URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Submission: On October 14 via manual from ES — Scanned from ES

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 3.77.129.30, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is auth.iws-hybrid.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1K on August 28th 2024. Valid for: a year.
This is the only time auth.iws-hybrid.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 3.77.129.30 16509 (AMAZON-02)
3 18.239.47.147 16509 (AMAZON-02)
11 2
Domain Requested by
8 auth.iws-hybrid.trendmicro.com auth.iws-hybrid.trendmicro.com
3 d2c7skxakqckd1.cloudfront.net auth.iws-hybrid.trendmicro.com
d2c7skxakqckd1.cloudfront.net
11 2

This site contains no links.

Subject Issuer Validity Valid
*.iws-hybrid.trendmicro.com
Entrust Certification Authority - L1K
2024-08-28 -
2025-09-27
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2024-07-30 -
2025-07-03
a year crt.sh

This page contains 1 frames:

Primary Page: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Frame ID: 91E373E8F6ADBF578561F4EB897171B5
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Trend Micro Web Security

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

88 kB
Transfer

230 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request logon
auth.iws-hybrid.trendmicro.com/
7 KB
2 KB
Document
General
Full URL
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
deaf1219f79cc6d623efe764c5ad63af8d3baab7f81351795de92b7774b71ef9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
TEXT/HTML
Date
Mon, 14 Oct 2024 14:07:02 GMT
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
bootstrap.css
auth.iws-hybrid.trendmicro.com/static/lib/bootstrap/
124 KB
24 KB
Stylesheet
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/lib/bootstrap/bootstrap.css
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
300040ff0171295d23c06bcfdd13c84989f6bffd35a40faaedcb8f600d85ec66

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

Transfer-Encoding
chunked
Content-Encoding
gzip
ETag
W/"62b1feef-1f10f"
Connection
keep-alive
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
text/css
Last-Modified
Tue, 21 Jun 2022 17:25:03 GMT
Server
nginx/1.20.1
bootstrap-responsive.css
auth.iws-hybrid.trendmicro.com/static/lib/bootstrap/
22 KB
5 KB
Stylesheet
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/lib/bootstrap/bootstrap-responsive.css
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
c166c16211466eb989c1eaf1573fa2e727d76ba8dce3be5ef6be2dde152b0819

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

Transfer-Encoding
chunked
Content-Encoding
gzip
ETag
W/"62b1feef-565f"
Connection
keep-alive
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
text/css
Last-Modified
Tue, 21 Jun 2022 17:25:03 GMT
Server
nginx/1.20.1
trend.css
auth.iws-hybrid.trendmicro.com/static/css/
32 KB
8 KB
Stylesheet
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/css/trend.css
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
8feca28e23e76dbc33449a143719ac07fc29366877a0f90ab98f7c31e938bccd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

Transfer-Encoding
chunked
Content-Encoding
gzip
ETag
W/"670ca4bf-8032"
Connection
keep-alive
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
text/css
Last-Modified
Mon, 14 Oct 2024 04:57:35 GMT
Server
nginx/1.20.1
i18n.js
auth.iws-hybrid.trendmicro.com/static/lib/
730 B
983 B
Script
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
ed44e926a8c174c3543529a2a70b02712b7ba46ed50193ccb93433d19fe9072a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

ETag
"62450f2d-2da"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
730
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
application/x-javascript
Last-Modified
Thu, 31 Mar 2022 02:17:17 GMT
Server
nginx/1.20.1
logo.js
auth.iws-hybrid.trendmicro.com/static/lib/
446 B
699 B
Script
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/lib/logo.js
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
fb69657cbf02b9d6e14e01641feffc482822beafe28cf99f93edf3433b1c4f8e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

ETag
"62b1feef-1be"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
446
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
application/x-javascript
Last-Modified
Tue, 21 Jun 2022 17:25:03 GMT
Server
nginx/1.20.1
l10n_support_language.js
d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/
129 B
481 B
Script
General
Full URL
https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/l10n_support_language.js?v=3.0.0.3889
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.47.147 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-47-147.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
71247569319d6b869300665a03ee931a4f96be2aacb9928bd0cce6c3224a67fb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://auth.iws-hybrid.trendmicro.com/

Response headers

etag
"37801f2a645cdbf7a394db9cfbe9d9db"
age
41407
via
1.1 3201e5fb77f9faaa881f4f324226564a.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
129
x-amz-cf-id
AAPWTEBtcAVdchhy2VTrjPYbeTiNZHp1Qz7GtAYmUNShXBZTrl2qWQ==
date
Mon, 14 Oct 2024 02:37:50 GMT
content-type
binary/octet-stream
last-modified
Tue, 13 Aug 2024 07:11:30 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
i18nwithoutjquery.js
d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/
13 KB
13 KB
Script
General
Full URL
https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/i18nwithoutjquery.js?v=3.0.0.3889
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.47.147 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-47-147.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9222797cda3ed74fadffbff536cd752b7ce941b899e46f90c5cadb64a28e6782

