bd-gzip"
x-frame-options: SAMEORIGIN
x-varnish: 2158153887
accept-ranges: bytes
content-type: application/javascript

GET
H/1.1 200
OK eluminate.js Show response
libs.coremetrics.com/ 156 KB
43 KB 123ms
18ms Script
application/x-javascript 184.31.90.101
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.coremetrics.com/eluminate.js
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.101 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-101.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d56485dbbc5b55b37f96b65ac0d5245e77cf51c094d827348f2243948f2feeca

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Mar 2019 17:31:33 GMT
Server: Apache
ETag: "648ad45a24b4d2c2a79a92505d2ecc8f:1552498293"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43582

GET
H/1.1 200
OK related.css
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/yet-another-related-posts-plugin/style/ 647 B
763 B 72ms
19ms Stylesheet
text/css 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6ca28839ba7e005b11dcf8d6de4c24f13f2cc988393ed7a570c41ee88ab092fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Dispatcher: Yes
Date: Wed, 22 May 2019 11:43:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Cacheable: YES
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 322
X-XSS-Protection: 1;mode=block
Last-Modified: Sun, 05 May 2019 15:43:50 GMT
Server: nginx
ETag: "287-58825d9a64efa-gzip"
X-Frame-Options: SAMEORIGIN
X-Varnish: 2158156142
Accept-Ranges: bytes
Content-Type: text/css

GET
H2 200 comment_count.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/ 889 B
720 B 15ms
14ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
status: 200
vary: Accept-Encoding
content-length: 440
x-xss-protection: 1;mode=block
last-modified: Sun, 05 May 2019 15:40:28 GMT
server: nginx
etag: "379-58825cda5227a-gzip"
x-frame-options: SAMEORIGIN
x-varnish: 2158154673
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 comment_embed.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/ 1 KB
784 B 28ms
25ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
status: 200
vary: Accept-Encoding
content-length: 505
x-xss-protection: 1;mode=block
last-modified: Sun, 05 May 2019 15:40:28 GMT
server: nginx
etag: "47e-58825cda5227a-gzip"
x-frame-options: SAMEORIGIN
x-varnish: 2158156823
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 wp-embed.js Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/ 3 KB
2 KB 29ms
26ms Script
application/javascript 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/wp-embed.js?ver=5.1.1

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
status: 200
vary: Accept-Encoding
content-length: 1267
x-xss-protection: 1;mode=block
last-modified: Sun, 05 May 2019 15:38:02 GMT
server: nginx
etag: "c8e-58825c4ec675d-gzip"
x-frame-options: SAMEORIGIN
x-varnish: 2158153915
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 shrMain.min.js Show response
k4z6w9b5.stackpathcdn.com/v2/01e18b43/ 432 KB
77 KB 63ms
14ms Script
application/javascript 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: d75d435caa401bff1ed2977371b022560a2539167638d4db6ae9dfb49c9a6924

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
x-amz-request-id: 1100B61E65EA9633
x-hw: 1558525429.cds111.fr8.hn,1558525429.cds034.fr8.c
status: 200
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 78820
x-amz-id-2: emwJaGSfwjD6lGsdiv372Hv4Ig/wFjhwTPX2MRBK+EDdlEkkefGz9bONlAU6Odw2519cHBedmZQ=
last-modified: Fri, 17 May 2019 19:30:24 GMT
server: nginx
etag: "12fd948c4fa1c731fe4a9fee7a7813ef"
access-control-max-age: 2000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag, Access-Control-Allow-Origin
cache-control: max-age=31536000, public
accept-ranges: bytes

GET
H2 200 f9f1a771608a24e84c49a8532e282dc1.json Show response
www.shareaholic.net/config/ 10 KB
2 KB 306ms
99ms XHR
application/json 107.23.133.35

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/f9f1a771608a24e84c49a8532e282dc1.json
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.23.133.35 Ashburn, United States, ASN14618 (,),
Reverse DNS: ec2-107-23-133-35.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 343c1fe4d71229177aaf3a89b8acdd04db4de680de7ad21ecb1d0b00ed4e6fff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
status: 200
content-length: 1480
server: nginx
etag: W/"343c1fe4d71229177aaf3a89b8acdd04"
access-control-max-age: 2000
access-control-allow-methods: GET, HEAD
x-varnish: 983917858 906057637
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin
cache-control: max-age=3, public, must-revalidate
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *

POST
H2 401 / Show response
blog.trendmicro.com/trendlabs-security-intelligence/wp-json/wordpress-popular-posts/v1/popular-posts/ 118 B
659 B 1358ms
1357ms XHR
application/json 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-json/wordpress-popular-posts/v1/popular-posts/

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ed6a7c7c15db91f2b6ffbaec4ccb7be48bd7853833e3e3e642ccf701fa90f3de

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
x-content-type-options: nosniff
x-cacheable: YES
status: 401
content-length: 118
pragma: no-cache
access-control-allow-headers: Authorization, Content-Type
server: nginx
x-robots-tag: noindex
vary: Origin
access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
x-varnish: 426453648
access-control-allow-origin: https://blog.trendmicro.com
access-control-expose-headers: X-WP-Total, X-WP-TotalPages
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
link: <https://blog.trendmicro.com/trendlabs-security-intelligence/wp-json/>; rel="https://api.w.org/"

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 58 KB
21 KB 25ms
15ms Script
application/javascript 2a00:1450:4001:81e::2008

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T8DW3SL

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2008 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

c1727d32d1dc3fbfe9430f8b35fb0011639a9aff2a188f336676c131b5476808

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
last-modified: Tue, 21 May 2019 20:21:51 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 21718
x-xss-protection: 0
expires: Wed, 22 May 2019 11:43:50 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 3 KB
2 KB 70ms
18ms Script
application/javascript 159.122.87.153

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&r=0.7953749801900643
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.153 Frankfurt am Main, Germany, ASN36351 (,),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: 1ceee93d453a2a67bc5e577ac2ea72599d505129a5b938663fd5f5e55a7a663e

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Wed, 22 May 2019 11:43:49 GMT
content-encoding: gzip
server: dacdn2
content-type: application/javascript; charset=UTF-8

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 75 KB
20 KB 89ms
13ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E5) /
Resource Hash: 5b5d78fe67167cbc3e8f23f5bee2f6637af84751a30473122e20ef4ddc14e2fe

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Tue, 09 Apr 2019 21:10:20 GMT
server: ECS (fcn/40E5)
etag: "606670861"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 20656
expires: Wed, 22 May 2019 11:48:50 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 46ms
6ms Script
text/javascript 2a00:1450:4001:80b::2008

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 May 2019 01:33:03 GMT
server: Golfe2
age: 1627
date: Wed, 22 May 2019 11:16:42 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17168
expires: Wed, 22 May 2019 13:16:42 GMT

GET
H2 200 stripe_2e31600cd015b400066a279bc8148c33.png
blog.trendmicro.com/wp-content/uploads/2013/07/ 93 B
351 B 29ms
19ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/wp-content/uploads/2013/07/stripe_2e31600cd015b400066a279bc8148c33.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

670d2452df4e20e6a2371d8a48fbe1bde1e4664081f1f20b478095d0b14d8685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 17 Jul 2013 19:56:49 GMT
server: nginx
x-cacheable: YES
etag: "5d-4e1ba7e7b0240"
x-frame-options: SAMEORIGIN
x-varnish: 834555221 834549547
status: 200
content-type: image/png
content-length: 93
x-xss-protection: 1;mode=block
x-cache-hits: 1

GET
H2 200 darkSeperator.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/ 929 B
1 KB 37ms
27ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/darkSeperator.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ec8ada9c249466cc83ead6cfea75ba0851281bb5a850b2009034d993e6449715

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/style.css?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2015 21:21:34 GMT
server: nginx
x-cacheable: YES
etag: "3a1-5205c9517d380"
x-frame-options: SAMEORIGIN
x-varnish: 839979613 839974620
status: 200
content-type: image/png
content-length: 929
x-xss-protection: 1;mode=block
x-cache-hits: 7

GET
H2 200 searchBg.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/ 1 KB
1 KB 31ms
21ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBg.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

746908a1b935d3ca0005ab17e8504e642f42cf3ce177dac795d898f5637dc0cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
x-cacheable: YES
status: 200
content-length: 1210
x-xss-protection: 1;mode=block
referrer-policy
last-modified: Tue, 22 Sep 2015 21:21:34 GMT
server: nginx
etag: "4ba-5205c95241248"
x-frame-options: SAMEORIGIN
x-varnish: 1534110630 1534107377
cache-control: max-age=3663
content-type: image/png
x-cache-hits: 1

GET
H2 200 searchBgHover.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/ 2 KB
2 KB 31ms
21ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchBgHover.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7d902673f947b5f070302fb19d049ed9d81694895de23552603e2da56782466b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
referrer-policy
last-modified: Tue, 22 Sep 2015 21:21:34 GMT
server: nginx
x-cacheable: YES
etag: "795-5205c9523d7b0"
x-frame-options: SAMEORIGIN
x-varnish: 468376535
status: 200
x-xss-protection: 1;mode=block
cache-control: max-age=3612
content-type: image/png
content-length: 1941
x-content-type-options: nosniff

GET
H2 200 searchSubmit.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/ 2 KB
2 KB 37ms
27ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/searchSubmit.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5f9eba6b4a09e7bbdfb3e9f52cc59625bb0a26854804928ffdf03c5ac2ad7d1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
x-cacheable: YES
status: 200
content-length: 1560
x-xss-protection: 1;mode=block
referrer-policy
last-modified: Tue, 22 Sep 2015 21:21:34 GMT
server: nginx
etag: "618-5205c95241248"
x-frame-options: SAMEORIGIN
x-varnish: 466798867 466794641
cache-control: max-age=54200
content-type: image/png
x-cache-hits: 1

GET
H2 200 postBubbles.png
blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/ 1 KB
2 KB 21ms
21ms Image
image/png 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/images/skins/minimal/postBubbles.png

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

005929580da46135c58cae0cbfcccd17e510aac10a27a3e674fb85ae4bee95c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/dynamicCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2015 21:21:34 GMT
server: nginx
x-cacheable: YES
etag: "587-5205c9517d380"
x-frame-options: SAMEORIGIN
x-varnish: 834801484 834798337
status: 200
content-type: image/png
content-length: 1415
x-xss-protection: 1;mode=block
x-cache-hits: 1

GET
H2 200 sec-pred-2019_sidebar.jpg
blog.trendmicro.com/trendlabs-security-intelligence/files/2018/12/ 21 KB
21 KB 29ms
19ms Image
image/jpeg 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/12/sec-pred-2019_sidebar.jpg

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5cb9a44218fdba8ed7dd67d279e1c4744491a18e8479bde0f2e575ca05985bbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Thu, 20 Dec 2018 00:43:26 GMT
server: nginx
x-cacheable: YES
etag: "82175fa89e28bed78a7f607a52e461f4"
x-frame-options: SAMEORIGIN
x-varnish: 2119456307 2119453087
status: 200
content-type: image/jpeg
content-length: 21063
x-xss-protection: 1;mode=block
x-cache-hits: 8

GET
H/1.1 200
OK sidebar-business-process-co.jpg
documents.trendmicro.com/images/TEx/articles/ 45 KB
46 KB 468ms
159ms Image
image/jpeg 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/articles/sidebar-business-process-co.jpg
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: f368605bd5e23568ed3e0568d70b9b1d039b82059e5e199335d059c4e400bee4

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "475b79c1e7c3d21:0"
Last-Modified: Wed, 03 May 2017 08:32:09 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 46571

GET
H/1.1 200
OK mailIcon.png
documents.trendmicro.com/images/TEx/blogicons/ 3 KB
3 KB 160ms
159ms Image
image/png 150.70.178.131
TREND MICRO INCOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://documents.trendmicro.com/images/TEx/blogicons/mailIcon.png
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 150.70.178.131 , Japan, ASN16880 (AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED, US),
Reverse DNS: sjc1-te-ftp.trendmicro.com
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 17dbeff08f1c2770ec37f9edf909627395215a93ac4d8c0307eaac9a4cab49b8

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=5.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
ETag: "6829cdb5e4dfd01:0"
Last-Modified: Wed, 26 Aug 2015 09:50:58 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2651

GET
H2 200 e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
blog.trendmicro.com/font/Interstate-Light/ 68 KB
69 KB 22ms
21ms Font
application/font-woff 104.109.56.169
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.trendmicro.com/font/Interstate-Light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff

Requested by

Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.56.169 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-56-169.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/themes/inspiredTrendLabs/css/customCss.php?ver=5.1.1
Origin: https://blog.trendmicro.com

Response headers

x-dispatcher: Yes
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 18 Sep 2014 19:08:14 GMT
server: nginx
x-cacheable: YES
etag: "1105c-5035bb4d02380"
x-frame-options: SAMEORIGIN
x-varnish: 840930597 840930516
status: 200
content-type: application/font-woff
content-length: 69724
x-xss-protection: 1;mode=block
x-cache-hits: 1

GET
H2 200 raven.min.js Show response
cdn.ravenjs.com/3.26.4/ Frame 1DA3 37 KB
14 KB 43ms
6ms Script
application/javascript 2a04:4e42:200::729

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ravenjs.com/3.26.4/raven.min.js
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::729 , Ascension Island, ASN54113 (,),
Reverse DNS
Software: Fastly /
Resource Hash: 3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Fri, 20 Jul 2018 09:10:03 GMT
server: Fastly
age: 22859
etag: "e7a52e3ca61154fb6077ca08d351e3e3"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13757

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
199 B 14ms
13ms Image
image/gif 2a00:1450:4001:80b::2008

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2078902382&utmhn=blog.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&utmhid=1978697389&utmr=-&utmp=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&utmht=1558525430156&utmac=UA-137644-6&utmcc=__utma%3D247958868.1417203096.1558525430.1558525430.1558525430.1%3B%2B__utmz%3D247958868.1558525430.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=965826858&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 va-043f4a2b907680908419b08213a8d3d5.js Show response
dev.visualwebsiteoptimizer.com/5.0/ 168 KB
56 KB 82ms
20ms Script
text/javascript 159.122.87.148

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/5.0/va-043f4a2b907680908419b08213a8d3d5.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&r=0.7953749801900643
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.148 Frankfurt am Main, Germany, ASN36351 (,),
Reverse DNS: 94.57.7a9f.ip4.static.sl-reverse.com
Software: fra1dacdn /
Resource Hash: f86c6e1eb69358e8f766ad580b840d7071ab691e2bb3baf4953f4e49e71ff913

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Tue, 21 May 2019 12:34:15 GMT
server: fra1dacdn
access-control-allow-origin: *
etag: "5ce3f047-dfef"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 57327

GET
H2 200 track-043f4a2b907680908419b08213a8d3d5.js Show response
dev.visualwebsiteoptimizer.com/5.0/ 17 KB
6 KB 129ms
68ms Script
text/javascript 159.122.87.148

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/5.0/track-043f4a2b907680908419b08213a8d3d5.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&r=0.7953749801900643
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.148 Frankfurt am Main, Germany, ASN36351 (,),
Reverse DNS: 94.57.7a9f.ip4.static.sl-reverse.com
Software: fra1dacdn /
Resource Hash: d12571fb058caba3e2478b76fc95d3f65741995d085ef27e29434b6e6d67791c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Tue, 21 May 2019 12:34:15 GMT
server: fra1dacdn
access-control-allow-origin: *
etag: "5ce3f047-15b9"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5561

GET
H2 200 opa-8c38e5daa48c1efe8891752e41f0a75e.js Show response
dev.visualwebsiteoptimizer.com/analysis/2.0/ 149 KB
48 KB 128ms
68ms Script
application/javascript 159.122.87.148

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/2.0/opa-8c38e5daa48c1efe8891752e41f0a75e.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&r=0.7953749801900643
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.148 Frankfurt am Main, Germany, ASN36351 (,),
Reverse DNS: 94.57.7a9f.ip4.static.sl-reverse.com
Software: fra1dacdn /
Resource Hash: 6a520a7c96d004ceb260a8692a0c6ca67daf6d3015f9726f81a0efd8d752f60f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Tue, 21 May 2019 12:34:14 GMT
server: fra1dacdn
access-control-allow-origin: *
etag: W/"5ce3f046-255df"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: public, max-age=604800

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
236 B 21ms
20ms Image
image/gif 159.122.87.153

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?a=215154&d=trendmicro.com&u=D68EB8C7736162AFDAF5B9D4861EFE697&h=b4d71e4ad8f236f97c3a6e7e7f5fddb1&t=false&r=0.54339894375776

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.122.87.153 Frankfurt am Main, Germany, ASN36351 (,),

Reverse DNS

99.57.7a9f.ip4.static.sl-reverse.com

Software

dacdn2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:49 GMT
x-content-type-options: nosniff
server: dacdn2
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H/1.1 200
OK 90369712.js Show response
libs.coremetrics.com/configs/ 85 B
410 B 21ms
17ms Script
application/x-javascript 184.31.90.101
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.coremetrics.com/configs/90369712.js
Requested by: Host: libs.coremetrics.com
URL: https://libs.coremetrics.com/eluminate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.101 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-101.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b568b1f531806b127ff051bc59e3675d9ca4c16c979107266cf505390c36dba5

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Aug 2012 23:40:49 GMT
Server: Apache
ETag: "5db5448f69bdbbbe387a460de2443a8b:1345074414"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86

GET
H/1.1 200
OK cookie-id.js Show response
analytics.trendmicro.com/ 57 B
333 B 1701ms
130ms Script
application/x-javascript 199.255.34.6

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.trendmicro.com/cookie-id.js?fn=eluminate6893
Requested by: Host: libs.coremetrics.com
URL: https://libs.coremetrics.com/eluminate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 199.255.34.6 , United States, ASN36351 (,),
Reverse DNS
Software: Apache /
Resource Hash: 38c0f0060861b5f7699b92530d6c3c4182515869fdf09b299e8deb8f57c7fc0d

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:51 GMT
Server: Apache
Connection: Keep-Alive
Content-Type: application/x-javascript
Keep-Alive: timeout=300, max=54
Content-Length: 57
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"

GET
H/1.1

200
OK

cm
analytics.trendmicro.com/
Redirect Chain

https://analytics.trendmicro.com/cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20I...
https://analytics.trendmicro.com/cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20I...

43 B
603 B

131ms
130ms

Image
image/gif

199.255.34.6

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://analytics.trendmicro.com/cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&tid=6&cg=MalwareBlog-Post&rnd=1558528697599&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=May&pv_a7=2019&cvdone=p
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 199.255.34.6 , United States, ASN36351 (,),
Reverse DNS
Software: Apache /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 May 2019 11:43:52 GMT
Server: Apache
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, pre-check=0, post-check=0, private
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=300, max=9
Content-Length: 43
Expires: Tue, 21 May 2019 11:43:52 GMT

Redirect headers

Location: /cm?ci=90369712&st=1558525430246&vn1=4.22.118&ec=utf-8&vn2=e4.0&pi=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog%20-%20MalwareBlog&ul=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&tid=6&cg=MalwareBlog-Post&rnd=1558528697599&pc=Y&jv=1.8.5&je=n&sw=1600&sh=1200&pd=24&tz=0&pv_a1=English&pv_a2=PH&pv_a3=Malware-BlogPost&pv_a4=Spam%2C&pv_a5=Trend%20Micro&pv_a6=May&pv_a7=2019&cvdone=p
Date: Wed, 22 May 2019 11:43:52 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=300, max=45
Content-Length: 0
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
1 KB 54ms
26ms Script
application/javascript 2a00:1450:4001:809::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

5156869aa1718304e7d1ea483d68d363e739178cb57c5ed9ee60a746e5ab49dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 EST

GET
H2 200 utag.69.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 2 KB
1 KB 22ms
21ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.69.js?utv=201610132134
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A6) /
Resource Hash: db3e8095381fb06bb6455b36c78beb4c8f1f6e3c2ef1483f97a8ec151704e6c6

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2016 21:48:18 GMT
server: ECS (fcn/41A6)
etag: "75691613+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1005
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 shrMain.min.js Show response
k4z6w9b5.stackpathcdn.com/v2/01e18b43/ Frame 1DA3 432 KB
77 KB 101ms
27ms Script
application/javascript 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Requested by: Host: cdn.shareaholic.net
URL: https://cdn.shareaholic.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: d75d435caa401bff1ed2977371b022560a2539167638d4db6ae9dfb49c9a6924

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-amz-request-id: 1100B61E65EA9633
x-hw: 1558525430.cds067.lo4.hn,1558525430.cds076.lo4.c
status: 200
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 78820
x-amz-id-2: emwJaGSfwjD6lGsdiv372Hv4Ig/wFjhwTPX2MRBK+EDdlEkkefGz9bONlAU6Odw2519cHBedmZQ=
last-modified: Fri, 17 May 2019 19:30:24 GMT
server: nginx
etag: "12fd948c4fa1c731fe4a9fee7a7813ef"
access-control-max-age: 2000
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: ETag, Access-Control-Allow-Origin
cache-control: max-age=31536000, public
accept-ranges: bytes

GET
H/1.1 200
OK count.js Show response
trendlabs.disqus.com/ 1 KB
1 KB 274ms
176ms Script
application/javascript 151.101.36.134

General

Check archive.org

Show headers Download Go to

Full URL

https://trendlabs.disqus.com/count.js

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.36.134 Amsterdam, Netherlands, ASN54113 (,),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 933229
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 08 May 2019 01:02:47 GMT
Server: nginx
ETag: "5cd22ab7-367"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect

GET
H/1.1 200
OK cookie-id.js Show response
data.cmcore.com/ 49 B
326 B 1052ms
160ms Script
application/x-javascript 129.33.139.56
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cmcore.com/cookie-id.js?fn=cmSetAvid
Requested by: Host: libs.coremetrics.com
URL: https://libs.coremetrics.com/eluminate.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 129.33.139.56 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 0c565577941b3ab40a246b32517e8edced36c7d480d65bd9b1299e7c01fc2176

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:51 GMT
Server: Apache
Connection: Keep-Alive
Content-Type: application/x-javascript
Keep-Alive: timeout=300, max=100
Content-Length: 49
P3P: CP="NON DSP COR CUR ADMo DEVo PSAo PSDo OUR IND ONL UNI PUR COM NAV INT DEM STA"

GET
H/1.1 200
OK embed.js Show response
trendlabs.disqus.com/ 64 KB
22 KB 325ms
252ms Script
application/javascript 151.101.36.134

General

Check archive.org

Show headers Download Go to

Full URL

https://trendlabs.disqus.com/embed.js

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.36.134 Amsterdam, Netherlands, ASN54113 (,),

Reverse DNS

Software

openresty /

Resource Hash

24032278443d32d5b7403fe65a5b5b9b26fd298f58b452ea5aa293bedf307ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 21610

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfl99qXyH/ 21 KB
8 KB 48ms
13ms Script
text/javascript 2a00:1450:4001:81b::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl99qXyH/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

4d222f2b485a1155435487dab18769a8de415204728fb7a9da94c3d433461c49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 16 May 2019 07:43:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 532821
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 8091
x-xss-protection: 0
last-modified: Thu, 16 May 2019 06:11:04 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Fri, 24 May 2019 07:43:29 GMT

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 3 KB
1 KB 22ms
20ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.9.js?utv=201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E7) /
Resource Hash: a1e2acedcc157bed6106061b1177d4de9102e7cb711fd74df49be5df56caecd2

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 25 Feb 2016 17:36:53 GMT
server: ECS (fcn/40E7)
etag: "3548890436+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1384
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 utag.18.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 2 KB
1 KB 23ms
21ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.18.js?utv=201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E3) /
Resource Hash: d2e8734e842f89489fa5bece0e3f613ba1c16ba2f12607a3cc0c38ff43413639

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 25 Feb 2016 17:36:52 GMT
server: ECS (fcn/40E3)
etag: "1732758884+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1024
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 utag.92.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 23 KB
6 KB 23ms
21ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.92.js?utv=201902141818
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A6) /
Resource Hash: 66561088efad00a5b856bbf459e42544bb596936943fbe3b0f8d7b6718608046

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 14 Feb 2019 18:19:04 GMT
server: ECS (fcn/41A6)
etag: "636828306+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 5736
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 utag.43.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 2 KB
1012 B 24ms
22ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.43.js?utv=201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40DE) /
Resource Hash: 9ea952c31d6d8c4c58481c338636f2424ee8ba8dfb6289645c0f1a3b2673698e

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 25 Feb 2016 17:36:54 GMT
server: ECS (fcn/40DE)
etag: "2942818274+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 923
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 utag.75.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 3 KB
1 KB 24ms
22ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.75.js?utv=201608171750
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E5) /
Resource Hash: 18a5b957a8ccd83f466eb7dde5fc616bb00c0be8b660f4c729c3dd41e1e8249a

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Wed, 17 Aug 2016 17:50:02 GMT
server: ECS (fcn/40E5)
etag: "4185047894"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1452
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 utag.91.js Show response
tags.tiqcdn.com/utag/trendmicro/nabu/prod/ 10 KB
3 KB 26ms
24ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.91.js?utv=201709142001
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4191) /
Resource Hash: 0819ab8b8211e99514e2b34bab24ae6d718e9f3d9ff3f7eae19380d293c77cc6

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 14 Sep 2017 20:00:52 GMT
server: ECS (fcn/4191)
etag: "1191131356+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2501
expires: Thu, 06 Jun 2019 11:43:50 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 207 KB
30 KB 27ms
25ms Script
application/javascript 2a00:1450:4001:81e::2008

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2008 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

cbe28e356d931c5c33bdfd7d9eeb612eb4b372a9497fcf2edd3900d1d40dd687

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
last-modified: Tue, 21 May 2019 20:21:51 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 31130
x-xss-protection: 0
expires: Wed, 22 May 2019 11:43:50 GMT

GET
H2 200 worker-68f4c079a93008e8e04f81f6476e5cc4.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 46 KB
15 KB 20ms
20ms XHR
application/javascript 159.122.87.148

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-68f4c079a93008e8e04f81f6476e5cc4.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/2.0/opa-8c38e5daa48c1efe8891752e41f0a75e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.148 Frankfurt am Main, Germany, ASN36351 (,),
Reverse DNS: 94.57.7a9f.ip4.static.sl-reverse.com
Software: fra1dacdn /
Resource Hash: d11075cd7df2682b221d194573250d4aed0a6a4e3a151acf41d1b14053495b85

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Wed, 04 Oct 2017 11:55:02 GMT
server: fra1dacdn
status: 200
etag: W/"59d4cc16-b83e"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800, public, max-age=604800

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 23 KB
9 KB 324ms
22ms Script
text/javascript 172.217.16.130

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.9.js?utv=201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (,),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

d1014dd86ebf5e5b98a0fdee2ff1a8cb6c30c2a4c2bfd3bc15b0aaa3a8dd93c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 8870
x-xss-protection: 0
server: cafe
etag: 2606668133852809251
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 22 May 2019 11:43:50 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 76ms
14ms Script
application/x-javascript 23.43.119.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.43.119.71 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-119-71.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 02:53:44 GMT
Server: Apache
ETag: "54520320df20b526337717d6d28181fc:1554432824"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

7dff09578729615fcd15c840a32c9f82a33fe2331a851e4ac40be03cb111b3f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 May 2019 01:33:03 GMT
server: Golfe2
age: 7014
date: Wed, 22 May 2019 09:46:56 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17779
expires: Wed, 22 May 2019 11:46:56 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 15 KB
5 KB 81ms
10ms Script
application/x-javascript 2a02:26f0:6c00:18c::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.43.js?utv=201510262117
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:18c::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 03 Dec 2018 23:03:30 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=11704
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4571

GET
H/1.1 200
OK revenuepulse-lib-v3.js Show response
resources.trendmicro.com/rs/945-CXD-062/images/ 2 KB
1 KB 1424ms
99ms Script
application/x-javascript 199.15.212.64
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_CBC

Server

199.15.212.64 , United States, ASN53580 (MARKETO - MARKETO, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 20 May 2019 01:50:53 GMT
Server: nginx
ETag: "48311d-6f3-58947f66ba4e7"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 695

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 3113ms
47ms Script
application/javascript 151.101.36.157

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.91.js?utv=201709142001
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.36.157 Amsterdam, Netherlands, ASN54113 (,),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:53 GMT
content-encoding: gzip
age: 73232
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-ams21042-AMS
last-modified: Tue, 23 Jan 2018 19:05:33 GMT
x-timer: S1558525434.710914,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
115 B 14ms
14ms Script
text/javascript 68.232.35.180
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabu/201904092110&cb=1558525430549
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabu/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.180 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A8) /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
last-modified: Thu, 14 Apr 2016 16:59:33 GMT
server: ECS (fcn/41A8)
etag: "2243872957"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Wed, 22 May 2019 11:53:50 GMT

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 2021
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 1296
x-xss-protection: 0
expires: Wed, 22 May 2019 12:10:09 GMT

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
957 B 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:16:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 1634
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 856
x-xss-protection: 0
expires: Wed, 22 May 2019 12:16:36 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 87ms
48ms Script
application/javascript 2620:1ec:c11::200

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (,),
Reverse DNS
Software: /
Resource Hash: 02c12028c90522c06327c224fefc978df14d510bf337adeb97eb1fb719d2e63e

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Thu, 16 May 2019 02:05:44 GMT
x-msedge-ref: Ref A: 6F9604A88BC34843B779D22BFFE1E0F1 Ref B: VIEEDGE0717 Ref C: 2019-05-22T11:43:50Z
access-control-allow-origin: *
etag: "08c95de8bbd51:0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7091

GET
H2

200

activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-...
5427711.fls.doubleclick.net/ Frame 624C
Redirect Chain

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watc...
https://5427711.fls.doubleclick.net/activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-sec...

0
0

75ms
75ms

Document
text/html

172.217.18.102

General

Check archive.org

Show headers Download Go to

Full URL

https://5427711.fls.doubleclick.net/activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (,),

Reverse DNS

fra16s42-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5427711.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Wed, 22 May 2019 11:43:53 GMT
expires: Wed, 22 May 2019 11:43:53 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 398
x-xss-protection: 0
set-cookie: IDE=AHWqTUlC3P2zzRIeWm2fFNIdXvBw4l0oxsQZKX-llfGQKXjHZ7EoKE-qm0Zy4YhY; expires=Mon, 15-Jun-2020 11:43:53 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Wed, 22 May 2019 11:43:53 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5427711.fls.doubleclick.net/activityi;dc_pre=CMra89aHr-ICFUyWdwoduukAtw;src=5427711;type=remar0;cat=allsi0;ord=1;num=1487413188272;gtm=2wg5f2;auiddc=514505974.1558525431;u1=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F;~oref=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 22-May-2019 11:58:53 GMT; path=/; domain=.doubleclick.net
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"

GET
H2 200 lodash.min.js Show response
cdnjs.cloudflare.com/ajax/libs/lodash.js/3.10.0/ Frame 1DA3 49 KB
18 KB 14ms
14ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/lodash.js/3.10.0/lodash.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

25d64b1ec0b422a5df19046e3a6ef88021138da8c3b97bcad56fb687e212e906

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:21:07 GMT
server: cloudflare
etag: W/"5afd4983-c585"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e59b7c6371-FRA
served-in-seconds: 0.002

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 1DA3 84 KB
29 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Tue, 26 Mar 2019 14:47:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4913772
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 30028
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Mar 2020 14:47:38 GMT

GET
H2 200 URI.js Show response
cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/ Frame 1DA3 60 KB
14 KB 17ms
16ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/URI.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

d72cab5ad74eefe257f40e8fb9e853ce725a9df15d88b18b6c800b688a2594b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:15:13 GMT
server: cloudflare
etag: W/"5afd4821-f090"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e5cb936371-FRA
served-in-seconds: 0.022

GET
H2 200 most.min.js Show response
cdnjs.cloudflare.com/ajax/libs/most/0.15.0/ Frame 1DA3 54 KB
13 KB 17ms
13ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/most/0.15.0/most.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

183411d5757492ee3db1cd81aba05179ebfc46db07a386173cfee38e5976b4c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:23:08 GMT
server: cloudflare
etag: W/"5afd49fc-d831"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e62bde6371-FRA
served-in-seconds: 0.045

GET
H2 200 punycode.min.js Show response
cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/ Frame 1DA3 5 KB
2 KB 13ms
12ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/punycode.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

e91abb0ce65f0e7147f9e19cbcfd60684b45efa4c05a09bab293fc29d74e136f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:15:13 GMT
server: cloudflare
etag: W/"5afd4821-132c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e63be66371-FRA
served-in-seconds: 0.016

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/155/ 9 KB
5 KB 15ms
14ms Script
application/x-javascript 23.43.119.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/155/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.43.119.71 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-119-71.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Nov 2018 03:18:20 GMT
Server: Apache
ETag: "c67dad42946949112916578f78706df8:1543547900"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3923
Expires: Fri, 30 Aug 2019 11:43:50 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
109 B 6ms
5ms Image
image/gif 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j75&a=1978697389&t=pageview&_s=1&dl=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&ul=en-us&de=UTF-8&dt=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBACAIrB~&cid=1107933475.1558525431&tid=UA-44592531-1&_gid=94573849.1558525431&cd15=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&z=654628381

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Mar 2019 00:11:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6435166
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 IPv6.min.js Show response
cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/ Frame 1DA3 2 KB
672 B 11ms
11ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/IPv6.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

328fc05d7dbda6dd1dcb8c1dbb804f257816ab6d90ebeb49c77a0fed430be74b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:15:13 GMT
server: cloudflare
etag: W/"5afd4821-6e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e65bfc6371-FRA
served-in-seconds: 0.001

GET
H2 200 SecondLevelDomains.min.js Show response
cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/ Frame 1DA3 9 KB
3 KB 15ms
14ms Script
application/javascript 2606:4700::6813:c797

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/URI.js/1.17.0/SecondLevelDomains.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c797 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

c9bc17693fc9798e1f7221f080f6c1925e4e5cec29f2423a7d60a0f8731c170d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:15:13 GMT
server: cloudflare
etag: W/"5afd4821-2265"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Mon, 11 May 2020 11:43:50 GMT
cache-control: public, max-age=30672000
cf-ray: 4dae88e66c036371-FRA
served-in-seconds: 0.091

GET
H2 204 0
bat.bing.com/action/ 0
148 B 47ms
47ms Image
text/plain 2620:1ec:c11::200

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26044208&Ver=2&mid=82f1630c-7ec0-5e54-23fe-ac081a730835&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&p=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&r=&lt=1629&evt=pageLoad&msclkid=N&rn=530660
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (,),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 22 May 2019 11:43:50 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: F307CAEAB28A42F4BC5541B6B37002E2 Ref B: VIEEDGE0717 Ref C: 2019-05-22T11:43:50Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.694ea7181ea49f1ce306dfc00c532f53.css
c.disquscdn.com/next/embed/styles/ 104 KB
19 KB 73ms
20ms Stylesheet
text/css 2606:4700::6810:4ea6

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.694ea7181ea49f1ce306dfc00c532f53.css

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4ea6 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

b73336a70c8e2b73cd8e349c54db26910f6f1c51be47806790252b72587ebf24

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 4dae88e69e62c2a4-FRA
status: 200
vary: Accept-Encoding
content-length: 19687
x-xss-protection: 1; mode=block
last-modified: Tue, 09 Apr 2019 22:19:57 GMT
server: cloudflare
etag: "5cad1a8d-4ce7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=300; includeSubdomains
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Apr 2020 22:26:48 GMT

GET
H2 200 common.bundle.2b6bb3725200b8d992a8cb9c288952d3.js Show response
c.disquscdn.com/next/embed/ 243 KB
82 KB 66ms
13ms Script
application/javascript 2606:4700::6810:4ea6

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.2b6bb3725200b8d992a8cb9c288952d3.js

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4ea6 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

e73035342ef69a696cf2e1ddda0c23b03e39d415307cfed23c75e8899e38f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 4dae88e69e64c2a4-FRA
status: 200
vary: Accept-Encoding
content-length: 82964
x-xss-protection: 1; mode=block
last-modified: Fri, 12 Apr 2019 18:37:48 GMT
server: cloudflare
etag: "5cb0dafc-14414"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=300; includeSubdomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Apr 2020 19:58:23 GMT

GET
H2 200 lounge.bundle.144df675dd33e3a8ad22b46d13bc744d.js Show response
c.disquscdn.com/next/embed/ 392 KB
101 KB 72ms
20ms Script
application/javascript 2606:4700::6810:4ea6

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.144df675dd33e3a8ad22b46d13bc744d.js

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4ea6 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

d96a14a4ac86fb04c9a9530a4cddf77f961d08a742275995e31db8b3090eac2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 4dae88e69e65c2a4-FRA
status: 200
vary: Accept-Encoding
content-length: 102984
x-xss-protection: 1; mode=block
last-modified: Mon, 20 May 2019 17:56:06 GMT
server: cloudflare
etag: "5ce2ea36-19248"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=300; includeSubdomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 May 2020 18:41:04 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ 5 KB
3 KB 54ms
12ms Script
application/javascript 151.101.0.134

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (,),

Reverse DNS

Software

nginx /

Resource Hash

df9af0058eba8186f0ee62a6b68beb2a14a6d3df98309e3a68dadd75d52725c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 22 May 2019 11:43:50 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 14
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Length: 2098
X-XSS-Protection: 1; mode=block
Server: nginx
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Timing-Allow-Origin: *

GET
H/1.1 200
OK visitWebPage Show response
945-cxd-062.mktoresp.com/webevents/ 2 B
272 B 559ms
96ms XHR
text/plain 192.28.144.124

General

Check archive.org

Show headers Download Go to

Full URL: https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1558525430802&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1558525430801-85039&_mchHo=blog.trendmicro.com&_mchPo=&_mchRu=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/155/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN53580 (,),
Reverse DNS
Software: spray-can/1.3.3 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 22 May 2019 11:43:51 GMT
Content-Encoding: gzip
Server: spray-can/1.3.3
Content-Length: 22
X-Request-Id: 8bfdf2d2-b488-4af7-a40b-0e4636be1319
Content-Type: text/plain; charset=UTF-8

GET
H2 200 pageview.gif Show response
analytics.shareaholic.com/dough/1.0/ Frame 1DA3 43 B
541 B 354ms
108ms XHR
image/gif 18.204.161.88

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/dough/1.0/pageview.gif?id_sync=9ebe22ca-58bf-4fb9-8354-f338b5ce8a83&referrer=&canon=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&cl=en-US&site=f9f1a771608a24e84c49a8532e282dc1

Requested by

Host: cdn.ravenjs.com
URL: https://cdn.ravenjs.com/3.26.4/raven.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.204.161.88 Ashburn, United States, ASN14618 (,),

Reverse DNS

ec2-18-204-161-88.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Accept: */*
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
x-client-geo-location: DE,Berlin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
status: 200
content-length: 43
pragma: no-cache
x-client-geo-region: Land Berlin
vary: Origin
content-type: image/gif
access-control-allow-origin: https://blog.trendmicro.com
access-control-expose-headers: X-Client-Geo-Location,X-Client-Geo-Region,X-Client-Geo-LatLong,X-Client-Auth
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
x-client-geo-latlong: 52.5196,13.4069
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame BBB6 0
0 18ms
15ms Document
text/html 151.101.0.134

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=trendlabs&t_i=84881%20https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2F%3Fp%3D84881&t_u=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&t_e=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam&t_d=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&t_t=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam&s_o=default

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (,),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Response headers

Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Mon, 20 May 2019 12:29:19 GMT
ETag: W/"lounge:view:7428853936.3e87b152a95ea5bb4674753302e1f344.2"
Content-Encoding: gzip
Content-Length: 2632
Date: Wed, 22 May 2019 11:43:50 GMT
Age: 2
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1015287688/ 2 KB
1 KB 30ms
28ms Script
text/javascript 172.217.16.130

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1015287688/?random=1558525430939&cv=9&fst=1558525430939&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (,),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

41413361b1b026d58525f4a1cf88407b50f9364bcd952ebd33f91d41196673a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 1109
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 app.js Show response
k4z6w9b5.stackpathcdn.com/v2/01e18b43/apps/sharebuttons/ Frame 1DA3 325 KB
49 KB 30ms
29ms Script
application/javascript 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/apps/sharebuttons/app.js
Requested by: Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: 8bdadaa7142416c019e9965b80bf147bcb56a00f965de4bd3a93e2580224abed

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Fri, 17 May 2019 19:30:23 GMT
server: nginx
x-amz-request-id: 38FD26230A26C0CE
etag: "a4a81b5d659ea6566ac37f56eee88f6f"
x-hw: 1558525430.cds067.lo4.hn,1558525430.cds071.lo4.c
content-type: application/javascript
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50319
x-amz-id-2: dHql4wuby4CcGH55cWcNi1cyQlzLCpwz5TT0kLlTgEbdJnzxQQw1HBENzBAF+aaARXOoDaRUfW0=

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 112ms
31ms Script
text/javascript 2606:4700::6810:a10d

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (,),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c3496e95a0c394198375135626e6e0401eab395e1107908eba6c2bf870fb957

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 1F1C617895FEC1B8
status: 200
content-length: 27394
x-amz-id-2: 93HENC6dwqD2e5vfB/IPkiLSlITy4wPAFRLPmpxpKyf0hxm8TeDADKvuL0E24mGeMpVcfkMqEcA=
last-modified: Tue, 21 May 2019 15:21:30 GMT
server: cloudflare
etag: "84ed9469d26699da63d9f58b4d0490ba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1800
accept-ranges: bytes
cf-ray: 4dae88e809c997fc-FRA
expires: Wed, 22 May 2019 12:13:51 GMT

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 350ms
102ms Script
application/javascript 107.20.147.136

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&canonical=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&cl=en-US&id_sync=9ebe22ca-58bf-4fb9-8354-f338b5ce8a83&site=f9f1a771608a24e84c49a8532e282dc1
Requested by: Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.20.147.136 Ashburn, United States, ASN14618 (,),
Reverse DNS: ec2-107-20-147-136.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:51 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 initial.js Show response
k4z6w9b5.stackpathcdn.com/v2/01e18b43/apps/adminbadge/ Frame 1DA3 28 KB
7 KB 29ms
25ms Script
application/javascript 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/apps/adminbadge/initial.js
Requested by: Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: a35277cb0b11d31ef55e62e20debbd1ccea124cadbca7aa2306a419c8445497d

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:50 GMT
content-encoding: gzip
last-modified: Fri, 17 May 2019 19:30:22 GMT
server: nginx
x-amz-request-id: 55D5942B045F136C
etag: "c064f0c53d4f3d98af6c250308faa6cc"
x-hw: 1558525430.cds067.lo4.hn,1558525430.cds098.lo4.c
content-type: application/javascript
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6514
x-amz-id-2: 5S65Tu8aSUj1dUc9r87pw4uetvZYSb7/ROyD05B4uh37hEK3qrnYr2RHRK+Bh4O4WNM293h2dKE=

GET
H2

200

/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1...
https://www.google.com/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=120...
https://www.google.de/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200...

42 B
109 B

20ms
19ms

Image
image/gif

2a00:1450:4001:808::2003

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&cdct=2&is_vtc=1&ocp_id=9jXlXO7BOsbi3wPQpamACA&random=841703132&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:51 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/1015287688/?random=1127405055&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/&tiba=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&gtd=&cdct=2&is_vtc=1&ocp_id=9jXlXO7BOsbi3wPQpamACA&random=841703132&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 angular.min.js Show response
ajax.googleapis.com/ajax/libs/angularjs/1.3.5/ Frame 1DA3 122 KB
45 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:814::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/angularjs/1.3.5/angular.min.js

Requested by

Host: k4z6w9b5.stackpathcdn.com
URL: https://k4z6w9b5.stackpathcdn.com/v2/01e18b43/shrMain.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

1b733be3b94a8ec2ff6bbd1e19f511b8a57f0a1f00f047528dc0ebc44d36b665

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 09 May 2019 13:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1115427
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 46024
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 May 2020 13:53:24 GMT

GET
H2 200 logo.svg
k4z6w9b5.stackpathcdn.com/v2/images_2054976d/badge/ 743 B
601 B 25ms
25ms Image
image/svg+xml 151.139.128.10

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/images_2054976d/badge/logo.svg
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: 90fadc153cb3202eb4e63fa7f561f19d28ba6b66e1a91a57813c66c3032d54d9

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
content-encoding: gzip
last-modified: Fri, 03 May 2019 21:54:28 GMT
server: nginx
x-amz-request-id: 6F571026F94B644D
etag: "83eda2388bc041d5d753201754724793"
x-hw: 1558525431.cds067.lo4.hn,1558525431.cds041.lo4.c
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 360
x-amz-id-2: Y99HFFOfQo7VwL95FBInHPxNWYrWdSaM/rcJGIvExwVfFC5aD2gnW2OEO0BZmvfQLxOKEQI7PTE=

GET
DATA 200
OK truncated
/ 492 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4299f2aaa46eea61cff7da0f945e26cf0ace8a35ea912182e7df2a9958db8e10

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 shareaholic-icons.woff
k4z6w9b5.stackpathcdn.com/v2/fonts_2054976d/ 20 KB
20 KB 16ms
16ms Font
application/font-woff 151.139.128.10

General

Check archive.org

Show headers Download Go to

Full URL: https://k4z6w9b5.stackpathcdn.com/v2/fonts_2054976d/shareaholic-icons.woff
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (,),
Reverse DNS
Software: nginx /
Resource Hash: 21e444926ee2b1297a9888fe081f196a640763626243aa07b80ff171049e7a8c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
content-encoding: gzip
last-modified: Fri, 03 May 2019 21:54:28 GMT
server: nginx
x-amz-request-id: 11C95A574AE8F65E
etag: "0e26e8e2b7a79ff2a9e9fe9ef5382e6d"
x-hw: 1558525431.cds111.fr8.hn,1558525431.cds025.fr8.c
content-type: application/font-woff
status: 200
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20572
x-amz-id-2: 4BzOEhtOkgT7xosbITTh/ex7ZIUrQo5gbpf8zK3aQUPDkU47x0FMtadc/ZhM2YbdzYb+/W8QNX8=

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
263 B 24ms
24ms Image
image/gif 2606:4700::6810:a10d

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=9.621185525047133
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (,),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
cf-cache-status: HIT
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
x-amz-request-id: FC48266EBFBBED1E
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 4dae88e90b5f97fc-FRA
content-length: 43
x-amz-id-2: ZYt0XCJT7TDkEZxleonR2vevsXdGlubVX+eAuuuJz1VDiWmEkPWx+T5VJrqeKqvnN7PBuAS9jqI=

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
102 B 25ms
24ms Image
image/gif 2606:4700::6810:a10d

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=9.621185525047133
Requested by: Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (,),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:51 GMT
cf-cache-status: HIT
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
x-amz-request-id: FC48266EBFBBED1E
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
cf-ray: 4dae88e90b6097fc-FRA
content-length: 43
x-amz-id-2: ZYt0XCJT7TDkEZxleonR2vevsXdGlubVX+eAuuuJz1VDiWmEkPWx+T5VJrqeKqvnN7PBuAS9jqI=

GET
H2 200 / Show response
graph.facebook.com/ Frame 1DA3 280 B
633 B 284ms
251ms Script
text/javascript 2a03:2880:f006:15:face:b00c:0:2

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?fields=og_object%7Bengagement%7Bcount%7D%7D&id=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&callback=jQuery22401413193435930078_1558525430695&_=1558525430696

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f006:15:face:b00c:0:2 , Ireland, ASN32934 (,),

Reverse DNS

Software

Resource Hash

faa5fe28bc25eb08c1ff87ae1912d8c958cff224ce965990dd407d535214be02

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
date: Wed, 22 May 2019 11:43:51 GMT
x-fb-rev: 1000741482
content-length: 188
pragma: no-cache
x-fb-debug: rnZpnfoOiVe7Nk8YNLo5cSafU/zwoZ2gWiodULPpN8M/npOTEQA25e0rmkM2o8rSJHER2bbMPlZ61zFModNTmw==
x-fb-trace-id: Bjqb+6tcTR+
etag: "0333c7f75ef7ae9e3dc5d039795791fe991a30a6"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AlDiiQEZP91tiGvOKv0XXbV
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.9
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81f::2003

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C700italic%2C400%2C700&ver=2.3.1
Origin: https://blog.trendmicro.com

Response headers

date: Mon, 25 Mar 2019 20:19:33 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:10:29 GMT
server: sffe
age: 4980258
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9132
x-xss-protection: 1; mode=block
expires: Tue, 24 Mar 2020 20:19:33 GMT

POST
H/1.1 200
OK ping Show response
api.viglink.com/api/ 212 B
898 B 157ms
44ms XHR
text/javascript 54.154.175.204

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/ping
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.175.204 Dublin, Ireland, ASN16509 (,),
Reverse DNS: ec2-54-154-175-204.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 43596646a6c8d3d9e09caa68bc9dadb8f10888b89ce289b711c4e8cfaad1e7ba

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Wed, 22 May 2019 11:43:51 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://blog.trendmicro.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 212
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 143 B
595 B 44ms
44ms XHR
text/javascript 54.154.175.204

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.175.204 Dublin, Ireland, ASN16509 (,),
Reverse DNS: ec2-54-154-175-204.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 7f305ed85224314c27106393de295e0bd7b92a96a01b440df179fe26f527264d

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
Origin: https://blog.trendmicro.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Wed, 22 May 2019 11:43:50 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://blog.trendmicro.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 143
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
486 B 200ms
138ms Image
image/gif 104.244.42.197

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: blog.trendmicro.com
URL: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (,),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 111
pragma: no-cache
last-modified: Wed, 22 May 2019 11:43:53 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 9a67bcada320fd4fc981d28b4d8b7066
x-transaction: 00164cef00e903a2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2

200

/ Show response
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=...
https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1558525434076%26pid%3D8866%26url%3Dhttps%253A%252F%252Fblog.trendmicro.com%252Ftrendlabs-securit...
https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=...

0
88 B

174ms
174ms

Script
application/javascript

2a05:f500:11:101::b93f:9005

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (,),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:54 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 20
x-li-uuid: uZAoJqH+oBXAiF08TisAAA==

Redirect headers

date: Wed, 22 May 2019 11:43:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
x-li-pop: prod-efr5
content-length: 20
x-li-uuid: i6fGBo/+oBUALxmRQisAAA==
pragma: no-cache
server: Play
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect/?time=1558525434076&pid=8866&url=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
495 B 148ms
147ms Script
application/javascript 104.244.42.195

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (,),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 120
pragma: no-cache
last-modified: Wed, 22 May 2019 11:43:54 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 477e817abcc1e4c820e194e2e1f64dfe
x-transaction: 00c35560002dd971
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T8DW3SL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

7dff09578729615fcd15c840a32c9f82a33fe2331a851e4ac40be03cb111b3f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 May 2019 01:33:03 GMT
server: Golfe2
age: 7018
date: Wed, 22 May 2019 09:46:56 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17779
expires: Wed, 22 May 2019 11:46:56 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
110 B 16ms
14ms Image
image/gif 2a00:1450:4001:817::200e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j75&a=1978697389&t=event&ni=1&_s=1&dl=https%3A%2F%2Fblog.trendmicro.com%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&ul=en-us&de=UTF-8&dt=Trickbot%20Watch%3A%20Arrival%20via%20Redirection%20URL%20in%20Spam%20-%20TrendLabs%20Security%20Intelligence%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Tracking&ea=%2Ftrendlabs-security-intelligence%2Ftrickbot-watch-arrival-via-redirection-url-in-spam%2F&el=10%25%20Scroll&ev=0&_u=aGHACEIrB~&jid=2090387456&gjid=1891111231&cid=1107933475.1558525431&tid=UA-137644-6&_gid=94573849.1558525431&_r=1&gtm=2wg5f2T8DW3SL&z=17086375

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (,),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 May 2019 11:43:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 1843 337 B
388 B 13ms
11ms Stylesheet
text/css 2606:4700::6810:4ea6

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4ea6 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 4dae89002fa7c2a4-FRA
status: 200
vary: Accept-Encoding
content-length: 244
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Dec 2018 19:32:13 GMT
server: cloudflare
etag: "5c2528bd-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=300; includeSubdomains
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Jan 2020 01:16:35 GMT

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame AFC1 337 B
308 B 19ms
19ms Stylesheet
text/css 2606:4700::6810:4ea6

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: trendlabs.disqus.com
URL: https://trendlabs.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:4ea6 , United States, ASN13335 (,),

Reverse DNS

Software

cloudflare /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-watch-arrival-via-redirection-url-in-spam/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 22 May 2019 11:43:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 4dae89003faec2a4-FRA
status: 200
vary: Accept-Encoding
content-length: 244
x-xss-protection: 1; mode=block
last-modified: Thu, 27 Dec 2018 19:32:13 GMT
server: cloudflare
etag: "5c2528bd-f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=300; includeSubdomains
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Jan 2020 01:16:35 GMT

Verdicts & Comments Add Verdict or Comment

483 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 10:17:01	Name: IDE Value: AHWqTUlC3P2zzRIeWm2fFNIdXvBw4l0oxsQZKX-llfGQKXjHZ7EoKE-qm0Zy4YhY
.blog.trendmicro.com/	1970-01-19 00:56:51	Name: _gid Value: GA1.3.94573849.1558525431
blog.trendmicro.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: t778hl0gaauhis6o5defa716d7
.trendmicro.com/	1970-01-19 03:19:25	Name: _vis_opt_s Value: 1%7C
.trendmicro.com/	1970-01-19 18:26:37	Name: _mkto_trk Value: id:945-CXD-062&token:_mch-trendmicro.com-1558525430801-85039
.trendmicro.com/	1970-01-19 00:56:51	Name: _gid Value: GA1.2.94573849.1558525431
.blog.trendmicro.com/	1970-01-19 18:26:37	Name: _ga Value: GA1.3.1107933475.1558525431
.trendmicro.com/	1970-01-19 18:26:37	Name: _ga Value: GA1.2.1107933475.1558525431
blog.trendmicro.com/	1969-12-31 23:59:59	Name: CMAVID Value: none
.trendmicro.com/	1970-01-19 03:05:01	Name: _vwo_ds Value: 3%3Aa_0%2Ct_0%3A0%241558525429%3A24.55639093%3A%3A%3A95_0%2C69_0
.trendmicro.com/	1970-01-19 03:05:01	Name: _gcl_au Value: 1.1.514505974.1558525431
.trendmicro.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.trendmicro.com/	1970-01-22 16:31:25	Name: _vwo_uuid Value: D68EB8C7736162AFDAF5B9D4861EFE697

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 23) Message: JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api	warning	URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45) Message: JQMIGRATE: jQuery.browser is deprecated
console-api	log	URL: https://blog.trendmicro.com/trendlabs-security-intelligence/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47) Message: console.trace

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
945-cxd-062.mktoresp.com
ajax.googleapis.com
analytics.shareaholic.com
analytics.trendmicro.com
analytics.twitter.com
api.viglink.com
bat.bing.com
blog.trendmicro.com
c.disquscdn.com
cdn.ravenjs.com
cdn.shareaholic.net
cdn.viglink.com
cdnjs.cloudflare.com
data.cmcore.com
dev.visualwebsiteoptimizer.com
disqus.com
documents.trendmicro.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
k4z6w9b5.stackpathcdn.com
libs.coremetrics.com
munchkin.marketo.net
partner.shareaholic.com
px.ads.linkedin.com
resources.trendmicro.com
s.ytimg.com
sjs.bizographics.com
ssl.google-analytics.com
static.ads-twitter.com
t.co
tags.tiqcdn.com
trendlabs.disqus.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.shareaholic.net
www.trendmicro.com
www.youtube.com
104.109.56.169
104.244.42.195
104.244.42.197
107.20.147.136
107.23.133.35
129.33.139.56
150.70.178.131
151.101.0.134
151.101.36.134
151.101.36.157
151.139.128.10
159.122.87.148
159.122.87.153
172.217.16.130
172.217.18.102
18.204.161.88
184.31.90.101
192.28.144.124
199.15.212.64
199.255.34.6
23.43.119.71
2606:4700::6810:4ea6
2606:4700::6810:a10d
2606:4700::6813:c797
2620:1ec:c11::200
2a00:1450:4001:808::2002
2a00:1450:4001:808::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:814::200a
2a00:1450:4001:817::200e
2a00:1450:4001:81b::200e
2a00:1450:4001:81e::2008
2a00:1450:4001:81f::2003
2a00:1450:4001:820::2004
2a00:1450:4001:824::200a
2a02:26f0:6c00:18c::3adf
2a03:2880:f006:15:face:b00c:0:2
2a04:4e42:200::729
2a05:f500:10:101::b93f:9101
2a05:f500:11:101::b93f:9005
54.154.175.204
68.232.35.180
005929580da46135c58cae0cbfcccd17e510aac10a27a3e674fb85ae4bee95c0
02c12028c90522c06327c224fefc978df14d510bf337adeb97eb1fb719d2e63e
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0819ab8b8211e99514e2b34bab24ae6d718e9f3d9ff3f7eae19380d293c77cc6
08f91baa9280e9a089f3e8b1dae667c4d69cc8268c59105e324847402332e4fd
09f9269176e86a07cd9f52f45c0d75cdf6b02180c71bcb1bb2c01ee33a0c3bd7
0c565577941b3ab40a246b32517e8edced36c7d480d65bd9b1299e7c01fc2176
0c6ef976b32b0f9158ce1211ed5d75bc3197e5a1802a70749e186fba11b78498
1210b2986220f5f6e6f416d87911e6655eed292f81a8219d8506f57c5d4353a3
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
17dbeff08f1c2770ec37f9edf909627395215a93ac4d8c0307eaac9a4cab49b8
183411d5757492ee3db1cd81aba05179ebfc46db07a386173cfee38e5976b4c3
18a5b957a8ccd83f466eb7dde5fc616bb00c0be8b660f4c729c3dd41e1e8249a
196b0d1013a5fb1985890e13453ab76df8bdcee3d57893e84afa3f3e58eacf52
1b6a8ba260c8eb344ad40fadccadc8dd6752ed67318153676309febd6d83eb34
1b733be3b94a8ec2ff6bbd1e19f511b8a57f0a1f00f047528dc0ebc44d36b665
1bc4f47bd64d3c1a5f131b2241ac870c4a497a59237b3187d35eeff93ccba167
1ceee93d453a2a67bc5e577ac2ea72599d505129a5b938663fd5f5e55a7a663e
1fa0c6a60241076bfa896030442753f3880bf99ba73ddb6eb24dccad0bfc075c
21e444926ee2b1297a9888fe081f196a640763626243aa07b80ff171049e7a8c
238b3b15fd1f306b170ab1b3af0c3e051f68642d487454544505d9c49d3f93bf
24032278443d32d5b7403fe65a5b5b9b26fd298f58b452ea5aa293bedf307ae0
25d64b1ec0b422a5df19046e3a6ef88021138da8c3b97bcad56fb687e212e906
2cc892aff2bd38e775ab3dbf8f6e197a2c46b5989c697172b6046393dc01b17d
2f1ea72b2b51bf4c7a64c95eec7d53291d1f060a175b73a8194d12eac0f0a993
31895b039ea1a0252fda10656dbcef19e8647014d00e77f08e32a9db2abbe832
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
31ca4c789d99d42ac7d3eb051c9693b3078fbc2aa3e3229dd23f0fbf6617413e
328fc05d7dbda6dd1dcb8c1dbb804f257816ab6d90ebeb49c77a0fed430be74b
343c1fe4d71229177aaf3a89b8acdd04db4de680de7ad21ecb1d0b00ed4e6fff
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
38c0f0060861b5f7699b92530d6c3c4182515869fdf09b299e8deb8f57c7fc0d
3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e
41413361b1b026d58525f4a1cf88407b50f9364bcd952ebd33f91d41196673a5
4299f2aaa46eea61cff7da0f945e26cf0ace8a35ea912182e7df2a9958db8e10
43596646a6c8d3d9e09caa68bc9dadb8f10888b89ce289b711c4e8cfaad1e7ba
476a2655428d2b968d291f986787023860b0645b3ab6c4e3b66b445e186b2ca2
49476f91ae0265b8a2db95ab66cf22d5abd7be374f7ec574443867ccab5ff638
4d222f2b485a1155435487dab18769a8de415204728fb7a9da94c3d433461c49
5156869aa1718304e7d1ea483d68d363e739178cb57c5ed9ee60a746e5ab49dd
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5b5d78fe67167cbc3e8f23f5bee2f6637af84751a30473122e20ef4ddc14e2fe
5cb9a44218fdba8ed7dd67d279e1c4744491a18e8479bde0f2e575ca05985bbf
5e62e5f7ea3ee74d6430ce302b0c61d95e93d43a80a449447c64ba791065202c
5f9eba6b4a09e7bbdfb3e9f52cc59625bb0a26854804928ffdf03c5ac2ad7d1b
62d9012a3badacfbf2c47ba8f9e83f5d33b66d05e7b25b54dd60dc07f01a58fb
66561088efad00a5b856bbf459e42544bb596936943fbe3b0f8d7b6718608046
66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76
670d2452df4e20e6a2371d8a48fbe1bde1e4664081f1f20b478095d0b14d8685
6a520a7c96d004ceb260a8692a0c6ca67daf6d3015f9726f81a0efd8d752f60f
6ca28839ba7e005b11dcf8d6de4c24f13f2cc988393ed7a570c41ee88ab092fc
6e4a8bebbc429e5ff771f80299086e45b667ea5bb69f06d31e6b1c0561b836da
721ec8a676333627a985bfa6fb6968d2c097f7922e7f31048118467a77ed91a6
746908a1b935d3ca0005ab17e8504e642f42cf3ce177dac795d898f5637dc0cb
7a3c6d22de397f163b11ae6e13db851b720abb639b0d158e1308a7ef02dfb97d
7bbd355b4ca50ea670a75269add0ab1d071fb030fb26ab868917078535e78c99
7d902673f947b5f070302fb19d049ed9d81694895de23552603e2da56782466b
7dff09578729615fcd15c840a32c9f82a33fe2331a851e4ac40be03cb111b3f0
7f305ed85224314c27106393de295e0bd7b92a96a01b440df179fe26f527264d
7f5d20386c62bc7957520cfe679927bf480d6ca275e7d1b05f08994bca59b6ac
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2
86321c43556c304568daf15b1660cc91f90db686ee291c5f5da81522cd809ff1
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8afe2513e82340e2b7a1640928467e4114e26f40e8aed1c889432a9b99f25596
8bdadaa7142416c019e9965b80bf147bcb56a00f965de4bd3a93e2580224abed
90b34033918608d698be777640ea1c2a7e33e64229e10ae75cde40b8f4ac1ded
90ce2e62e6733486cafcf39e399da0a91bc36f9ad180043e270737eb0b3ff0a2
90fadc153cb3202eb4e63fa7f561f19d28ba6b66e1a91a57813c66c3032d54d9
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
951c201eceb26489dc9b4cc8ea4e408ae957410ea32b0fc7d4845d851886739f
9609588bc37c441a77b4a59833d9356028c573f4b26615a64f5143e4a197939b
96543b22a94e2ad5bcc8f7c80665280ec6dfcddef0d839bb69d73674468b4459
9c3496e95a0c394198375135626e6e0401eab395e1107908eba6c2bf870fb957
9ea952c31d6d8c4c58481c338636f2424ee8ba8dfb6289645c0f1a3b2673698e
9fd7bfa229eec86e2b02fdcf85e49e5b2699a2d9cd53ee36b4df53513d1da1f3
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1e2acedcc157bed6106061b1177d4de9102e7cb711fd74df49be5df56caecd2
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a35277cb0b11d31ef55e62e20debbd1ccea124cadbca7aa2306a419c8445497d
a9667d16d28f3a6a1b777fbdc7775a0ea43cfd5da93cfac4c948a240a398656f
aa05b14bf4b4344109b83cb7e5d26a20591c298ded57d8168911f820bd2ec8fc
aa16d08aa19b9af5effe3381d0ba38f1a675c362bd62b2db8d012d35e3db3510
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b4c068f566d4557dac74a849284e07c1da7fb80e8a23812f99016eb1aee15186
b568b1f531806b127ff051bc59e3675d9ca4c16c979107266cf505390c36dba5
b661ad65228149bf1c614c44313818e661b4a7a1935f164bdd53ded0f37184cf
b73336a70c8e2b73cd8e349c54db26910f6f1c51be47806790252b72587ebf24
bb15e076783b6ba0f44ce382e8a5a06775cb11f2f3f84f5067f3567188016c61
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
be23dbb4ef534fb2fbdf640c70e9ebce16ddd32eff4235784b99bbed85696cf6
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
bf724439f2f8fd287feb12f58c2e382886601ae7ace43215778dfd3d75435210
c005667a560305e72f76e6464a0cd95c7dbe9a35da6cffebe3617fbd1496faf7
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0
c1727d32d1dc3fbfe9430f8b35fb0011639a9aff2a188f336676c131b5476808
c24b44e8c7234bd170abd96909ce1668bb22d31635b8c99aeedaacf958969c76
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c50d0c28e2a468835879ee766fb71c9e505225351cc258991c7adbf1ba3909d2
c9bc17693fc9798e1f7221f080f6c1925e4e5cec29f2423a7d60a0f8731c170d
cbe28e356d931c5c33bdfd7d9eeb612eb4b372a9497fcf2edd3900d1d40dd687
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cebf053025b29c7ec4b3d6ef4e032f805b317cf4d023fc4a721f3042bcfdec36
cf89f407e2db31d4f94b32bc3819bd2481bcdf2d75eaed98d4a79277b650d3ea
d1014dd86ebf5e5b98a0fdee2ff1a8cb6c30c2a4c2bfd3bc15b0aaa3a8dd93c2
d11075cd7df2682b221d194573250d4aed0a6a4e3a151acf41d1b14053495b85
d12571fb058caba3e2478b76fc95d3f65741995d085ef27e29434b6e6d67791c
d1695d8985b2411104b59085fcf35de39255e29ea68064e26bd3fb67116bbe42
d2bc9c513d50deb617981195a91d357c004688ae7a90962da29814385e168dea
d2e8734e842f89489fa5bece0e3f613ba1c16ba2f12607a3cc0c38ff43413639
d56485dbbc5b55b37f96b65ac0d5245e77cf51c094d827348f2243948f2feeca
d72cab5ad74eefe257f40e8fb9e853ce725a9df15d88b18b6c800b688a2594b8
d75d435caa401bff1ed2977371b022560a2539167638d4db6ae9dfb49c9a6924
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d96a14a4ac86fb04c9a9530a4cddf77f961d08a742275995e31db8b3090eac2e
db3e8095381fb06bb6455b36c78beb4c8f1f6e3c2ef1483f97a8ec151704e6c6
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df9af0058eba8186f0ee62a6b68beb2a14a6d3df98309e3a68dadd75d52725c6
e3ac5c56d0c3a6005ee7a9226a3470acd9acbfa64244cddabb899140c8a8f5d4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e73035342ef69a696cf2e1ddda0c23b03e39d415307cfed23c75e8899e38f4be
e91abb0ce65f0e7147f9e19cbcfd60684b45efa4c05a09bab293fc29d74e136f
ec8ada9c249466cc83ead6cfea75ba0851281bb5a850b2009034d993e6449715
ed6a7c7c15db91f2b6ffbaec4ccb7be48bd7853833e3e3e642ccf701fa90f3de
ed8103aa39e3d6156b0fca9caf6fc88473686048f495b08df443a5995e4c33fb
ee290666f02ac90c3e4bb57b767b7a32149599fa59ad1b8120208b74e79237ac
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f368605bd5e23568ed3e0568d70b9b1d039b82059e5e199335d059c4e400bee4
f42551c6cb1f3a2597f99bdb1b458a5224c04d14de425efc4c1f543bbc1a2570
f86c6e1eb69358e8f766ad580b840d7071ab691e2bb3baf4953f4e49e71ff913
fa055f2f7c5b735dbbb71954f434aed79925bc00ff2ffbc3ecfc4a790689a723
faa5fe28bc25eb08c1ff87ae1912d8c958cff224ce965990dd407d535214be02

blog.trendmicro.com Open in urlscan Pro 104.109.56.169 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

149 Requests

99 %HTTPS

47 %IPv6

32 Domains

44 Subdomains

41 IPs

6 Countries

1849 kBTransfer

5129 kBSize

13 Cookies

41 Outgoing links

Redirected requests

149 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.trendmicro.com Open in urlscan Pro
104.109.56.169 Public Scan

Screenshot
Live screenshot

Full Image

149
Requests

99 %
HTTPS

47 %
IPv6

32
Domains

44
Subdomains

41
IPs

6
Countries

1849 kB
Transfer

5129 kB
Size

13
Cookies

149 HTTP transactions
1 data transactions