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://auth.iws-hybrid.trendmicro.com/

Response headers

etag
"0d5bf66b9b2ba8360c92f38c2eb9078a"
age
22088
via
1.1 3201e5fb77f9faaa881f4f324226564a.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
13328
x-amz-cf-id
0zwRB2qmNZsHF4qjmVkPTzeUJg2vrwTTrEUwF7g0j5jmf-0WlYwWGA==
date
Mon, 14 Oct 2024 08:04:30 GMT
content-type
binary/octet-stream
last-modified
Tue, 13 Aug 2024 07:11:29 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
IWSH-banner.svg
auth.iws-hybrid.trendmicro.com/static/images/
24 KB
24 KB
Image
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/images/IWSH-banner.svg
Requested by
Host: auth.iws-hybrid.trendmicro.com
URL: https://auth.iws-hybrid.trendmicro.com/static/css/trend.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
45e502e1224eda77eae24ac029be1ca8d0865768e077d85a240117fa1511f517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/static/css/trend.css

Response headers

ETag
"670ca719-5e8b"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
24203
Date
Mon, 14 Oct 2024 14:07:02 GMT
Content-Type
image/svg+xml
Last-Modified
Mon, 14 Oct 2024 05:07:37 GMT
Server
nginx/1.20.1
authdaemon.js
d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/L10n/en_US/
2 KB
3 KB
Script
General
Full URL
https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/L10n/en_US/authdaemon.js?v=3.0.0.3889
Requested by
Host: d2c7skxakqckd1.cloudfront.net
URL: https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/i18nwithoutjquery.js?v=3.0.0.3889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.239.47.147 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-239-47-147.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b1a7f3fa74405612a6c579a4b63e64ac00c6f324209b6473c3d9deed61e43af1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://auth.iws-hybrid.trendmicro.com/

Response headers

etag
"e7506536c86bdc5cfcc0b07523aeb0ff"
age
28714
via
1.1 3201e5fb77f9faaa881f4f324226564a.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
2311
x-amz-cf-id
WiLusjd8ILcHb2Te3M9iBuMgtzNZ0JBZe7g__A2EjQ5gth5csHvR2A==
date
Mon, 14 Oct 2024 06:14:29 GMT
content-type
binary/octet-stream
last-modified
Tue, 13 Aug 2024 07:11:28 GMT
server
AmazonS3
x-amz-cf-pop
AMS58-P3
x-amz-server-side-encryption
AES256
favicon.ico
auth.iws-hybrid.trendmicro.com/static/images/ico/
5 KB
6 KB
Other
General
Full URL
https://auth.iws-hybrid.trendmicro.com/static/images/ico/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.77.129.30 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-77-129-30.eu-central-1.compute.amazonaws.com
Software
nginx/1.20.1 /
Resource Hash
10b2aa2d68cf526888ad683fff3a02729b1f59742226118cda964a7e0e55483f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://auth.iws-hybrid.trendmicro.com/logon?url=http%3a%2f%2ftreball.ad%2f

Response headers

ETag
"670ca719-1536"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5430
Date
Mon, 14 Oct 2024 14:07:03 GMT
Content-Type
image/x-icon
Last-Modified
Mon, 14 Oct 2024 05:07:37 GMT
Server
nginx/1.20.1

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| example_input_username function| body_onload function| GetCookieVal function| GetCookie function| getParameter function| button_click function| alert_bar_click string| cdndomain string| admin_protal_global_address string| loadssl object| l10n_supportlanguage object| translate_i18n object| getjson object| load_i18n function| localizePage function| geti18n string| querystring string| searchstr string| version object| i18n string| i18n_value

1 Cookies

Domain/Path Name / Value
auth.iws-hybrid.trendmicro.com/ Name: _xsrf
Value: 38c32cf5f3371d5c3e4abf34e7d00c20dff1fd6d8820b500df5f091d20904885

5 Console Messages

Source Level URL
Text
javascript warning URL: https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js(Line 4)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/l10n_support_language.js?v=3.0.0.3889, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js(Line 4)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/l10n_support_language.js?v=3.0.0.3889, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://auth.iws-hybrid.trendmicro.com/static/lib/i18n.js(Line 5)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/i18nwithoutjquery.js?v=3.0.0.3889, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/i18nwithoutjquery.js?v=3.0.0.3889(Line 347)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/L10n/en_US/authdaemon.js?v=3.0.0.3889, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/common/L10n/i18nwithoutjquery.js?v=3.0.0.3889(Line 347)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://d2c7skxakqckd1.cloudfront.net/3.0.0.3889/javascript/L10n/en_US/authdaemon.js?v=3.0.0.3889, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN