URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Submission: On November 27 via api from TR — Scanned from DE

Summary

This website contacted 59 IPs in 6 countries across 49 domains to perform 314 HTTP transactions. The main IP is 23.197.7.9, located in Düsseldorf, Germany and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on May 20th 2023. Valid for: a year.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
51 23.197.7.9 16625 (AKAMAI-AS)
7 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
25 2600:9000:223... 16509 (AMAZON-02)
11 2a02:26f0:480... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 23.45.238.53 16625 (AKAMAI-AS)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 35.201.125.192 396982 (GOOGLE-CL...)
3 52.19.222.237 16509 (AMAZON-02)
1 34.111.194.12 396982 (GOOGLE-CL...)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
8 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 18.155.158.118 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 185.89.210.101 29990 (ASN-APPNEX)
1 2600:9000:211... 16509 (AMAZON-02)
1 1 3.248.147.241 16509 (AMAZON-02)
2 2620:116:800d... 16509 (AMAZON-02)
2 2.23.65.88 16625 (AKAMAI-AS)
4 2a00:1450:400... 15169 (GOOGLE)
2 142.250.185.130 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
1 104.17.71.206 13335 (CLOUDFLAR...)
1 54.228.115.105 16509 (AMAZON-02)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 2606:4700:440... 13335 (CLOUDFLAR...)
10 95.101.111.184 20940 (AKAMAI-ASN1)
65 18.155.145.87 16509 (AMAZON-02)
1 146.75.116.157 54113 (FASTLY)
1 23.57.31.196 16625 (AKAMAI-AS)
1 13 2400:52e0:1e0... 200325 (BUNNYCDN)
4 18.195.36.121 16509 (AMAZON-02)
32 18.238.243.43 16509 (AMAZON-02)
1 2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 2600:9000:223... 16509 (AMAZON-02)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 104.244.42.69 13414 (TWITTER)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 154.59.122.94 174 (COGENT-174)
1 192.28.144.124 15224 (OMNITURE)
2 52.57.88.70 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
4 34.215.250.209 16509 (AMAZON-02)
1 35.71.131.137 16509 (AMAZON-02)
4 54.147.21.139 14618 (AMAZON-AES)
4 3.224.56.144 14618 (AMAZON-AES)
314 59
Apex Domain
Subdomains
Transfer
65 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5586
759 KB
52 trendmicro.com
www.trendmicro.com
resources.trendmicro.com
5 MB
36 equally.ai
widget.equally.ai — Cisco Umbrella Rank: 150991
api.equally.ai — Cisco Umbrella Rank: 148185
405 KB
25 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1253
87 KB
17 sumome.com
load.sumome.com — Cisco Umbrella Rank: 53708
sumome.com — Cisco Umbrella Rank: 53300
436 KB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5465
c.6sc.co — Cisco Umbrella Rank: 8564
ipv6.6sc.co — Cisco Umbrella Rank: 5738
b.6sc.co — Cisco Umbrella Rank: 3759
22 KB
11 scene7.com
trendmicro.scene7.com
249 KB
8 gstatic.com
fonts.gstatic.com
385 KB
7 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
ssl.google-analytics.com — Cisco Umbrella Rank: 574
region1.google-analytics.com — Cisco Umbrella Rank: 2462
41 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 342
176 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 377
www.linkedin.com — Cisco Umbrella Rank: 629
px4.ads.linkedin.com — Cisco Umbrella Rank: 6003
5 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35
422 KB
4 drift.com
bootstrap.api.drift.com — Cisco Umbrella Rank: 6353
metrics.api.drift.com — Cisco Umbrella Rank: 6159
14 KB
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2977
9 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6862
673 B
3 google.com
www.google.com — Cisco Umbrella Rank: 2
region1.analytics.google.com — Cisco Umbrella Rank: 3040
1 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 24529
ibc-flow.techtarget.com — Cisco Umbrella Rank: 22103
2 KB
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 495
2 KB
3 doubleclick.net
5427711.fls.doubleclick.net Failed
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
9572106.fls.doubleclick.net Failed
stats.g.doubleclick.net — Cisco Umbrella Rank: 78
3 KB
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 228
trendmicro.demdex.net
5 KB
3 youtube.com
www.youtube.com — Cisco Umbrella Rank: 68
69 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9302
649 B
2 t.co
t.co — Cisco Umbrella Rank: 607
606 B
2 acuityplatform.com
origin.acuityplatform.com — Cisco Umbrella Rank: 20245
e.acuityplatform.com — Cisco Umbrella Rank: 18052
3 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
90 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 145
18 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3497
6 KB
2 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1245
pixel.quantserve.com — Cisco Umbrella Rank: 964
9 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1610
insight.adsrvr.org — Cisco Umbrella Rank: 584
3 KB
2 bing.com
bat.bing.com — Cisco Umbrella Rank: 366
13 KB
2 go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1444
c.go-mpulse.net — Cisco Umbrella Rank: 654
50 KB
2 bc0a.com
cdn.bc0a.com — Cisco Umbrella Rank: 13380
ixfd2-api.bc0a.com — Cisco Umbrella Rank: 19901
14 KB
2 cludo.com
customer.cludo.com — Cisco Umbrella Rank: 15352
75 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
3 KB
1 akstat.io
684dd32e.akstat.io — Cisco Umbrella Rank: 73869
204 B
1 mktoresp.com
945-cxd-062.mktoresp.com — Cisco Umbrella Rank: 391442
318 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 110
186 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 778
3 KB
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1212
457 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 713
15 KB
1 xg4ken.com
resources.xg4ken.com — Cisco Umbrella Rank: 6613
4 KB
1 bizographics.com
sjs.bizographics.com — Cisco Umbrella Rank: 34291
4 KB
1 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1275
517 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 18105
236 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 14796
283 B
1 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 466
72 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 590
296 B
1 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 3240
362 B
0 twitter.com Failed
analytics.twitter.com Failed
314 49
Domain Requested by
65 js.driftt.com tags.tiqcdn.com
www.trendmicro.com
js.driftt.com
51 www.trendmicro.com www.trendmicro.com
32 widget.equally.ai tags.tiqcdn.com
www.trendmicro.com
widget.equally.ai
25 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
13 load.sumome.com 1 redirects www.trendmicro.com
11 trendmicro.scene7.com www.trendmicro.com
8 b.6sc.co www.trendmicro.com
8 fonts.gstatic.com fonts.googleapis.com
7 cdn.cookielaw.org www.trendmicro.com
cdn.cookielaw.org
5 www.googletagmanager.com tags.tiqcdn.com
www.googletagmanager.com
www.google-analytics.com
4 api.equally.ai www.trendmicro.com
4 sumome.com www.trendmicro.com
4 tags.srv.stackadapt.com tags.tiqcdn.com
www.trendmicro.com
tags.srv.stackadapt.com
4 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
www.trendmicro.com
3 px.ads.linkedin.com 3 redirects
3 www.google.de www.trendmicro.com
3 secure.adnxs.com 2 redirects www.trendmicro.com
3 www.youtube.com www.trendmicro.com
www.youtube.com
tags.tiqcdn.com
2 metrics.api.drift.com js.driftt.com
2 bootstrap.api.drift.com js.driftt.com
2 epsilon.6sense.com www.trendmicro.com
2 t.co www.trendmicro.com
2 ibc-flow.techtarget.com www.trendmicro.com
2 www.google.com 1 redirects www.trendmicro.com
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 www.googleadservices.com www.trendmicro.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 googleads.g.doubleclick.net 1 redirects www.trendmicro.com
2 bat.bing.com www.googletagmanager.com
www.trendmicro.com
2 dpm.demdex.net assets.adobedtm.com
www.trendmicro.com
2 customer.cludo.com www.trendmicro.com
2 fonts.googleapis.com www.trendmicro.com
client
1 684dd32e.akstat.io s.go-mpulse.net
1 insight.adsrvr.org www.trendmicro.com
1 px4.ads.linkedin.com www.trendmicro.com
1 www.linkedin.com 1 redirects
1 pixel.quantserve.com www.trendmicro.com
1 945-cxd-062.mktoresp.com munchkin.marketo.net
1 e.acuityplatform.com www.trendmicro.com
1 ipv6.6sc.co www.trendmicro.com
1 c.6sc.co www.trendmicro.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 www.facebook.com www.trendmicro.com
1 snap.licdn.com sjs.bizographics.com
1 c.go-mpulse.net www.trendmicro.com
1 rules.quantcount.com secure.quantserve.com
1 region1.google-analytics.com www.googletagmanager.com
1 origin.acuityplatform.com tags.tiqcdn.com
1 static.ads-twitter.com tags.tiqcdn.com
1 j.6sc.co tags.tiqcdn.com
1 trk.techtarget.com tags.tiqcdn.com
1 resources.xg4ken.com www.trendmicro.com
1 resources.trendmicro.com tags.tiqcdn.com
1 sjs.bizographics.com tags.tiqcdn.com
1 secure.quantserve.com tags.tiqcdn.com
1 cm.everesttech.net 1 redirects
1 trendmicro.demdex.net www.trendmicro.com
1 attr.ml-api.io www.trendmicro.com
1 s.ml-attr.com 1 redirects
1 js.adsrvr.org www.googletagmanager.com
1 s.go-mpulse.net www.trendmicro.com
1 ixfd2-api.bc0a.com cdn.bc0a.com
1 cdn.bc0a.com tags.tiqcdn.com
1 assets.adobedtm.com tags.tiqcdn.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 s7.addthis.com www.trendmicro.com
0 analytics.twitter.com Failed www.trendmicro.com
0 9572106.fls.doubleclick.net Failed www.googletagmanager.com
0 5427711.fls.doubleclick.net Failed www.googletagmanager.com
314 71
Subject Issuer Validity Valid
www.trendmicro.com
Entrust Certification Authority - L1M
2023-05-20 -
2024-06-19
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
*.cludo.com
AlphaSSL CA - SHA256 - G4
2023-06-01 -
2024-07-02
a year crt.sh
tags.tiqcdn.com
Amazon RSA 2048 M01
2023-04-18 -
2024-05-17
a year crt.sh
*.scene7.com
DigiCert TLS RSA SHA256 2020 CA1
2023-01-22 -
2024-01-24
a year crt.sh
*.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert TLS RSA SHA256 2020 CA1
2023-02-07 -
2024-02-07
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2023-11-13 -
2024-11-12
a year crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-11 -
2024-08-10
a year crt.sh
cdn.bc0a.com
GTS CA 1D4
2023-10-02 -
2023-12-31
3 months crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-26 -
2024-10-26
a year crt.sh
ixfd-api.bc0a.com
GTS CA 1D4
2023-10-06 -
2024-01-04
3 months crt.sh
akstat.io
DigiCert TLS RSA SHA256 2020 CA1
2023-04-05 -
2024-04-04
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 01
2023-10-24 -
2024-04-21
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
quantserve.com
R3
2023-10-28 -
2024-01-26
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA
2023-08-10 -
2024-08-09
a year crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3
2023-05-18 -
2024-05-17
a year crt.sh
*.xg4ken.com
Go Daddy Secure Certificate Authority - G2
2023-10-29 -
2024-11-29
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-09-05 -
2023-12-04
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-06-25 -
2024-06-24
a year crt.sh
6sc.co
R3
2023-11-03 -
2024-02-01
3 months crt.sh
drift.com
Amazon RSA 2048 M02
2023-08-15 -
2024-09-11
a year crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
*.acuityplatform.com
DigiCert TLS RSA SHA256 2020 CA1
2023-01-30 -
2024-02-01
a year crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M02
2023-09-09 -
2024-10-07
a year crt.sh
equally.ai
Amazon RSA 2048 M01
2023-05-06 -
2024-06-03
a year crt.sh
www.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
www.google.de
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2023-11-17 -
2024-02-15
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
load.sumome.com
R3
2023-11-08 -
2024-02-06
3 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-07 -
2024-10-07
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
*.sumome.com
Sectigo RSA Domain Validation Secure Server CA
2023-02-13 -
2024-02-13
a year crt.sh

This page contains 8 frames:

Primary Page: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Frame ID: 38CD65B592388C106398220C3047AD6C
Requests: 207 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=1349609714562;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;gtm=45He3b81v72003116;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Frame ID: DBCA74DFC54AC9B2FCA1E4A43A069D8B
Requests: 1 HTTP requests in this frame

Frame: https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=2315715416687;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;gtm=45He3b81v72003116;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Frame ID: 982CEFF7447A21B9113130F41427A6A4
Requests: 1 HTTP requests in this frame

Frame: https://trendmicro.demdex.net/dest5.html?d_nsid=0
Frame ID: 8773DCEB4175242756146664F99025C3
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Frame ID: 7796F1C1D6C1FF0255BB63A8F023F505
Requests: 34 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Frame ID: F83E388FD6F042313BCEB8681EB836E2
Requests: 34 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&upid=803df29&upv=1.1.0
Frame ID: 530EFCCFA3DCBFAAF37B2D22B8F83C52
Requests: 1 HTTP requests in this frame

Frame: https://widget.equally.ai/equallyai-widget.css
Frame ID: E13427E4991D69A8735DD4D3D8D8CDA6
Requests: 30 HTTP requests in this frame

Screenshot

Page Title

ParaSiteSnatcher How Malicious Chrome Extensions Target Brazil

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js

Overall confidence: 100%
Detected patterns
  • load\.sumome\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

314
Requests

96 %
HTTPS

52 %
IPv6

49
Domains

71
Subdomains

59
IPs

6
Countries

8686 kB
Transfer

17799 kB
Size

60
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 113
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=186693726241257388
Request Chain 116
  • https://cm.everesttech.net/cm/dd?d_uuid=31247803169938651264609444652043540623 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZWS3-wAAAFR57gNe
Request Chain 131
  • https://load.sumome.com/ HTTP 301
  • https://load.sumome.com/sumome.js
Request Chain 163
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&ocp_id=_7dkZZaCI4fT9u8Pu8SjoAo&sscte=1&crd=&pscrd=IhMI1v3dxMHkggMVh6n9Bx074gik HTTP 302
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1v3dxMHkggMVh6n9Bx074gik&is_vtc=1&ocp_id=_7dkZZaCI4fT9u8Pu8SjoAo&cid=CAQSKQDICaaNXnlMtIxu4_WOw4iJG8-VchmRfnMg50vNEVgFB-S1WgvZHb3o&random=2240880718&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1v3dxMHkggMVh6n9Bx074gik&is_vtc=1&ocp_id=_7dkZZaCI4fT9u8Pu8SjoAo&cid=CAQSKQDICaaNXnlMtIxu4_WOw4iJG8-VchmRfnMg50vNEVgFB-S1WgvZHb3o&random=2240880718&resp=GooglemKTybQhCsO&ipr=y
Request Chain 179
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1701099519819%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen_us%252Fresearch%252F23%252Fk%252Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cookiesTest=true&liSync=true&e_ipv6=AQKizSASIG6E2wAAAYwRbsGTM-qTq9pFBhPRh7sgUyKQlUngwIeTjgbadBwisdXYuXhllRvVb-9SgQ

314 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
www.trendmicro.com/en_us/research/23/k/
155 KB
29 KB
Document
General
Full URL
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
33f36ffa4f8478d7263983e315a7e62d42026dc210d045f6f81a446aeb299d63
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
28671
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
content-type
text/html;charset=utf-8
date
Mon, 27 Nov 2023 15:38:38 GMT
server
nginx
server-timing
cdn-cache; desc=HIT edge; dur=198 origin; dur=0 ak_p; desc="1701099517999_34831260_589600307_19801_2313_30_52_255";dur=1
vary
Accept-Encoding
x-akamai-transformed
9 26433 0 pmb=mRUM,2
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-prod-a-01
Yes
x-prod-n-01
Yes
x-xss-protection
1;mode=block
OtAutoBlock.js
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/
209 KB
25 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edae277827642cd51b689e27e8cc8777276fffb792f0d31d3d50f6aed3923bf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
24469
content-md5
NRVsmfb84UGxpARBDyqOog==
content-length
25142
x-ms-lease-status
unlocked
last-modified
Fri, 08 Sep 2023 18:20:08 GMT
server
cloudflare
etag
0x8DBB0983BEA9C1C
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
7d3d147c-001e-0096-0c87-f03052000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb75959a2a18d6-FRA
expires
Tue, 28 Nov 2023 15:38:38 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
/EzX6ku1+i8ak28m1WuIrw==
age
42160
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6841
x-ms-lease-status
unlocked
last-modified
Wed, 22 Nov 2023 17:38:25 GMT
server
cloudflare
etag
0x8DBEB81D4AA9473
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
7f5edf5c-201e-004a-17b1-1d9a0c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb75959a2c18d6-FRA
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
34 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Fri, 03 Nov 2023 22:35:08 GMT
server
Akamai Resource Optimizer
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518287_34831260_589600537_38_2088_26_0_219";dur=1
x-prod-n-01
Yes
content-length
34051
x-xss-protection
1;mode=block
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Sat, 28 Oct 2023 23:18:51 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518301_34831260_589600540_1340_2327_26_0_219";dur=1
content-length
3224
x-xss-protection
1;mode=block
css
fonts.googleapis.com/
13 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b5fc7649baa5db00a746c067fd19607a54f6e4ae1f536d2c18257671cf7fe99c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 27 Nov 2023 15:32:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 27 Nov 2023 15:38:38 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/
16 KB
3 KB
Stylesheet
General
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:1c60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 21 Apr 2022 10:55:26 GMT
server
cloudflare
age
37183
etag
W/"0238c4e6e55d81:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
82cb7595c8c65be1-FRA
alt-svc
h3=":443"; ma=86400
x-lb
4
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
335 KB
34 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
1e92810ef3030da7403227f4b986ecce82a867c10da87f58838c7a3baeadf76e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Mon, 20 Nov 2023 23:43:15 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518290_34831260_589600535_400_2157_26_0_255";dur=1
content-length
34479
x-xss-protection
1;mode=block
header-footer.min.css
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/
60 KB
6 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
14c7ed6b9b540b42d3ec969bbe0cb8d4ea30965c15f5669b4fffddd405c0b3c7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Wed, 11 Oct 2023 15:57:48 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518287_34831260_589600536_88_1691_26_0_255";dur=1
content-length
5477
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
1 KB
871 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c867f581b6ab234be9476a2284e95d3ab309adf566d8fdb545dd064ec7399ac7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
5e.ucw0ZoSM_0om3dzNBojngFjVp1zY2
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Fri, 17 Nov 2023 22:28:39 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
65
x-amz-server-side-encryption
AES256
etag
W/"7731cf7eb2cd67b75f49ca92f679fd97"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=300
x-amz-cf-id
BPiR0KYSQtFpEMlAZEvZb-sI5ICV4gJBI0DcJKoJIdvQbJ9W-ojziA==
tm-logo-red-white-t.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/
5 KB
3 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 27 Nov 2023 15:38:38 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518290_34831260_589600541_72_1638_26_0_182";dur=1
content-length
2173
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 11:41:14 GMT
server
nginx
etag
W/"154e-60b20c78543c2"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=307
accept-ranges
bytes
expires
Mon, 27 Nov 2023 15:43:45 GMT
small-business-worry-free-service-console-shot
trendmicro.scene7.com/is/image/trendmicro/
12 KB
12 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/small-business-worry-free-service-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
baab390c2d7313aff54f9e972aec75d7293ed44cef9fd2eec59c1debe9343dfd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/small-business-worry-free-service-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c34e5e
etag
"d368300e798fca683308d1ed100d958c"
content-type
image/webp
access-control-allow-origin
*
content-length
12248
expires
Mon, 27 Nov 2023 16:52:23 GMT
trend-vision-one-laptop-console-nav.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/
529 KB
381 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 27 Nov 2023 15:38:38 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=2, ak_p; desc="1701099518358_34831260_589600609_567_2408_25_0_182";dur=1
content-length
389784
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 12:15:45 GMT
server
nginx
etag
W/"8428e-60b2142f4fe9d"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=191
accept-ranges
bytes
expires
Mon, 27 Nov 2023 15:41:49 GMT
asrm-console-shot
trendmicro.scene7.com/is/image/trendmicro/
14 KB
14 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/asrm-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:26 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c34e88
etag
"1ac209128f661abb8a982d1bdb20d08e"
content-type
image/webp
access-control-allow-origin
*
content-length
14534
expires
Mon, 27 Nov 2023 22:20:02 GMT
xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/
18 KB
18 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/xdr-product-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c34eac
etag
"b3ffdce154f5ac33f90bafd0b8f52ddf"
content-type
image/webp
access-control-allow-origin
*
content-length
18350
expires
Mon, 27 Nov 2023 17:58:19 GMT
cloud-one-workload-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/
20 KB
21 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/cloud-one-workload-security-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c34fb7
etag
"fd80448de919134c924f18226b59ecd2"
content-type
image/webp
access-control-allow-origin
*
content-length
20734
expires
Mon, 27 Nov 2023 18:03:09 GMT
cloud-one-container-console-shot
trendmicro.scene7.com/is/image/trendmicro/
22 KB
23 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/cloud-one-container-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:25 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c35036
etag
"0bd7f96f29e779fac6dc954866b8de36"
content-type
image/webp
access-control-allow-origin
*
content-length
22816
expires
Mon, 27 Nov 2023 18:40:12 GMT
cloud-one-file-storage-console-shot
trendmicro.scene7.com/is/image/trendmicro/
10 KB
11 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/cloud-one-file-storage-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3504a
etag
"81b7f638d5ac80cfde194124da99cc5e"
content-type
image/webp
access-control-allow-origin
*
content-length
10478
expires
Mon, 27 Nov 2023 20:48:05 GMT
sps-mobile-security-enterprise-console-shot
trendmicro.scene7.com/is/image/trendmicro/
20 KB
20 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/sps-mobile-security-enterprise-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3504b
etag
"183303c0127c38a2849f7046d6cccef2"
content-type
image/webp
access-control-allow-origin
*
content-length
19998
expires
Mon, 27 Nov 2023 20:48:27 GMT
zero-trust-access-console-shot
trendmicro.scene7.com/is/image/trendmicro/
24 KB
24 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/zero-trust-access-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3504c
etag
"54553bd846274282dee4b07c8fd3198b"
content-type
image/webp
access-control-allow-origin
*
content-length
24410
expires
Mon, 27 Nov 2023 22:31:14 GMT
email-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/
24 KB
25 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/email-security-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:50:40 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3504d
etag
"adeabd4b80e2b5f6ab0d131473fa84c3"
content-type
image/webp
access-control-allow-origin
*
content-length
24906
expires
Mon, 27 Nov 2023 20:11:05 GMT
all-products-console-shot
trendmicro.scene7.com/is/image/trendmicro/
64 KB
64 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/all-products-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Mon, 27 Mar 2023 00:57:09 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3504f
etag
"891ae1c6af5064a7f40d8b2f96a4ea68"
content-type
image/webp
access-control-allow-origin
*
content-length
65306
expires
Mon, 27 Nov 2023 23:29:36 GMT
search-script.js
customer.cludo.com/scripts/bundles/
400 KB
72 KB
Script
General
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:1c60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e7fec735da70cd06ad2d2ede0add50ee4d1aef7801aed7a455419f66e3daf0f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 21 Nov 2023 10:37:48 GMT
server
cloudflare
age
121
etag
W/"0661bc5661cda1:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
82cb7596491b5be1-FRA
alt-svc
h3=":443"; ma=86400
x-lb
4
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
648 B
752 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 27 Nov 2023 15:38:38 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518884_34831260_589601159_33_1869_26_0_146";dur=1
content-length
362
x-xss-protection
1;mode=block
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=307
expires
Mon, 27 Nov 2023 15:43:45 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
8 KB
8 KB
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 18:35:29 GMT
server
AkamaiNetStorage
etag
"4dc263680765839bcf154c31da4ae22b:1592332529.612416"
vary
Accept-Encoding
content-type
text/html
cache-control
no-cache, no-store
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518886_34831260_589601160_273_1960_26_0_146";dur=1
accept-ranges
bytes
content-length
3235
expires
Mon, 27 Nov 2023 15:38:38 GMT
ParaSiteSnatcher_Fig1.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
101 KB
102 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig1.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e01d6dc1abdb826d43e6666020867d581d055874b359d932829d252f7588c608
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=31, origin; dur=316, ak_p; desc="1701099518890_34831260_589601161_35377_1362_26_0_146";dur=1
content-length
103526
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:34 GMT
server
nginx
etag
"19466-60b2348dcba63"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1772
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:11 GMT
ParaSiteSnatcher_Fig2.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
135 KB
135 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig2.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ee066eb5d4337241f1c3f10b1151b4a2b6a56432ae7ef2ddbd480528b65a567b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=70, origin; dur=634, ak_p; desc="1701099518884_34831260_589601162_70465_1734_26_0_146";dur=1
content-length
137729
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:34 GMT
server
nginx
etag
"21a01-60b2348e3abe3"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig3.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
86 KB
87 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig3.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a1f4b84cf445b9350febd03d41fb8c4efad00ca01efcce58082c17cc858f2e93
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=258, origin; dur=351, ak_p; desc="1701099518922_34831260_589601167_65014_1857_27_0_146";dur=1
content-length
88151
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:43:48 GMT
server
nginx
etag
"15857-60b235466ffc4"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1794
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:33 GMT
ParaSiteSnatcher_Fig4.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
79 KB
79 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig4.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4161e36b7f5ad0c7837733c26f513c9665ef06a8e3f33cd2d8ae9ca8fd49de43
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=107, origin; dur=627, ak_p; desc="1701099518891_34831260_589601168_73637_2103_29_0_146";dur=1
content-length
80451
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:35 GMT
server
nginx
etag
"13a43-60b2348efdd42"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1758
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:07:57 GMT
ParaSiteSnatcher_Fig5.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
51 KB
52 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig5.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1509dc217819ad2dd4014e253baa32792ce544333a8916444f93989b8d6ab7b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=50, origin; dur=621, ak_p; desc="1701099518889_34831260_589601169_67162_1666_27_0_146";dur=1
content-length
52729
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"cdf9-60b23487c44cc"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig6.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
104 KB
104 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig6.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
93b80e24b384219ed900d6c2c57b95e55256988cfd2bd76f9f3c80b399970648
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=162, origin; dur=353, ak_p; desc="1701099518889_34831260_589601170_51532_1626_32_0_146";dur=1
content-length
106203
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"19edb-60b23487c3144"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig7.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
104 KB
104 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig7.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0c175faf04782b81ff1d1c1297ed6dec12e66d736dd70de4fd35ce90988e0c9c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=58, origin; dur=621, ak_p; desc="1701099518889_34831260_589601171_67985_1608_27_0_146";dur=1
content-length
106468
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:36 GMT
server
nginx
etag
"19fe4-60b2348f7ebf1"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig8.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
67 KB
67 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig8.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8dcc53c62676aa4653201bb3b840c749e0f78c970ada8e62f1a8df358eb61d36
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=76, origin; dur=637, ak_p; desc="1701099518889_34831260_589601172_71344_1620_26_0_146";dur=1
content-length
68381
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"10b1d-60b23487c2d5b"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1749
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:07:48 GMT
ParaSiteSnatcher_Fig9.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
570 KB
571 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig9.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a969a82bb3ac58f06a3137d9cbf5c5c51e1311d6ef8986b84c42bab87bdaf7cd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=12, origin; dur=629, ak_p; desc="1701099518910_34831260_589601189_64129_1916_27_0_146";dur=1
content-length
583951
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"8e90f-60b23488126e8"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1777
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:16 GMT
ParaSiteSnatcher_Fig10A.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
13 KB
13 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig10A.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e2e0bae31f3084d1ddbd244ffdfbe62ed5babede11e9897ab70990ba01ec4987
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=208, origin; dur=178, ak_p; desc="1701099518916_34831260_589601191_39307_2189_25_0_146";dur=1
content-length
12871
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"3247-60b234880677c"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig10B.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
45 KB
45 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig10B.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
afc4bdae016b1b2788b282a23571c692eb31fe782007f3a2244f68ef925e550c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=22, origin; dur=632, ak_p; desc="1701099518923_34831260_589601192_66961_1609_27_0_146";dur=1
content-length
46009
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:37 GMT
server
nginx
etag
"b3b9-60b234904d8d3"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig11.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
68 KB
69 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig11.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a592d5f47fa61931f84d9c0336bcec6628945763d0009f44882d61f77c6dd19a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=26, origin; dur=621, ak_p; desc="1701099518910_34831260_589601193_64686_1943_27_0_146";dur=1
content-length
70044
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:43:48 GMT
server
nginx
etag
"1119c-60b235467d2b8"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig12.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
190 KB
190 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig12.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
dd6a60845f874c842a6c0ea1e0a4ca6409e809a48f885bec9e007b216f71a662
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=41, origin; dur=632, ak_p; desc="1701099518911_34831260_589601194_67538_1615_27_0_146";dur=1
content-length
194451
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"2f793-60b23487cae46"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig13.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
19 KB
19 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig13.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
45b9acd0d7acb13b08ea42e95827e94bd8be3cbf18202713e93bf79d6bb512ec
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=47, origin; dur=629, ak_p; desc="1701099518921_34831260_589601195_68887_1397_26_0_146";dur=1
content-length
19061
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"4a75-60b23487c3914"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig14.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
504 KB
505 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig14.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3de99c7432f432aeea6d2f665aea44348a0b316b11cf04a3f35aa477c05a9b8e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=43, origin; dur=627, ak_p; desc="1701099518910_34831260_589601196_67057_1686_27_0_146";dur=1
content-length
516336
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:37 GMT
server
nginx
etag
"7e0f0-60b23490f7fa1"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1753
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:07:52 GMT
ParaSiteSnatcher_Fig15A.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
74 KB
74 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig15A.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ec7b7f2ea7c2691ebf9a7ca8161af36263c9d1a8256c1698e65827aeb97593d8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=14, origin; dur=624, ak_p; desc="1701099518910_34831260_589601197_63841_1773_27_0_146";dur=1
content-length
75535
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"1270f-60b234880a9e5"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig15B.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
215 KB
216 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig15B.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ff71f3ee3a06deeb569530bfe7174533653a4382a2a327171c52e5825cf90bb6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=92, origin; dur=619, ak_p; desc="1701099518913_34831260_589601198_71434_1456_29_0_146";dur=1
content-length
220648
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:38 GMT
server
nginx
etag
"35de8-60b2349175b86"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1762
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:01 GMT
ParaSiteSnatcher_Fig16.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
68 KB
68 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig16.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a71ba95f3450a26edd86e6d972023ab92364f7bf0149a011bcc5bab46e1511c2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=12, origin; dur=624, ak_p; desc="1701099518913_34831260_589601199_63923_1556_27_0_146";dur=1
content-length
69360
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:38 GMT
server
nginx
etag
"10ef0-60b2349186cfc"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig17.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
193 KB
193 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig17.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9002702b4dd8576690f7fa8da0c88bcbb7bd74c568cd2a38048f386b53cbe34a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=16, origin; dur=624, ak_p; desc="1701099518910_34831260_589601200_64028_1724_27_0_146";dur=1
content-length
197319
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:38 GMT
server
nginx
etag
"302c7-60b23491874cc"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig18.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
276 KB
276 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig18.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b57ba30ba4abb40d8ecf6680ce4218317fbc16eee5999bd0543d1cb88be817c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=56, origin; dur=622, ak_p; desc="1701099518925_34831260_589601201_69741_2110_27_0_146";dur=1
content-length
282137
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"44e19-60b23487c8736"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1788
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:27 GMT
ParaSiteSnatcher_Fig19A.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
298 KB
299 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig19A.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9f5235b382e7052717e8d2f41112bc116472f8f6133c5e498e550a3c0334f58b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=84, origin; dur=628, ak_p; desc="1701099518912_34831260_589601202_71527_1656_29_0_146";dur=1
content-length
305294
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:38 GMT
server
nginx
etag
"4a88e-60b234918c2ee"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1780
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:19 GMT
ParaSiteSnatcher_Fig19B.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
478 KB
478 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig19B.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f1c52a96f41d5778efb234b215e4e815b8b77e00bf2cc50cd96990e90f35b333
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=13, origin; dur=629, ak_p; desc="1701099518918_34831260_589601203_65209_2058_27_0_146";dur=1
content-length
489030
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:38 GMT
server
nginx
etag
"77646-60b234918b34e"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig20.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
71 KB
72 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig20.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
450b58f0da233b187d384f0190935c709619eda6f9b7d3dcd085a30a2127bba8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=11, origin; dur=313, ak_p; desc="1701099518911_34831260_589601204_32524_1292_26_0_146";dur=1
content-length
73067
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"11d6b-60b23487c3cfc"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
ParaSiteSnatcher_Fig21.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/
129 KB
129 KB
Image
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/k/parasitesnatcher-how-malicious-chrome-extension-targets-brazil/ParaSiteSnatcher_Fig21.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
df15b0839fb4f70118ce881715052ff8648051a9a01e146212d7e68c0a1d344d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:39 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=45, origin; dur=316, ak_p; desc="1701099518910_34831260_589601205_36150_1594_26_0_146";dur=1
content-length
131882
x-xss-protection
1;mode=block
last-modified
Mon, 27 Nov 2023 14:40:28 GMT
server
nginx
etag
"2032a-60b23487c73ad"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
accept-ranges
bytes
expires
Mon, 27 Nov 2023 16:08:39 GMT
granite.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Sun, 12 Nov 2023 21:15:12 GMT
server
Akamai Resource Optimizer
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518468_34831260_589600713_26_1466_26_0_182";dur=1
x-prod-n-01
Yes
content-length
1422
x-xss-protection
1;mode=block
clientLibs.min.js
www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/
646 B
630 B
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
db05d4267dfa54efcffce5353b6b16959137d2387075f61974be55c6d3d6413c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Wed, 11 Oct 2023 15:04:58 GMT
server
Akamai Resource Optimizer
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518497_34831260_589600732_27_1846_26_0_182";dur=1
x-prod-n-01
Yes
content-length
251
x-xss-protection
1;mode=block
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
18 KB
7 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518509_34831260_589600744_21_2082_26_0_182";dur=1
x-prod-n-01
Yes
content-length
6497
x-xss-protection
1;mode=block
last-modified
Mon, 13 Nov 2023 03:54:51 GMT
server
Akamai Resource Optimizer
etag
"48de-60a009fbc5a8f"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=342916
accept-ranges
bytes
expires
Fri, 01 Dec 2023 14:53:54 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
81 KB
23 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518526_34831260_589600763_32_2100_26_0_182";dur=1
x-prod-n-01
Yes
content-length
22997
x-xss-protection
1;mode=block
last-modified
Thu, 09 Nov 2023 21:17:38 GMT
server
Akamai Resource Optimizer
etag
"1457a-609beb9e360e9"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=326761
accept-ranges
bytes
expires
Fri, 01 Dec 2023 10:24:39 GMT
iframe_api
www.youtube.com/
993 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0de2a176ad08f62d4eb01561e51936094f156760b03746e2f17e69345824f7b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:38 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
origin-trial
AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Mon, 27 Nov 2023 15:38:38 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
385 KB
99 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
a4328c78cf1b5cc23e5b78142d563d1f2a92eac3ca9d0e0d68c86c4a2084db10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Thu, 16 Nov 2023 18:14:51 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518567_34831260_589600803_882_2062_26_0_182";dur=1
content-length
101376
x-xss-protection
1;mode=block
header-footer.min.js
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/
36 KB
6 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
523e8e412693994fe6b7c57035ee70d6d0981da58428747101852ac0710fbded
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Thu, 31 Aug 2023 00:13:15 GMT
server
Akamai Resource Optimizer
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518625_34831260_589600890_1519_2239_26_0_182";dur=1
x-prod-n-01
Yes
content-length
5336
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/
56 B
362 B
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.238.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-238-53.deploy.static.akamaitechnologies.com
Software
Oracle API Gateway /
Resource Hash
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:38:38 GMT
server
Oracle API Gateway
opc-request-id
/D97A3CA52DDDB235092B749963B7BFAE/C99C0A6A7C2D8CDB590EB12280277CEB
x-frame-options
sameorigin
vary
Accept-Encoding
content-type
text/javascript
x-distribution
99
x-host
s7.addthis.com
content-length
76
x-xss-protection
1; mode=block
821060e3-3f9c-4a2f-8613-8e0db4841f79.json
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/821060e3-3f9c-4a2f-8613-8e0db4841f79.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d34cace5073f691a7024b6dd563eda0874bf4ce25bc29ceda006e398b8275c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
8735
content-md5
gS3Xe5HNQ4htQ7mh5lM4Tw==
content-length
1748
x-ms-lease-status
unlocked
last-modified
Fri, 08 Sep 2023 18:20:09 GMT
server
cloudflare
etag
0x8DBB0983C2D1927
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
ce70c4c6-101e-0051-1c73-0ca40f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb75963e1e1e4b-FRA
expires
Tue, 28 Nov 2023 15:38:38 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
59 B
296 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
82cb7596dec703d8-FRA
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.34.0/
348 KB
83 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e88dafe889a514ea8b9b07747f53d08b66a473b7caa78645b4aa2167563651e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ywzctmjVIapkx83Pz3a+AQ==
age
43882
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
84671
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:35 GMT
server
cloudflare
etag
0x8DA3822B5C4CCF6
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
966d2274-201e-0091-347d-eb5c31000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb75990f6818d6-FRA
launch-75dcf65b28c1.min.js
assets.adobedtm.com/d205b04dc657/0c07287192f8/
226 KB
72 KB
Script
General
Full URL
https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:7a4::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
6ecad4dffbfb54b23db3b0ea63b3749934d1fa75e2b6f9fcbaa939ca715dbde8

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 27 Nov 2023 15:38:38 GMT
content-encoding
gzip
last-modified
Fri, 17 Nov 2023 06:36:17 GMT
server
AkamaiNetStorage
etag
"5c4e4e12e801ce70812f5fc10abd4267:1700202977.507838"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
73490
expires
Mon, 27 Nov 2023 16:38:38 GMT
autopilot_sdk.js
cdn.bc0a.com/autopilot/f00000000017219/
37 KB
14 KB
Script
General
Full URL
https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.125.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.125.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-goog-meta-marvel_enabled
false
content-security-policy
default-src 'self' 'unsafe-inline';
content-encoding
gzip
age
305
x-guploader-uploadid
ABPtcPoH65ODDiuvl0ZHvjgCEC0HepjazXd_-05DxHV4HwlTlRWtSLs2qouAhrXYYezTDVnnL8Y
x-goog-meta-sdk_canonical_host
x-goog-meta-sdk_whitelist
ixf
x-goog-stored-content-encoding
gzip
x-goog-meta-publishingdate
2023-10-20 15:39:22
x-goog-meta-sdk_canonical_protocol
etag
"3aad08e612ecaabb32fad8e36d99578e"
vary
Accept-Encoding
x-goog-generation
1697816362499806
content-language
en
access-control-allow-origin
*
x-goog-meta-custom
true
access-control-expose-headers
Content-Type
x-goog-meta-marvel_test_mode
false
cache-control
public, max-age=360
content-type
application/javascript
x-goog-meta-spa
false
expires
Mon, 27 Nov 2023 15:39:33 GMT
x-goog-meta-sdk_version
1.5.9
date
Mon, 27 Nov 2023 15:33:33 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-goog-meta-sdk_account_id
f00000000017219
x-goog-meta-sdk_request_parameters_case_sensitive
false
x-goog-meta-marvel_config_consistency_custom
{"data-url":"dataservice.tmok.tm/tc.png,trendmicro.scene7.com,0,.66,1&qlt=80,1.0&amp","data-dropsrcset":"true","data-customerid":"f00000000017219","data-ignorepath":"uat-author.we.trendmicro.com,uat.we.trendmicro.com,prod-author.we.trendmicro.com,qa-author.we.trendmicro.com,qa.we.trendmicro.com"}
x-goog-storage-class
MULTI_REGIONAL
x-goog-meta-marvel_customer_id
x-goog-metageneration
3
x-goog-meta-sdk_log_level
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12736
x-goog-meta-content_only
false
last-modified
Fri, 20 Oct 2023 15:39:22 GMT
server
UploadServer
x-goog-hash
crc32c=x1TL3Q==, md5=Oq0I5hLsqrsy+tjjbZlXjg==
x-goog-stored-content-length
12736
accept-ranges
bytes
x-goog-meta-disable_debug_elements
false
id
dpm.demdex.net/
369 B
920 B
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=29C656F85FE1CBB80A495C08%40AdobeOrg&d_nsid=0&ts=1701099518861
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.19.222.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-222-237.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
96b997ab041d34adb848adf5e8cddecbf48d3e534aaa685e7b504530d503650e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

dcs
dcs-prod-irl1-2-v054-02519c4a4.edge-irl1.demdex.com 1 ms
pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-tid
taCoOYPCSmQ=
vary
Origin
content-type
application/json;charset=utf-8
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials
true
content-length
312
expires
Thu, 01 Jan 1970 00:00:00 UTC
0172057124
ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/
3 KB
740 B
XHR
General
Full URL
https://ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/0172057124?client=js_sdk&client_version=1.5.9&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
Requested by
Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.194.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
12.194.111.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
07be671a165671d1106a94e0477c88c9d69cad7688c660a06282a02ef112178a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-be-pop
BRU-1-302
date
Mon, 27 Nov 2023 15:38:33 GMT
content-encoding
br
via
1.1 google
server
bws/1.0
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
KL7L2-AE63W-6L875-PUGB2-GU2BB
s.go-mpulse.net/boomerang/
205 KB
49 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/KL7L2-AE63W-6L875-PUGB2-GU2BB
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:586::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
customappheader
mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified
Sat, 25 Nov 2023 12:39:19 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
50393
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
109 KB
21 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f6ade4293488af8ca3636b7a8571c03a8fccae5acd544bc40ea8e5827c73d66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
fIRL2Hr7qDZQv0AVH8inrhqheGNq8..q
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:35:16 GMT
last-modified
Fri, 17 Nov 2023 22:28:39 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
203
x-amz-server-side-encryption
AES256
etag
W/"efa04c6d84762da4c7f26ccd8f5039cd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=300
x-amz-cf-id
L9EogcJl86WIzKHyRYkkyXQ-5WrqN2oQDX8fjZ8S4GZ-enfAqU6fWg==
xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/
18 KB
18 KB
Image
General
Full URL
https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ee2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Unknown /
Resource Hash
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
-x-adobe-assetlist
[trendmicro/xdr-product-console-shot]
date
Mon, 27 Nov 2023 15:38:38 GMT
last-modified
Wed, 04 Jan 2023 02:43:22 GMT
-x-adobe-smart-imaging
0
server
Unknown
akamai-grn
0.a27d1302.1701099518.53c3505a
etag
"b3ffdce154f5ac33f90bafd0b8f52ddf"
content-type
image/webp
access-control-allow-origin
*
content-length
18350
expires
Mon, 27 Nov 2023 17:58:19 GMT
OpenSans.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/
58 KB
58 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/OpenSans.woff2
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Mon, 08 May 2023 17:33:35 GMT
server
nginx
date
Mon, 27 Nov 2023 15:38:38 GMT
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
public, max-age=1412
server-timing
cdn-cache; desc=HIT, edge; dur=4, origin; dur=0, ak_p; desc="1701099518912_34831260_589601206_715_1854_26_0_255";dur=1
content-length
59444
x-xss-protection
1;mode=block
material-symbols-outlined.woff2
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/
225 KB
226 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/material-symbols-outlined.woff2
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 27 Nov 2023 15:38:38 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 07 Sep 2023 17:07:37 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
public, max-age=1219
server-timing
cdn-cache; desc=HIT, edge; dur=56, origin; dur=0, ak_p; desc="1701099518914_34831260_589601208_6018_1582_30_0_255";dur=1
x-prod-n-01
Yes
content-length
230732
x-xss-protection
1;mode=block
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/
72 KB
72 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 27 Nov 2023 15:38:38 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=357
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518921_34831260_589601209_1318_1538_26_0_255";dur=1
x-prod-n-01
Yes
content-length
73259
x-xss-protection
1;mode=block
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
34 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Fri, 03 Nov 2023 22:35:08 GMT
server
Akamai Resource Optimizer
date
Mon, 27 Nov 2023 15:38:38 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518911_34831260_589601210_95_1544_26_0_219";dur=1
x-prod-n-01
Yes
content-length
34051
x-xss-protection
1;mode=block
OpenSans-SemiBold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/
58 KB
58 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/OpenSans-SemiBold.woff2
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 27 Nov 2023 15:38:38 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Mon, 08 May 2023 17:33:35 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
public, max-age=319
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518920_34831260_589601218_300_1748_26_0_255";dur=1
x-prod-n-01
Yes
content-length
59480
x-xss-protection
1;mode=block
dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/
37 KB
38 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
date
Mon, 27 Nov 2023 15:38:38 GMT
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=293
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518918_34831260_589601219_51_1982_26_0_255";dur=1
x-prod-n-01
Yes
content-length
38313
x-xss-protection
1;mode=block
Interstate-Bold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/
50 KB
51 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/Interstate-Bold.woff2
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Mon, 08 May 2023 17:33:35 GMT
server
nginx
date
Mon, 27 Nov 2023 15:38:38 GMT
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
public, max-age=359
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518918_34831260_589601220_39_2097_26_0_255";dur=1
content-length
51664
x-xss-protection
1;mode=block
e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/
68 KB
68 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-n-02
Yes
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Mon, 27 Nov 2023 15:38:38 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=91
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518923_34831260_589601227_134_1528_26_0_255";dur=1
content-length
69724
x-xss-protection
1;mode=block
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 14:29:28 GMT
x-content-type-options
nosniff
age
263350
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2024 14:29:28 GMT
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/
24 KB
14 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-content-type-options
nosniff
last-modified
Thu, 09 Dec 2021 18:07:24 GMT
server
nginx
date
Mon, 27 Nov 2023 15:38:38 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-font-ttf
cache-control
public, max-age=266
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099518922_34831260_589601228_91_1748_26_0_255";dur=1
x-prod-n-01
Yes
content-length
14370
x-xss-protection
1;mode=block
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v36/
49 KB
50 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a246c4de8a0f1f1fdb6ee52565018dc341063aa9efe8481034bc3ef7d697e334
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 12:35:48 GMT
x-content-type-options
nosniff
age
97370
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50368
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:04:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2024 12:35:48 GMT
utag.69.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.49.202006041752
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2b4a2c91c9bd0e4ed72eb465692871a7518685da394bb57b2e7b0889e8c69532

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
6WmPDvljfR1f1bHmocFkjSq4ioZPoZoB
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:14 GMT
last-modified
Fri, 17 Nov 2023 22:28:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
166
x-amz-server-side-encryption
AES256
etag
W/"64dcce68adaf70ec8caabd35c3aea2f2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
b0zVZxCb6vFatGxw0LEnYJGoOroW_CD1brGybNXIqSukWKcXKUxB7Q==
www-widgetapi.js
www.youtube.com/s/player/63e90c30/www-widgetapi.vflset/
215 KB
67 KB
Script
General
Full URL
https://www.youtube.com/s/player/63e90c30/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
af82cd92cb1df231870f60b847a411fcc4adfffef67f01fff41885828edee2e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:37:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
61
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68238
x-xss-protection
0
last-modified
Mon, 20 Nov 2023 02:45:49 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 26 Nov 2024 15:37:37 GMT
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-content-type-options
nosniff
x-prod-a-01
Yes
last-modified
Sat, 28 Oct 2023 23:18:51 GMT
server
Akamai Resource Optimizer
x-prod-n-02
Yes
date
Mon, 27 Nov 2023 15:38:39 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099519030_34831260_589601329_2656_1970_27_0_219";dur=1
content-length
3224
x-xss-protection
1;mode=block
en.json
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/f9ca69f4-5e0e-4fbc-8d49-019514af017f/
312 KB
51 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/f9ca69f4-5e0e-4fbc-8d49-019514af017f/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3563345a94ccba87561a45bc118e44150e02bc7da3ce270936eadb23ce6996c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
27020
content-md5
JM+Dj/AbsFRgD4W6deNvAg==
content-length
52312
x-ms-lease-status
unlocked
last-modified
Fri, 08 Sep 2023 18:20:13 GMT
server
cloudflare
etag
0x8DBB0983E5DFAE2
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c5ee10ba-c01e-007d-6e96-f048a0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb7599cb8a1e4b-FRA
expires
Tue, 28 Nov 2023 15:38:39 GMT
gtm.js
www.googletagmanager.com/
411 KB
98 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a9ddfc8f6fa5df3944350efd58ed576b4bcd5f7bb49b577da7e795ff9f41140f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100184
x-xss-protection
0
last-modified
Mon, 27 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 27 Nov 2023 15:38:39 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.34.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ae30f6f2162279a812bf9e00efd0c985e20e76efece9444125b410f3a6822a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
e9t+XAucPzqMmpjFA11lKw==
age
30125
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2959
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:25 GMT
server
cloudflare
etag
0x8DA3822AFD03491
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
28cd69af-701e-009c-5d80-eb94e5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
82cb759a3c1c1e4b-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.34.0/assets/
21 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.34.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.34.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
/wtHD+oYY7dZRzCx50GZrQ==
age
34650
x-ms-lease-status
unlocked
last-modified
Tue, 17 May 2022 16:31:39 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
78c6e45d-201e-0007-68bf-1255e0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
82cb759a3c1d1e4b-FRA
token.json
www.trendmicro.com/libs/granite/csrf/
245 B
464 B
XHR
General
Full URL
https://www.trendmicro.com/libs/granite/csrf/token.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ddb3a051562457ce3d69a677341ad2cccad3a6c7dc6ca563c3a0c7a69ea181e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-prod-a-01
Yes
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
server-timing
cdn-cache; desc=MISS, edge; dur=42, origin; dur=612, ak_p; desc="1701099519142_34831260_589601418_68135_1951_26_0_219";dur=1
content-length
206
dict.en-US.json
www.trendmicro.com/libs/cq/i18n/
14 KB
4 KB
XHR
General
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en-US.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.197.7.9 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-7-9.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-content-type-options
nosniff
server
nginx
date
Mon, 27 Nov 2023 15:38:39 GMT
etag
"b91bea50244aae0b72b630e6c7e2791f"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json;charset=utf-8
cache-control
public, max-age=254
server-timing
cdn-cache; desc=HIT, edge; dur=44, origin; dur=0, ak_p; desc="1701099519135_34831260_589601419_6304_1795_26_0_255";dur=1
x-prod-n-01
Yes
content-length
4080
x-xss-protection
1;mode=block
utag.138.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.138.js?utv=ut4.49.202010201643
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f6d6614ecec4d410a09138dc60634f6dbd70a5f4b8c24d0054bd8513c364fc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
MHl0OYj_vdka0y.tJZaIcmCYLZf0JzMe
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
145
x-amz-server-side-encryption
AES256
etag
W/"326ca20d2db0a7ec5c62f1a510cb2975"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
HR26JSM-CZqJBN2d0EWRQD24JAVVk5PMzyd91M73P-9MPT3f2Z4tIA==
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
24 KB
6 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.49.202305162129
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a48041cebe64deb1a98cab2c0fd76840d957edc76fc58fd0e3f8e44076e4371

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
ey1vUvKRaJQTP3AroD9TVQo_zle_NAuc
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"a58d6bc375f965178d0ec5832834f41b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
QFtRLOshaGXa-k66g0Pcz75dne5OQ7BlhSlogtTepGbQq9f7kR8frw==
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.49.201510262117
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
439a1743209122f34446fb66d2b510a96601776e9868993088ef051e74d2b42f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
7jI01sHlS93ALrXOutDsQQr1hIPbVGpX
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:35 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"56131bf2f242e2a62ee3f780ba0462dc"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
GA4aj1OAcIbQHhmTFJyRvz_VRJ-1NRlZ4FFLJgnoMrONaZWZTPXMSA==
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.49.201510262117
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5384f72a7c721365e38dcf5fd29e5b3b27a67c2179763f87b7ce5ab04681d960

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
H7X9kHQqg77sKGxV2Hjlg.Nzj5s8_ivo
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"5cd313aad637435959960917f2b4f0cf"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
TjiRFBXKfrQuSGBdsJHU0QUH7W_3LeQzi99ri2S7QJvLvmKacpqrSA==
utag.22.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.22.js?utv=ut4.49.201510262117
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7a13ed6ca8a90a2bb60ef518a36ec6d87fdc0cc0df514d75d4eaff7bb9414e98

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
5_T2WmscHmMGcP5jWAmJuex8W4bOruio
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:32 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
6
x-amz-server-side-encryption
AES256
etag
W/"ddca136fd5243475cda4efadacd7a66f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
GbkuM3gMtjkEmywSj25iEiHjmFGWWbfmKWS8mkG-CzNRY1Mag4iorQ==
utag.9.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.49.201510262117
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
149eb0e1edeaf44be577a0b3ddc51fe9c82c0cf9e8d7b38c936b61a90b510c6c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
GosYQXp7OGrZXkTGjC2_5kF4HtYE2f3L
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"2fd3255fceedadc75256df2bd6673632"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
uMpL-740TH0q9A0MPug0dpD9b1T7zan9M-5HQGiH_pjy6BQkq3uMPA==
utag.43.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.49.201510262117
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1a69e8e540cedfb163ea767f3ad91f2ac49eb93db72e5d4dfad1aad64d4dd3eb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
lxafGxNUmVFOvMiWuedhS2mVWVBFZsc0
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:35 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"950e0fd3417a06ddc61c1d24d78ebe12"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
PLj3a4XauJ9FOG89FFkh7h5w4ioTq3qpIa3v68QNQw0mbUl0v6mXSw==
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.49.201608171750
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
316558d71ad59f41ec8cbf9095f956415e6d35aaa0d11f2b2d386410f0137c00

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
FQ4_aSxNrHs4.mlZ1oAby4219eCFC7Eb
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"5a36cfe095e6d0ee2c7c12e6fba824e3"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
PE10l4mChl8ro0QiqzOFgRD9qCXmKa2OI0X7InK4exmrlwD3-3aFsQ==
utag.115.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
10 KB
3 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.49.202109201636
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0ddb59fb748963caaaa0d8c1ccee7647d060d92f57b3c8c29cc153deeb791be

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
aVz_dd8NwWXrtbojgMnm4MYWrDkxGH5t
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"89589e8e4483727c35a64c8cb6f0fcaf"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
FzEvdZuOMkvJ_oIxVhCPzOf3fISqif48Hh9GyMH_bTNpf7HEYDj6pw==
utag.117.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.49.202109291943
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
13043181b75e04d7b92e350e94ce762e36560d15a5d1cd6a1d1e021a3bb4042d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
YOgKOxuSQsrYM3V5QBxlEx8A40GzYDUc
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"7233bdd737054d55ccb961e6aff273c9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
aWcph3iWZkAul_O1Q6Mx_R_no-wCZoxPXUKmbqw4PeLWAEcbO2gdaw==
utag.127.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.49.201905291644
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4026d6520eabe64b68e8617b1053894283541cacb30f362dbaab39fa64fa6f28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
JSKSbX7UmmBtOufZDDHhoSYS6D.MLoRy
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:37 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
145
x-amz-server-side-encryption
AES256
etag
W/"b4c5fe938955f6fe5d5f5370ee3b1209"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
BfDDdAnsY6t62w1I6rO-zfk3euouSMFqxersEA6HX7pKnDGcp6xGWQ==
utag.145.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.49.202305162129
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c114663a3b5e85919fda876b018c14770096c603ded617faaadd097a9b96ce35

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
SazzOCYkkDhQtEk7ABJ1wnW0VEFpT4zV
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:34:57 GMT
last-modified
Fri, 17 Nov 2023 22:28:36 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
270
x-amz-server-side-encryption
AES256
etag
W/"8d6c5823d34b7d1b100c0cf9df1ef2e6"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
6KVWfkHYIMKZMtGtTqrrTPPiZBUJoZoWOvA194KqresH7rlZh48QRw==
utag.151.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.49.202109071517
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
218696130b4ddb728c99f9eede695715788fdfb385874ad4614c74fff54d1e3e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
zXjLDWCPiv5bFf_A5zIrMk0VQJ3Smo5h
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:34:57 GMT
last-modified
Fri, 17 Nov 2023 22:28:38 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
270
x-amz-server-side-encryption
AES256
etag
W/"29d316f57e68d942b9899bcdd4862d5d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
0XQ607CU39x0OGMa_6B7QYP7XoL4An9wCCEtfaNY0ksMlodwtjfYAg==
utag.171.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
14 KB
4 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.171.js?utv=ut4.49.202308081722
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4114174ea444a24929b4d21935883cd91b9cf9beaee908b322aa3107b3ac3692

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
R5Vl7DCKk__.Z45hlwmHW.evOAMpaVYi
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:38 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"c148f5688287c45820060806b2b40383"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
2pKoMLrBetc6fO7eH41LM7EMjOznaXehQKv7ZkNs77QvtZLBaNuHGQ==
utag.181.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.181.js?utv=ut4.49.202210212104
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6870a159c9680c3ea16aa528b5b3a0cb9dfd7d3e2b4367068dd2536ac294b69a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
m1varkEUeT4qeVtgbcRyl1nQ78YxYS3n
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:35 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
144
x-amz-server-side-encryption
AES256
etag
W/"39ae93c1f187722c5ccdae716130a391"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
KRZTZPK3Srstc8oFznCjldE9iKAPxtz2bjUOWNg_pzL4jlWkbHqHhw==
utag.182.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.182.js?utv=ut4.49.202212122044
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8f12c5abe51035ac7d3b7e65db736f9eaef715d79d50d10a16c6070102c2257b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
RQWKFzwZYuzNfSHSMj8hkHyvkBK.z1gl
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
145
x-amz-server-side-encryption
AES256
etag
W/"b9926cc74f21b4f6bca250c4e94cd4e7"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
kTDw_7dC525gDKFZCXun4Djwjtpkqgi9sy9LhPbrC7zh1ttZiwwp0g==
utag.184.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.184.js?utv=ut4.49.202302161711
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0b99ed3d94a1d1dbfe7458b86939f5378756aa5d64880344bb1a631f2ed75b9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
WJLw4X5Ca_VnJyRCpBwkvJl7TY.8.j_a
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:32 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
145
x-amz-server-side-encryption
AES256
etag
W/"404cdb5d8d7ebda2e6c9f9f5087d0931"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
YbcRRC0PEK3Chjx8hK3qBLUppWUHZP0b86DV0WhokQdhuxuPmMb3hA==
utag.187.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202311152125
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7b497ac7beae5f18fead362010dae4cfa0a3942659b0afb7467eed655fe5f297

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
TJg2SkifzE3oJ5eR5q2BrZv2DNPkEJ0u
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
6
x-amz-server-side-encryption
AES256
etag
W/"4032858c735796b1eaac77764334d5e9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
5wMDa4kNQrEYLJnrrCGt5l4erAAdSbwFSe-U0EP-2yDdLwLlB1natA==
utag.189.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
12 KB
5 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.189.js?utv=ut4.49.202305082144
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd00e09e2ca8307586ae09f310f92f3c363a2a71e431dbba4fcfc5438375b952

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
i7Q3tDFQ5XaZDJxio6YQAMiNnaPErV0V
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 17 Nov 2023 22:28:36 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
81
x-amz-server-side-encryption
AES256
etag
W/"4d38c349db16536680b2b7e8381f0141"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
QFLFibO-RgUn317AkeZfsqjY8lK91bmvlNZVZx_oULMWR9ymb4ZBrQ==
utag.192.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.192.js?utv=ut4.49.202305252141
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7324817de67a98d0a6ebc71fd6a13fe2f5ee0e521a578198a45aed0a8e5d1cb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
cg0JoLms3KD6SvlgEQYJDBoDlxTWQXLX
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:36:15 GMT
last-modified
Fri, 17 Nov 2023 22:28:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
144
x-amz-server-side-encryption
AES256
etag
W/"5b4987445331fc08c042be6fc02f49bf"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=1296000
x-amz-cf-id
aHlNFjX5tj3liXovykZaZlr-d15EPxz0wUDY4izM7IpNc0Y_NkG4EQ==
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
109 KB
21 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f6ade4293488af8ca3636b7a8571c03a8fccae5acd544bc40ea8e5827c73d66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
fIRL2Hr7qDZQv0AVH8inrhqheGNq8..q
content-encoding
br
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
date
Mon, 27 Nov 2023 15:35:16 GMT
last-modified
Fri, 17 Nov 2023 22:28:39 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P4
age
204
x-amz-server-side-encryption
AES256
etag
W/"efa04c6d84762da4c7f26ccd8f5039cd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=300
x-amz-cf-id
fhQEYN1If0WyutEPj4OLbEF7K9GbrbLPvZqkplshnUUBjEZfHEC5uw==
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml
activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=1349609714562;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.h...
5427711.fls.doubleclick.net/ Frame DBCA
0
0

bat.js
bat.bing.com/
45 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 27 Nov 2023 15:38:39 GMT
last-modified
Fri, 10 Nov 2023 20:09:55 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B827192C119E4872B375FB58957C7C4C Ref B: FRA31EDGE0605 Ref C: 2023-11-27T15:38:39Z
etag
"80abcdf1114da1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13175
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1701099519281&cv=11&fst=1701099519281&bg=ffffff&guid=ON&async=1&gtm=45He3b81v72003116&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&hn=www.googleadservices.com&frm=0&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&auid=1240429162.1701099519&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
abbac496a218b37d21daa7b235db93974c16362c06e84858f8ee4b15944e1d78
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1334
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;src=9572106;type=trend002;cat=globa0;ord=2315715416687;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;...
9572106.fls.doubleclick.net/ Frame 982C
0
0

up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.155.158.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-158-118.ham50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 02:56:46 GMT
Content-Encoding
gzip
Via
1.1 3023b7184ed14098cef2ae93e7950190.cloudfront.net (CloudFront)
Last-Modified
Mon, 20 Nov 2023 02:56:36 GMT
Server
AmazonS3
X-Amz-Cf-Pop
HAM50-P2
Age
45714
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
bFb5XWiYbvbxd9tRhT-RPbzbJNhRU7hjEeoyGddV-bsjv6qr4x5HwQ==
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=186693726241257388
0
236 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=186693726241257388
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Server
2600:9000:211e:1800:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
via
1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
ObzewBPCp5c_-rdS88m-7SSxzowXw3M_8VYUpK_CHZAH3JVHOZVZfw==
content-length
0
apigw-requestid
PEGwCh3YIAMEJRg=

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
an-x-request-uuid
d6da5335-59f0-4606-8221-81af5da9c0e9
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=186693726241257388
x-proxy-origin
217.114.218.28; 217.114.218.28; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
gtm.js
www.googletagmanager.com/
144 KB
55 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e5273dbdef1f0e5a3b6692f19f99a6c201d2e9cd866d900d8284b2708d882d18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
55866
x-xss-protection
0
last-modified
Mon, 27 Nov 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 27 Nov 2023 15:38:39 GMT
dest5.html
trendmicro.demdex.net/ Frame 8773
7 KB
3 KB
Document
General
Full URL
https://trendmicro.demdex.net/dest5.html?d_nsid=0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.19.222.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-222-237.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Mon, 27 Nov 2023 15:38:39 GMT
dcs
dcs-prod-irl1-2-v054-06db7c088.edge-irl1.demdex.com 2 ms
expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Fri, 17 Nov 2023 11:52:55 GMT
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
vary
accept-encoding
x-tid
6lAE223dQK0=
ibs:dpid=411&dpuuid=ZWS3-wAAAFR57gNe
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=31247803169938651264609444652043540623
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZWS3-wAAAFR57gNe
42 B
718 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZWS3-wAAAFR57gNe
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Server
52.19.222.237 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-222-237.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

dcs
dcs-prod-irl1-2-v054-047c6455c.edge-irl1.demdex.com 2 ms
pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-encoding
gzip
x-tid
uj8U7x4TSDo=
content-type
image/gif
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length
59
expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZWS3-wAAAFR57gNe
Date
Mon, 27 Nov 2023 15:38:39 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
quant.js
secure.quantserve.com/
21 KB
9 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
77daa4388c965a3e23b5a6c800727d8025ab108f89cf5679e79136986d5b4561

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
etag
"e23JaXq4HVtlOmThpFhluQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Mon, 04 Dec 2023 15:38:39 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-23-65-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 15:38:39 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 13:49:38 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
6541
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 27 Nov 2023 15:49:38 GMT
conversion_async.js
www.googleadservices.com/pagead/
46 KB
17 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
84d65ec5b183b19a3a243732bee14343667252d65b6b01feb08f3c641e392462
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16826
x-xss-protection
0
server
cafe
etag
13883091100937700954
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 27 Nov 2023 15:38:39 GMT
insight.min.js
sjs.bizographics.com/
12 KB
4 KB
Script
General
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.49.201510262117
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Nov 2023 09:07:27 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=37225
accept-ranges
bytes
content-length
3840
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.49.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 27 Nov 2023 15:20:22 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
1097
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17168
expires
Mon, 27 Nov 2023 17:20:22 GMT
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/
2 KB
1 KB
Script
General
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
last-modified
Sat, 07 Oct 2023 01:49:34 GMT
server
cloudflare
etag
"1e1ffa-6f3-6071691a66186"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
82cb759ddc481a6d-FRA
content-length
695
expires
Mon, 27 Nov 2023 15:39:39 GMT
ktag.js
resources.xg4ken.com/js/v2/
9 KB
4 KB
Script
General
Full URL
https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EB
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.115.105 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-115-105.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c34c2d2268ab45d0767257f1b78129246fa17e6051d59f33cbb882228b580df3
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
last-modified
Wed, 01 Nov 2023 09:09:46 GMT
server
nginx
etag
"654215da-dd8"
content-type
application/javascript
cache-control
max-age=86400, public
content-length
3544
x-xss-protection
1; mode=block
expires
Tue, 28 Nov 2023 15:38:39 GMT
fbevents.js
connect.facebook.net/en_US/
202 KB
54 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 27 Nov 2023 15:38:39 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
54273
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
IO1Qsj4tZLpKJta/K4FITAGEqcl1F3Ple1+Hyt+xGuxROe+X0AKcom3BV4ApGiNyV6OMWt/H+6R/DDEK0qtvbQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.49.201905291644
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
38601
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1200
cf-ray
82cb759cbf9e65e0-FRA
expires
Mon, 27 Nov 2023 15:58:39 GMT
6si.min.js
j.6sc.co/
63 KB
17 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 Nov 2023 22:43:30 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"65554992-fd89"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
17416
expires
Mon, 27 Nov 2023 15:38:39 GMT
sv2uuh4gw3ms.js
js.driftt.com/include/1701099600000/
218 KB
61 KB
Script
General
Full URL
https://js.driftt.com/include/1701099600000/sv2uuh4gw3ms.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.49.202109071517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
84bf3385585c2a81cf961332af338f36d0fe2d2529a70cec26336a2a47945b2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
yIhOen2RdQOLq1JuyYKlrWgmQDSDlLqr
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Mon, 27 Nov 2023 15:38:39 GMT
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
31
last-modified
Tue, 21 Nov 2023 16:39:13 GMT
server
istio-envoy
etag
W/"e488aeb4315bae8793bb76f59967016d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
eBBHkoB5kdgfIprci39MRAsvpRJvW4ZpeGG4iI6FEoE_n5Nwr-G30g==
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230062-FRA
pixel.js
origin.acuityplatform.com/event/v2/
2 KB
3 KB
Script
General
Full URL
https://origin.acuityplatform.com/event/v2/pixel.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.57.31.196 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-57-31-196.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 /
Resource Hash
89cf66cb9de8da20fc15e9953845dd4d1de2c0fb465c827a09d818449222c533

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 15:38:39 GMT
Last-Modified
Wed, 04 Jan 2023 18:57:40 GMT
Server
nginx/1.14.0
ETag
"63b5cc24-978"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2424
sumome.js
load.sumome.com/
Redirect Chain
  • https://load.sumome.com/
  • https://load.sumome.com/sumome.js
2 KB
2 KB
Script
General
Full URL
https://load.sumome.com/sumome.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
7a0bde1acd31ff832a492f3790d5128d22a1a988e0af81a429e74e2e6ad10e3c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
DWS92DD0K4C131SC
cdn-cachedat
11/22/2023 21:36:52
cdn-pullzone
1686293
x-amz-id-2
FhZTLYagYwt4W/52vrULlz1N4/25V4xTYsj3fpNZ6yAmuZG3R2di+yg+Y22NpAzbRCJC7iSyd/M=
last-modified
Wed, 22 Nov 2023 21:31:41 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"932b89f108df60f6a47590d035bcff7e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
max-age=600
cdn-requestid
c9f3a55af9707f73b63d403bcc9c6916
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

date
Mon, 27 Nov 2023 15:38:39 GMT
server
BunnyCDN-DE1-1080
content-type
text/html
location
https://load.sumome.com/sumome.js
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
no-cache
cdn-pullzone
1686293
cdn-requestid
1293b05dd02d0004a476306ea9877380
cdn-requestcountrycode
DE
content-length
162
events.js
tags.srv.stackadapt.com/
18 KB
7 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.192.js?utv=ut4.49.202305252141
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.36.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-36-121.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
ede2c62d5d121769b6ddf9fb27add48868880e3f51272d25d3d8ab90216614b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 15:38:39 GMT
cache-control
max-age=5
content-encoding
gzip
content-type
text/javascript
equally-widget.min.js
widget.equally.ai/
936 KB
258 KB
Script
General
Full URL
https://widget.equally.ai/equally-widget.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202311152125
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3c220fb0f16431a4a269511c64f390b29fb30f8374ecc429f533b0763a9e2023
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 21 Nov 2023 09:27:28 GMT
server
AmazonS3
etag
W/"203ce88e2e978e42fb6d83438fe0fc90"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=60
x-amz-cf-id
vi2-JMR7naKJDz4vk5VbFu_H_d-WlegnVcCL_xbHnyW5qgsPRWaqnw==
js
www.googletagmanager.com/gtag/
296 KB
92 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dc788a8767abd052db2ea9f05c2c6c6a91442148f5e7aa381bac45a665370992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
93901
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 27 Nov 2023 15:38:39 GMT
js
www.googletagmanager.com/gtag/
296 KB
92 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
020326877e1d509a74b7c7f6a81e1ce4c78106da7cdca708c7c77b20d5f1e087
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
93834
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 27 Nov 2023 15:38:39 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
440 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202311172227&cb=1701099519334
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d800:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
2XUX04X5QEw0.xFya64khU._sHTRl_Pz
date
Mon, 27 Nov 2023 15:36:15 GMT
via
1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
145
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
2
last-modified
Sat, 11 Mar 2023 06:57:46 GMT
server
AmazonS3
etag
"7bc0ee636b3b83484fc3b9348863bd22"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
accept-ranges
bytes
x-amz-cf-id
pTmgFb6TQPj-jXd1WzG3hNd_45p4s-Xcj0_d2lpqOiECLUroDOb91g==
iframe_api
www.youtube.com/
993 B
519 B
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0de2a176ad08f62d4eb01561e51936094f156760b03746e2f17e69345824f7b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
origin-trial
AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Mon, 27 Nov 2023 15:38:39 GMT
/
www.google.com/pagead/1p-user-list/929919117/
42 B
456 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/929919117/?random=1701099519281&cv=11&fst=1701097200000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v72003116&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&frm=0&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&fmt=3&is_vtc=1&cid=CAQSGwDICaaNjDLvllrjXB0wEEOLOz40FLQUS9Ey3w&random=2131819911&rmt_tld=0&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/929919117/
42 B
456 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/929919117/?random=1701099519281&cv=11&fst=1701097200000&bg=ffffff&guid=ON&async=1&gtm=45He3b81v72003116&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&frm=0&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&fmt=3&is_vtc=1&cid=CAQSGwDICaaNjDLvllrjXB0wEEOLOz40FLQUS9Ey3w&random=2131819911&rmt_tld=1&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/
0
257 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4502MK3B94&gtm=45je3b81v884954515&_p=1701099519000&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&gdid=dYmQxMT&cid=2141023639.1701099519&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701099519&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&dt=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.consumer=not_consumer&tfd=1485
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
26044208.js
bat.bing.com/p/action/
0
119 B
Script
General
Full URL
https://bat.bing.com/p/action/26044208.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 27 Nov 2023 15:38:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 4AC9F4212E224112BE64CAFB78FD8D4F Ref B: FRA31EDGE0605 Ref C: 2023-11-27T15:38:39Z
x-cache
CONFIG_NOCACHE
rules-p-yyb3JEF9Pm8ey.js
rules.quantcount.com/
3 B
457 B
Script
General
Full URL
https://rules.quantcount.com/rules-p-yyb3JEF9Pm8ey.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:6e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 03:44:26 GMT
via
1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
age
42927
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 21:25:15 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
DNg5zkWNIrk2QtAc9gcA0HkDvAHjoEzwexNaBbRfMWkNKZb0elhgWw==
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 14:40:12 GMT
content-encoding
br
x-content-type-options
nosniff
age
3507
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1129
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 17:28:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 27 Nov 2023 15:40:12 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
813 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 14:45:47 GMT
content-encoding
br
x-content-type-options
nosniff
age
3172
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Fri, 30 Jun 2023 18:58:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 27 Nov 2023 15:45:47 GMT
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.23.65.88 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-23-65-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 15:38:39 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Wed, 06 Mar 2024 15:38:39 GMT
collect
www.google-analytics.com/j/
15 B
224 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1109936118&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&ul=en-us&de=UTF-8&dt=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACAIrBAAAACAMIg~&cid=2141023639.1701099519&tid=UA-44592531-1&_gid=1229615982.1701099519&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cd2=Aliakbar%20Zahravi%7CStaff%20Researcher%2CPeter%20Girnus%7CSr.%20Threat%20Researcher&cd3=2023-11-23&z=868797304
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15
expires
Fri, 01 Jan 1990 00:00:00 GMT
config.json
c.go-mpulse.net/api/
1 KB
906 B
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=KL7L2-AE63W-6L875-PUGB2-GU2BB&d=www.trendmicro.com&t=5670332&v=1.720.0&sl=0&si=6e1742a6-bcf1-45fe-a59e-a66b55d67bb3-s4sgse&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=807181
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:981::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
135af090c219f450ddce6af0188d76c4d0a45ee07dacb06efab1e237cd2157bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 15:38:39 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
586
__utm.gif
ssl.google-analytics.com/r/
35 B
198 B
Image
General
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=536378638&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&utmhid=1109936118&utmr=-&utmp=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&utmht=1701099519464&utmac=UA-29051577-12&utmcc=__utma%3D44797537.2141023639.1701099519.1701099519.1701099519.1%3B%2B__utmz%3D44797537.1701099519.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=124501470&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5b3086a886aa8649ecbf496ac913a1aa443926cd2fff610be2d136c9598bcd8b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Oct 2023 08:32:45 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=79348
accept-ranges
bytes
content-length
3272
js
www.googletagmanager.com/gtag/
276 KB
86 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f7c44e9e1d2523536cef6627794db0a3bbd32f5341c09c70ae92443d1b27b90f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88013
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 27 Nov 2023 15:38:39 GMT
243552383039605
connect.facebook.net/signals/config/
141 KB
36 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/243552383039605?v=2.9.138&r=stable&domain=www.trendmicro.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3f3863d004819d9ca0bb572c2063698a610de89d5d3901dcb8ce9d9c702782e7
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 27 Nov 2023 15:38:39 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
36959
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
TAHt/VzTPOVkHWuBXnbf/Jtz6yimXlo7IxeicYpCsCJxx6XR04KwPR567IwGWiP+7BrviEOumAe4QvpW23WNtw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
gif.gif
ibc-flow.techtarget.com/a/
43 B
451 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1279657&r=1701099519528&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&version=2.4
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
1279657
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
via
1.1 google
x-guploader-uploadid
ABPtcPpbm5DyLp0PSscMr13Bj8t8BCeq9c5mzv--9gKmRPEEkf0a4e5Bqj4AMOakHxE3C0hZGw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Mon, 27 Nov 2023 16:38:39 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1279657&r=1701099519528&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 27 Nov 2023 15:38:39 GMT
expires
Mon, 27 Nov 2023 15:38:39 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ABPtcPoNQNYzOkm_7OXskvBvAUG3LuJBpGz6odbVRG-8v50GzVnHa95ZznIRyKAHeITH5pFstp4
/
www.googleadservices.com/pagead/conversion/1015287688/
3 KB
2 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1015287688/?random=1701099519549&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&rfmt=3&fmt=4
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
89b9754fb02fcd0e1427d0e4b2c5d116385abd2848a9833b685fec79e22ac77c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1502
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
0
186 B
Image
General
Full URL
https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&rl=&if=false&ts=1701099519571&sw=1600&sh=1200&v=2.9.138&r=stable&a=tmtealium&ec=0&o=4126&fbp=fb.1.1701099519569.349974659&cs_est=true&ler=empty&it=1701099519526&coo=false&rqm=GET
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 27 Nov 2023 15:38:39 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
collect
region1.analytics.google.com/g/
0
257 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-JSMMKXDWBS&gtm=45je3b81v9164383042&_p=1701099519000&_gaz=1&gcd=11l1l1l1l2&dma_cps=sypham&dma=1&gdid=dYmQxMT&ul=en-us&sr=1600x1200&cid=2141023639.1701099519&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&dt=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&sid=1701099519&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&ep.ua_dimension_2=Aliakbar%20Zahravi%7CStaff%20Researcher%2CPeter%20Girnus%7CSr.%20Threat%20Researcher&ep.ua_dimension_3=2023-11-23&tfd=1673
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
257 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JSMMKXDWBS&cid=2141023639.1701099519&gtm=45je3b81v9164383042&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
108 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JSMMKXDWBS&cid=2141023639.1701099519&gtm=45je3b81v9164383042&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2&z=111225640
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/1/i/
43 B
377 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=2d31a325-47e0-41dc-94d4-10d3dfea35a1&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5eb49fbf-148e-42bb-95cf-9439c1a1fc53&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.29
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
109
date
Mon, 27 Nov 2023 15:38:38 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
49e73c872405807d
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
7750adf1d24f6d309730c04171e63ce0bd632cf4a19ceeb2931f66a9c2d26334
content-length
43
adsct
analytics.twitter.com/1/i/
0
0

adsct
t.co/1/i/
43 B
229 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=c4b80526-2e3f-46df-a5e4-2e1090f4721a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5eb49fbf-148e-42bb-95cf-9439c1a1fc53&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tw_iframe_status=0&txn_id=nuwoi&type=javascript&version=2.3.29
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
169
date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
69434f1f5bbe2988
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
7750adf1d24f6d309730c04171e63ce0bd632cf4a19ceeb2931f66a9c2d26334
content-length
43
adsct
analytics.twitter.com/1/i/
0
0

/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTyb...
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u...
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_...
42 B
109 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1v3dxMHkggMVh6n9Bx074gik&is_vtc=1&ocp_id=_7dkZZaCI4fT9u8Pu8SjoAo&cid=CAQSKQDICaaNXnlMtIxu4_WOw4iJG8-VchmRfnMg50vNEVgFB-S1WgvZHb3o&random=2240880718&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/1015287688/?random=621704257&cv=9&fst=1701099519549&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465925&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tiba=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI1v3dxMHkggMVh6n9Bx074gik&is_vtc=1&ocp_id=_7dkZZaCI4fT9u8Pu8SjoAo&cid=CAQSKQDICaaNXnlMtIxu4_WOw4iJG8-VchmRfnMg50vNEVgFB-S1WgvZHb3o&random=2240880718&resp=GooglemKTybQhCsO&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getuidj
secure.adnxs.com/
11 B
577 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
an-x-request-uuid
766d2dea-4c53-4ff4-a250-9f4f03eb4664
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
217.114.218.28; 217.114.218.28; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
11
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
196 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
24 B
320 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:23::1726:62a7 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b7bab399e87338ff7e75ac15e592a194fce5a9bce2b7e899f6510af38c5c4177

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::10
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1701099519688_388391911_21383065_22_876_22_54_219";dur=1
content-length
24
expires
Mon, 27 Nov 2023 15:38:39 GMT
69.ce9d3b69dd1815269e54.js
load.sumome.com/
114 KB
38 KB
Script
General
Full URL
https://load.sumome.com/69.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
33bc1e4cb0149bcd78b51946dd003707ffa7ecfce57fc898f60a2ca39538cfbf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
1Y0YQ9C8205B1BEX
cdn-cachedat
11/16/2023 00:10:17
cdn-pullzone
1686293
x-amz-id-2
RvZKHcFMgYNcrmPaybyp0kqeaYAxYXhiAeF3wlZ2tY1545B0b5q1dVm/a8WcbZFgc/ILGHVIex0=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"3dae70388578c04a238027665e47b465"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
6a4f4941824930f90e51dafd81c8183b
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
70.ce9d3b69dd1815269e54.js
load.sumome.com/
305 KB
106 KB
Script
General
Full URL
https://load.sumome.com/70.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
9e016bbbbe591db632165d4255231af7e360444d9a3663dbb3c4920221f752b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
1Y0P83S7829CS65P
cdn-cachedat
11/16/2023 00:10:17
cdn-pullzone
1686293
x-amz-id-2
mhHo1lDL7iDmAm69xFRNsLnQqOWc6EdbNUVvBVA1TY7PZG4W/ZsWuGVIgHRlpgvFWgpnB9kCzYU=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"ce53ffc45beb6c36c13f83022b5dda94"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
fbbdee1b3df0d4853dd2c489ef3ed7ce
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
pj
e.acuityplatform.com/
149 B
591 B
Script
General
Full URL
https://e.acuityplatform.com/pj?pk=5371219865983838496&pu=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
154.59.122.94 Schiphol, Netherlands, ASN174 (COGENT-174, US),
Reverse DNS
Software
/
Resource Hash
e4142b08bb91c6729ce36efd4ad1ef33c7a9b8b02f75066b0c2d0c748392fc4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
*
content-length
149
content-type
text/javascript
visitWebPage
945-cxd-062.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1701099519701&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1701099519701-34132&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&_mchPc=https%3A&_mchVr=163&_mchEcid=29C656F85FE1CBB80A495C08%40AdobeOrg%3A6%3A24179475743853494393831222820708142614&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Mon, 27 Nov 2023 15:38:40 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
7afbcef1-2a73-49b6-b2fb-5245a3b732d8
pixel;r=499794236;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;uht=2;fpan=1;fpa=P0-...
pixel.quantserve.com/
35 B
373 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=499794236;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;uht=2;fpan=1;fpa=P0-1167718740-1701099519420;pbc=;ns=0;ce=1;qjs=1;qv=6076e8c2-20231114150359;cm=;gdpr=0;ref=;d=trendmicro.com;dst=1;et=1701099519741;tzo=-60;ogl=url.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-ch%2Ctitle.ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%2Cdescription.We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20v%2Csite_name.Trend%20Micro%2Cimage.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fcontent%2Fdam%2Ftrendmicro%2Fglobal%2Fen%2Fresearch%2Fthumbnails%2F%2Clocale.en_US;ses=18fe4146-5b95-4801-9fb9-4f60bb3d4f58;mdl=
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:39 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
sa.css
tags.srv.stackadapt.com/
65 B
204 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.36.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-36-121.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
d6dea5f430dcc6e18d3bb267760ad4a76bf83ff8363d542fa54fbd395a4b3f37

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 15:38:39 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.36.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-36-121.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 15:38:39 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
content-type
image/jpeg
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A10%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&v=1.1.11
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22f0978075a275d14104571cd0b3e9919c9748869b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22810eb8f4ed8abcee5cd1e233263d8d3f%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/
686 B
649 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.88.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-88-70.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
d031cc970271e726dd8284f19274e5bc3770fe40a924bee96a4b4eb2ab527722

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
Authorization
Token f0978075a275d14104571cd0b3e9919c9748869b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
X-6s-CustomID
WebTag1.0 810eb8f4ed8abcee5cd1e233263d8d3f

Response headers

date
Mon, 27 Nov 2023 15:38:39 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
x-6si-region
eu-central-1a
access-control-allow-origin
https://www.trendmicro.com
access-control-expose-headers
X-6si-Region
access-control-allow-credentials
true
timing-allow-origin
https://6sense.com, https://www.ssga.com
content-length
362
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.88.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-88-70.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.trendmicro.com
access-control-expose-headers
X-6si-Region
access-control-max-age
1800
date
Mon, 27 Nov 2023 15:38:39 GMT
server
nginx
timing-allow-origin
https://6sense.com, https://www.ssga.com
x-6si-region
eu-central-1a
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1701099519819%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fen...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-targe...
0
264 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cookiesTest=true&liSync=true&e_ipv6=AQKizSASIG6E2wAAAYwRbsGTM-qTq9pFBhPRh7sgUyKQlUngwIeTjgbadBwisdXYuXhllRvVb-9SgQ
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 4210AC5A67504431BEC90BE1385B40A2 Ref B: FRAEDGE1911 Ref C: 2023-11-27T15:38:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYLJBinmH7Opsy5rMkjWQ==

Redirect headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: F7F73AA1059144E8B836575A85359572 Ref B: FRAEDGE1906 Ref C: 2023-11-27T15:38:40Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1701099519819&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&cookiesTest=true&liSync=true&e_ipv6=AQKizSASIG6E2wAAAYwRbsGTM-qTq9pFBhPRh7sgUyKQlUngwIeTjgbadBwisdXYuXhllRvVb-9SgQ
x-li-proto
http/2
content-length
0
x-li-uuid
AAYLJBikDV53EE/hWHk8pA==
9efd0aa2-b0bc-4543-9ce2-baa9b56b2f0f
https://www.trendmicro.com/
43 B
0
Image
General
Full URL
blob:https://www.trendmicro.com/9efd0aa2-b0bc-4543-9ce2-baa9b56b2f0f
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
saq_pxl
tags.srv.stackadapt.com/
163 B
359 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=1j7Ig4BaDD-2O7rpgSDWYw&is_js=true&landing_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&t=ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil&tip=F8n2RQ3iIzd7Fw_e2pNbOjRYzSM9Jv2lBTdKLXJRKbU&host=https%3A%2F%2Fwww.trendmicro.com&sa_conv_data_css_value=%270-35422625-07e6-558c-5cb7-358959792d49%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd93542262507e6558c5cb7358959792d49d972da1c&sa-user-id-v3=s%253AAQAKIJZtxV4rItxX0nJnoXntTm6nqIrJEkM-zhatKeGOmjObEHwYBCD_75KrBjABOgRyABfNQgRu4bMR.smtG8m75ewkKRkMH6aMDulrOs7vORSl1BN2lIPR2dxc&sa-user-id-v2=s%253ANUImJQfmVYxctzWJWXktSdly2hw.pLqKOJGpQS%252Bt6m4WU%252FT74a%252BLCfpzPKXwB2SfHrjp3Rg&sa-user-id=s%253A0-35422625-07e6-558c-5cb7-358959792d49.KT360rvQ34GqiL8DvMSbjzlFDEq0f52B3yxDjONkZG4
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.36.121 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-36-121.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
7aa5165924f115f6e8c64a1e2d6bf238c5f33665fac27c6d69ba9e05a6bc701a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
https://www.trendmicro.com
date
Mon, 27 Nov 2023 15:38:40 GMT
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
163
access-control-allow-methods
GET
content-type
text/plain; charset=utf-8
img.gif
b.6sc.co/v1/beacon/
43 B
486 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A39%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%221005%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
core
js.driftt.com/ Frame 7796
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3efdf09e51f3ec616ed534a682bb3db5eb060dd912e51adc58a9170089ea84e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 15:38:40 GMT
etag
W/"49f8c71df632861cfd1a371879fe9e53"
last-modified
Tue, 21 Nov 2023 16:39:02 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-id
bu6emJTIzH6tfINn_c-X3R6R-OfzJpjGpUvZr1MjR-GJ-xh2oab9fw==
x-amz-cf-pop
HAM50-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
pULQhqLCuNOuCtO0ELAtN_o8rmZsdQ3t
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
18
chat
js.driftt.com/core/ Frame F83E
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1701099600000/sv2uuh4gw3ms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
3efdf09e51f3ec616ed534a682bb3db5eb060dd912e51adc58a9170089ea84e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 27 Nov 2023 15:38:40 GMT
etag
W/"49f8c71df632861cfd1a371879fe9e53"
last-modified
Tue, 21 Nov 2023 16:39:02 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-id
IhbxVvwxuzQjSc-l0bqor5dLd5cl1BFo-O6cET62SQS9wQPp_Ibg9Q==
x-amz-cf-pop
HAM50-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
pULQhqLCuNOuCtO0ELAtN_o8rmZsdQ3t
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
15
/
sumome.com/api/load/
797 B
1 KB
XHR
General
Full URL
https://sumome.com/api/load/
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.215.250.209 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-215-250-209.us-west-2.compute.amazonaws.com
Software
nginx/1.21.5 /
Resource Hash
0055333d5526c36eb45523247a3b0adc7c04e9c1051ccd97ef4cad6945d5d3b3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
server
nginx/1.21.5
x-frame-options
SAMEORIGIN
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
content-length
797
up
insight.adsrvr.org/track/ Frame 530E
0
60 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&upid=803df29&upv=1.1.0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
0
content-type
text/html
date
Mon, 27 Nov 2023 15:38:41 GMT
server
Kestrel
/
684dd32e.akstat.io/
0
204 B
Ping
General
Full URL
https://684dd32e.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/KL7L2-AE63W-6L875-PUGB2-GU2BB
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:586::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 27 Nov 2023 15:38:41 GMT
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Mon, 27 Nov 2023 15:38:41 GMT
runtime~main.f52bd0ba.js
js.driftt.com/core/assets/js/ Frame F83E
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ac2be5f6d404a2cdeef5f6b792544790a88fe8098c9513b2bf0ca2b6363af7f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
0kSNKxKJZDtV6oeQ0vGh4IydP7Mz2M_0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
14
last-modified
Tue, 21 Nov 2023 16:21:44 GMT
server
istio-envoy
etag
W/"8f7f7df6e52f6244085b22dbc43178c8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
eQvGrAXYNmw3xtIBqCJLIt1XHEpUye_5sL2NDM1mONeRsw9jfcFR2Q==
9.4a3e9801.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id
q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
11197232
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Thu, 20 Jul 2023 18:22:11 GMT
server
istio-envoy
etag
W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WPZOj4JtGePiEWlOsp1DECq3Oi3Q9EMpgZ7yNRg0L0IG1L7DwclC4g==
main~493df0b3.d2a43907.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id
OTiYyuMgyycXvMHseM5MN77RPTRQczpn
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5901107
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
31
last-modified
Mon, 18 Sep 2023 19:58:07 GMT
server
istio-envoy
etag
W/"e094b276ad2035c3a46871991c258c2d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EIuivc4TskrCcivzUh29yIefs6XFkSmrQJPEJdN1pS9SeMHBSx6BTQ==
runtime~main.f52bd0ba.js
js.driftt.com/core/assets/js/ Frame 7796
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ac2be5f6d404a2cdeef5f6b792544790a88fe8098c9513b2bf0ca2b6363af7f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
0kSNKxKJZDtV6oeQ0vGh4IydP7Mz2M_0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
14
last-modified
Tue, 21 Nov 2023 16:21:44 GMT
server
istio-envoy
etag
W/"8f7f7df6e52f6244085b22dbc43178c8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_DP_HGttJGlzfxYZBwuKS_vWUk7ge9UrlnmUfmOSgaxn7V2P7yzMmg==
9.4a3e9801.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id
q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
11197232
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Thu, 20 Jul 2023 18:22:11 GMT
server
istio-envoy
etag
W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YCRBpEuGgIdep9RloAFyWbJUIK6YCM0ITAnM9HVwMOWl93oCghAKrw==
main~493df0b3.d2a43907.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id
OTiYyuMgyycXvMHseM5MN77RPTRQczpn
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5901107
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
31
last-modified
Mon, 18 Sep 2023 19:58:07 GMT
server
istio-envoy
etag
W/"e094b276ad2035c3a46871991c258c2d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
NCOnG3dRsAfTfzSXEISMfV1I6xDropX09nc8TQR503BNwo7eU2GspA==
51.558be3c5.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
w0qbrI1odcdSkv4sxruOvmIO8c6P6eRd
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"fa281fcbe4b2e35558d60fae3e316367"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gLwt7B2sBGsyemu-mm4u7q7YK7BR5Q28Y5QcVyCcG3l-b78a96GZOw==
35.d0f1ccda.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
ugODpWCLtsTQf05E2RGcl4eR0QvJNWsW
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
29
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"46fa5a7bc37a22544a908e4ad950309c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_bghYQ7uz4iKMQpDAaAQnDNqpOh2507lDzxqifEorl_k0DE1IMJYQQ==
22.6b9a301a.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
Ky6QIkZiBGtiJJ5ArZwKu1e32zvPbxo9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"d8739a9fe9a3a42936f5cd86c8727494"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Cr2VomZRbX8Q3Hk7F0xp86LmCTio4M---8OyzLtnbHcGhJxRlNtErA==
19.6f85b843.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
17 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
hSQ1C45siavtoncbP4dVLGc2JwP9P3B4
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
QaIMJkSq9uY_sSRbwIZXIYXrjgmnzRRhHcyTKYm4O0C7yAk3WLRn3A==
41.b4fc4de2.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
ST_dGdxBc4LtMZLFBge.wpnYWt7p0ji5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ubVCRrFAjwdfBdHvD9GiCfkSU310DymUNY6PdPcEsqtMc_gFLYIdbQ==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id
koF.ql6S6iU4L3DAmCcO8za68l9Cvk6p
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
6814554
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Thu, 07 Sep 2023 15:58:12 GMT
server
istio-envoy
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
iBLw4o2WWSaDHToC9r0wpNG7GIaz01h2MaiC21xtkGvsgrgHUSTjkg==
26.04e7f30b.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
66 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
A48cJVKJSxyqaY6toJL0V5VmBK2YcQrr
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
44
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Mg14XoS8pPEYkrs0BGrXIiWZjdPRjG8v_lWo8G5E-OpTTyp_Hl9h1A==
14.e24a6190.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
N5_fbXguvqHkSXdp93YYK8jXmF7bvtJA
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
23
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"16d7ae86e21434a32157d3226ac9bb77"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
c_KEry0Al3lYo7GCDjDqOID_ZD-b0orYEZCCNoSWER312X7lcYqaIA==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
sxovHfzffiyEIJ7X_.Sm4lBRNFee6dop
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:47 GMT
server
istio-envoy
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Wn2safaM0yvtFz62ks9NcabvsyTZqhxi95vmD8qtFa5kD9B-Us_ZMA==
18.9c1bd1fb.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
uYT1yqnf39G62Ov6m1d8GLY9M8CCtDuD
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"02f09379c544befa413d22eb57ed41de"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ogVA8Uk8A4UYqwa7Nz-1rqWGxpjGL1NlJya_IvuMoEzwALmM96TLRg==
49.f7274268.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/49.f7274268.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id
nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
10705522
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
last-modified
Wed, 26 Jul 2023 13:14:43 GMT
server
istio-envoy
etag
W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
y26Xr8tREVZmj5I6E4QI_GVvVIW8XKU4vkQfeCLCugEJZal2aaVGaQ==
40.31ef8dbf.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
gojIfd5_r5SmuAcvpIgRwTeq0TepCiYI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
18
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"b0793fa46e8c0ae1846b7be8a833da35"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KjF777FaqM1bBRictjLOKTbF6x4dsLC9n4q2cRcR5ZTFvKxbJKn0ag==
29.31d09948.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/29.31d09948.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 02 Oct 2023 04:56:51 GMT
x-amz-version-id
PyawGVolC84hpcWm6OWVT0dG84hVjB6f
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
4876910
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Thu, 21 Sep 2023 18:21:36 GMT
server
istio-envoy
etag
W/"455157cb49065fb85fed54901ddaeb0e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
34NxigWdFohcywoZ3QQysksa-ZRYGhgd0Rvkp1oznl6JYRZTtLuo8Q==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id
g1ri2j1Cjjab.VdRD9o2Qfb0pzjBKg2Y
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5901107
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Mon, 18 Sep 2023 19:58:05 GMT
server
istio-envoy
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zUwWjLJYlD6YW8nZ9M6wtdRcMFPoLDguKt26Wq4VzPMpMQiVpujkYw==
8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
31 KB
4 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/8.7602338c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
jrWQnYyVlhsp63gB_Waa1icJoQNHHYda
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
46
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LioO2GxRnrIfrNgVivlK8AWe3FibOICPlvMWiNe-c-x7fAUx60FP8w==
8.044769eb.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
81 KB
26 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.044769eb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id
17DfV7s42f89YbincTHPPVmLUV_bhnjp
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2068460
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
52
last-modified
Fri, 03 Nov 2023 16:05:58 GMT
server
istio-envoy
etag
W/"44b93d3484fa424f7b36b2e344e21e24"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2ws6vlWcanA1zABjTrNvkJp77A9CGoFr2KvppIM-veECc_rHnR_ATw==
16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
24 B
707 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
bSLSwZppFdHXrhemF0lDrn1oKnWHmidI
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
content-length
24
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fMkFcFAXrJBWS3Xq90IOCQxQZql4edLC44EVDxYpIbKjNrJlOjcy7Q==
16.2394064c.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
92 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.2394064c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 01 Nov 2023 18:06:41 GMT
x-amz-version-id
E5klQAQs3D4aAXVjfwX8.j3PQlETJSVe
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2237519
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
42
last-modified
Wed, 01 Nov 2023 17:45:49 GMT
server
istio-envoy
etag
W/"b3fe5876c5b8966c8af8f22496366c99"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RAF3VrDNHX5o8iEHH3LBwYliGrLKxanvVpNuUcAPttTqFnvEWUrY8w==
24.b6ed1466.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
50 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.b6ed1466.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
cedc3b05f6b82af9696f663cebb5afdcea4e495d8646316f30fa041b8530d9ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
uX9XQ33R8MHMUXsK6itOLSboNk6JZ1R7
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
21
last-modified
Tue, 21 Nov 2023 16:21:41 GMT
server
istio-envoy
etag
W/"b3b902de8819aee144f4219ddd27fe90"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mHeMfz4FtFuQ2GQxSnaLUz9CLLi92EQesr0WgISyJsTIK-NwkQ0tvw==
17.140f8b44.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.140f8b44.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6c103980ef9acd760daed97b96d96ccc68bd8dfd9085f963594b007c98ef599b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
jbdCNCK5HJaShZpsTFyBDk6DZsP5d1v6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Tue, 21 Nov 2023 16:21:41 GMT
server
istio-envoy
etag
W/"5aca76d118ed5ee582ce5ade6c0d8226"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xO5y8uk4UWLrxM8jYOfnKEd51HYbzXan-hV4_JtiAXDj5aHcUKdKmQ==
51.558be3c5.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
23 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
w0qbrI1odcdSkv4sxruOvmIO8c6P6eRd
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"fa281fcbe4b2e35558d60fae3e316367"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
I9gd9ZxyLSPF4J57fV7U5Us1A6RCmABLY7O8HcfaHH09W_PASEdOzw==
35.d0f1ccda.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
36 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
ugODpWCLtsTQf05E2RGcl4eR0QvJNWsW
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
29
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"46fa5a7bc37a22544a908e4ad950309c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
6cdHPuhX754dtQvnNRSo3dsYicSzkxf3VGw_jZEgFuKdLW_j_RL_rg==
22.6b9a301a.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
32 KB
11 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
Ky6QIkZiBGtiJJ5ArZwKu1e32zvPbxo9
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"d8739a9fe9a3a42936f5cd86c8727494"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
9q6ys-nR6EPB5NK9_jhisyK-YTQrM1_v7uJtb_xDHoIQWdjGi8t8PQ==
19.6f85b843.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
17 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
hSQ1C45siavtoncbP4dVLGc2JwP9P3B4
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
AvdlMCbV3dMzlgAPXZiLHZDII5-ryN3mN3qT9exFOKEHCDhVlm7FZA==
41.b4fc4de2.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
ST_dGdxBc4LtMZLFBge.wpnYWt7p0ji5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
BIFDtamWkxYvW2-ohZod6DjUYn1RekEsPV1J9adlf5qhGL84eSi_Zg==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 09 Sep 2023 18:42:47 GMT
x-amz-version-id
koF.ql6S6iU4L3DAmCcO8za68l9Cvk6p
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
6814554
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Thu, 07 Sep 2023 15:58:12 GMT
server
istio-envoy
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bBT2aIZTroLmeAN3Z_0hTXaRhBHJCgNsv91--U8uLs6VYjpvaa8asg==
26.04e7f30b.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
66 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
A48cJVKJSxyqaY6toJL0V5VmBK2YcQrr
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
44
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LliMrXcFdn7oibuLSFzus6vrXuA8nvjdK-b5zY5AkI0HdqjQBdruuA==
14.e24a6190.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
N5_fbXguvqHkSXdp93YYK8jXmF7bvtJA
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
23
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"16d7ae86e21434a32157d3226ac9bb77"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bRgU76XtCz6iQ5eBLaaxn2qBBMKp3nBGmhsyoSXM_kqHPI_VWHLjog==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
sxovHfzffiyEIJ7X_.Sm4lBRNFee6dop
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:47 GMT
server
istio-envoy
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
uUWWFGTSdmuEJfG6Z5_yhuHD6XSYJmqxUok4nTwWor9AzWLHG2aEJQ==
18.9c1bd1fb.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
uYT1yqnf39G62Ov6m1d8GLY9M8CCtDuD
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"02f09379c544befa413d22eb57ed41de"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
oRoACk2OGbl9ai3RKMOP4rhL96OpkvS8ZVla4o79xrp5qhaul7yS0Q==
49.f7274268.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/49.f7274268.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id
nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
10705522
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
last-modified
Wed, 26 Jul 2023 13:14:43 GMT
server
istio-envoy
etag
W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y2TRtJj7jsVzMOaS2dILvdL6KjXDMq3tHEKgpC0VdnsNH0ibk8EgDw==
40.31ef8dbf.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:26 GMT
x-amz-version-id
gojIfd5_r5SmuAcvpIgRwTeq0TepCiYI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
18
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"b0793fa46e8c0ae1846b7be8a833da35"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
79so89KNln9Tf4NJ_gSXHT6I_Si5iRNzX7acpBIbt8xzFXLoUxHz-w==
29.31d09948.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/29.31d09948.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 02 Oct 2023 04:56:51 GMT
x-amz-version-id
PyawGVolC84hpcWm6OWVT0dG84hVjB6f
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
4876910
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Thu, 21 Sep 2023 18:21:36 GMT
server
istio-envoy
etag
W/"455157cb49065fb85fed54901ddaeb0e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y5oc1mNbO9nP0zxSs-oUnmBj-UAOlkoeS-O0rWU2bOS_61GxImeSHQ==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id
g1ri2j1Cjjab.VdRD9o2Qfb0pzjBKg2Y
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5901107
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Mon, 18 Sep 2023 19:58:05 GMT
server
istio-envoy
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hsD-QVpnBtppDl84syIF54riQqmmpgIhs5EcauW1WFB2YSttiJ_baw==
8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame 7796
31 KB
4 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/8.7602338c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
jrWQnYyVlhsp63gB_Waa1icJoQNHHYda
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
46
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bElY283sk1_ycGZyOYiio0JtceFON3jYonbxzWscHNSFg0PaBOiwpg==
8.044769eb.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
81 KB
26 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.044769eb.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id
17DfV7s42f89YbincTHPPVmLUV_bhnjp
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2068460
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
52
last-modified
Fri, 03 Nov 2023 16:05:58 GMT
server
istio-envoy
etag
W/"44b93d3484fa424f7b36b2e344e21e24"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
6c-lj8Y2mdjESe_XqInG3Bvna_QRJ2GpuRzvrDoWSvR7s_cXXxttwA==
16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 7796
24 B
705 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
bSLSwZppFdHXrhemF0lDrn1oKnWHmidI
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
content-length
24
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vGQq3yXGuAghcCsKHcleuCi-gB4viVqB8DmdoWCoOYoUQDRevozfVA==
16.2394064c.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
92 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.2394064c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 01 Nov 2023 18:06:41 GMT
x-amz-version-id
E5klQAQs3D4aAXVjfwX8.j3PQlETJSVe
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2237519
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
42
last-modified
Wed, 01 Nov 2023 17:45:49 GMT
server
istio-envoy
etag
W/"b3fe5876c5b8966c8af8f22496366c99"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LPRraatl0186mDArSVbo9kXUjAGkDpww98P7SSGJdJ5PL58Zj0gTTQ==
24.b6ed1466.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
50 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.b6ed1466.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
cedc3b05f6b82af9696f663cebb5afdcea4e495d8646316f30fa041b8530d9ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
uX9XQ33R8MHMUXsK6itOLSboNk6JZ1R7
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
21
last-modified
Tue, 21 Nov 2023 16:21:41 GMT
server
istio-envoy
etag
W/"b3b902de8819aee144f4219ddd27fe90"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2P_t5T1Oh6nzqnp0V6VcbOEqtQSP2ejzLvO2nqXdXUrPZZpAR-VjBQ==
17.140f8b44.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.140f8b44.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6c103980ef9acd760daed97b96d96ccc68bd8dfd9085f963594b007c98ef599b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
jbdCNCK5HJaShZpsTFyBDk6DZsP5d1v6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
36
last-modified
Tue, 21 Nov 2023 16:21:41 GMT
server
istio-envoy
etag
W/"5aca76d118ed5ee582ce5ade6c0d8226"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_Vz-8tHBp5tCMu9Zj2xaK8tYzxdsNmuxbU3Cc1XFAw4gtQlz9KrPIg==
37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
hCf8phYuemcgoEPlZCjTy2m0Id0.GkCC
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
22
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TgAl-mNjnb2FsI2XICaBALUD3W-u0WUe1ReZew4D5G712CcvI_JxJw==
37.298cbb69.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.298cbb69.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
4Pv6uNXMEr1V_bcIARSkrGZ5UZXkqULI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466073
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
63
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"86b289eeb2bf9d30034f30d9794e8041"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FZziFpwr1ULaLIzTsAp0E7BATJshhI9BylXFYZh_7KwNyuoA-jc4SA==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id
N.P1rsR6Ulh0hyhpF1x45w2GtJbK5a1j
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5062941
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 29 Sep 2023 23:27:53 GMT
server
istio-envoy
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wRBJHojjUr4LxtYL30ZS3_9Xz0hk5Z5zse-vuNZeMTqG35hyxTukcQ==
27.01c2bea5.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
35 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
.IG3hjPvhTZAtXnAHs6o5ljvIzzjnZ.t
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
16
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"04a233a42dcf8c50a83bfecea8ba552d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jn94MRPb6iW3d1BBLPSD1EsoVXtqDeGYLkm5tDDlZJ_UZnYg3PpM0A==
28.b5e8f5e1.chunk.css
js.driftt.com/core/assets/css/ Frame 7796
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/28.b5e8f5e1.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
AFM.froK8Qw0ZtUvorUczVm7T.RT1qt4
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
38
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
W/"e7107bc29ccb3c6d928f0f8f10a0f22d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LIjLrlyc0Knd0iAFwNFk2FpQcDl8ruylc-PbGxZGpvb1rj4ZqDwH8A==
28.bdd92ff2.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
14 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.bdd92ff2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
08UBw75LMOW4PTzPTebwcEHykhb9NuLk
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
83
last-modified
Fri, 27 Oct 2023 17:57:48 GMT
server
istio-envoy
etag
W/"260fbabe310bd2cae5c44538f3d833ad"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
SInFNnZDyFdludww75sZqj-af0m6opExsU7gbvxD4_oWWGj9MI_sAg==
25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 7796
365 B
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/25.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:27 GMT
x-amz-version-id
ilu_7Ae7WvHcQeZoj_ZREff.3GwXAGVB
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
HAM50-P1
age
2466074
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
70
content-length
365
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
"06b2963b029c0824382815165bfea73e"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
6YNhZsMQAY01N5LRQ89MddnOmVAVVABiij6IHhBTnrmd2IWdMey6XQ==
25.a6216a28.chunk.js
js.driftt.com/core/assets/js/ Frame 7796
91 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.a6216a28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
5cca4cddd4f59dc1890d79a18b1dd68d69c68e4c28c568d7edca037a2dce1979
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?d=1&embedId=sv2uuh4gw3ms&eId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=3488c935-92ed-4fac-8844-635b40013671&sessionStarted=1701099520.893&campaignRefreshToken=b184bedf-537a-47e3-86eb-97db4b928f6d&hideController=false&pageLoadStartTime=1701099518292&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 16:39:02 GMT
x-amz-version-id
9mlLoc0dRXl0hXBoCbQBVq1nQlfFX_0K
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
514779
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Tue, 21 Nov 2023 16:21:41 GMT
server
istio-envoy
etag
W/"19611a790aca824f3a06d4fa0aa0f651"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0r_mI7GJlBwyZVk3Xesc7Lv7X5JatjGTzfr4jb2FKfMUQwTnEykqzA==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 30 Sep 2023 01:16:20 GMT
x-amz-version-id
N.P1rsR6Ulh0hyhpF1x45w2GtJbK5a1j
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5062941
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Fri, 29 Sep 2023 23:27:53 GMT
server
istio-envoy
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MB9NpRKKWesaawPB9sclpFIr5X3t5qQinpJ-Cs623pVsRwp4rjLXoQ==
3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 26 Jul 2023 17:53:21 GMT
x-amz-version-id
Ov831I2a5yEZEgVNkzjL3jR4iYT4qeoU
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
10705520
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
40
last-modified
Wed, 26 Jul 2023 13:12:09 GMT
server
istio-envoy
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
r8hLhl6xVw88FhdBvSteMReT8PcMEyvQ-y05bhAphKQn750GkzVE0w==
3.f50b964b.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
54 KB
15 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 08:26:55 GMT
x-amz-version-id
Kynz7_sRLMeatVgI4HEORmIIXnKig1_t
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
5901106
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
37
last-modified
Mon, 18 Sep 2023 19:58:05 GMT
server
istio-envoy
etag
W/"1ac37bf2b93050f29058b66a9ad43e10"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1Tcebb5_a-IzaoCZN40gpp27nhlXhJMvnkxAEvKPLE_vTNagi8pF1Q==
1.12ba17b6.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
44 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:28 GMT
x-amz-version-id
WKmcreNC98KAxkGhkxeOM3byfUi36vM0
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466073
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 27 Oct 2023 17:57:46 GMT
server
istio-envoy
etag
W/"3b8ba82e1bac13ee29e9764a55620d99"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
G2R-R-MmzkAJbjcjm4KgtKWoFo4tfaQOAAO0G6ZfOjMmMfJL3pO8wA==
1.2aebee2c.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
54 KB
18 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.2aebee2c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:28 GMT
x-amz-version-id
K.K9i30yDOTblsE3cl.mJf9pmPqlfKfb
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466073
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
55
last-modified
Fri, 27 Oct 2023 17:57:47 GMT
server
istio-envoy
etag
W/"8dec138e62d799d028f8c7ed0cc19058"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ok0Z6NOnX4LcAyc9UCibLpPweDOvMpJ4CyX_3BaeYpxK1bMvyE5DSQ==
4.9d776499.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
23 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.9d776499.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 25 Jul 2023 18:55:58 GMT
x-amz-version-id
uGJ36CDXFf5jc7zFgfXUohqg1i8mPHWM
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
10788163
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
17
last-modified
Tue, 25 Jul 2023 18:08:15 GMT
server
istio-envoy
etag
W/"cc02ad980b6b04f3bba61e68883356d4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bpFUeWazDA7bDS8HAKQHzQWry20RWY842aLMvq4g0X9URCHwpoIrMA==
34.d13ab69b.chunk.css
js.driftt.com/core/assets/css/ Frame F83E
16 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/34.d13ab69b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
7c8b113cce07a87ca4cb9dc4f1c55d701efd44834430e1939c27b2e5e1c12ac1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 03 Nov 2023 17:04:21 GMT
x-amz-version-id
pFWMvJB2j2wrLwpXYClAbSTx9Ncr0bnJ
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2068460
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
19
last-modified
Fri, 03 Nov 2023 16:05:55 GMT
server
istio-envoy
etag
W/"cd2168c34ad30fc16e40bb8888419c0b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TSvzZ_bAidSxM9ak8i9gi_G63jO2_doaoUFX4YPF5_2_cJqcFU1QHg==
34.565cc93a.chunk.js
js.driftt.com/core/assets/js/ Frame F83E
13 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/34.565cc93a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f52bd0ba.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.155.145.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-155-145-87.ham50.r.cloudfront.net
Software
istio-envoy /
Resource Hash
08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1701099518292
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 30 Oct 2023 02:37:28 GMT
x-amz-version-id
vSSxkYn6PDQ51XDj25hbIMFtBbFYJSvx
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 fce8106dca6331a9ef447b7d400205f8.cloudfront.net (CloudFront)
x-amz-cf-pop
HAM50-P1
age
2466073
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-envoy-upstream-service-time
15
last-modified
Fri, 27 Oct 2023 17:57:49 GMT
server
istio-envoy
etag
W/"57c0a57c3cf808c4592182b4c490b3a0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lc46bSiXxBQe3UZWL13iPd9TqOwQY0kFBDbdF4rMBF8mMM8Y6iEPkg==
v2
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame 7796
207 B
646 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
443746c308fe991b78c8f840b5e110cc95bb7e0f4a3964cc9484496e413f3d59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
d686e2a030c297c6
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
8
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
207
config
api.equally.ai/api/v1/widget/
22 KB
22 KB
XHR
General
Full URL
https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=05cb1f3e8765472d22a062dba89e74b0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.56.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-56-144.compute-1.amazonaws.com
Software
nginx /
Resource Hash
adb73f5a682a31bf070e2e7955caa7433f0175b15e39f76b3dc5fc45be088eb7

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
X-Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 15:38:41 GMT
server
nginx
content-length
22378
apigw-requestid
PEGwUg6IIAMEJGw=
content-type
application/json
config
api.equally.ai/api/v1/widget/ Frame
0
0
Preflight
General
Full URL
https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=05cb1f3e8765472d22a062dba89e74b0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.56.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-56-144.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
x-referer
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
access-control-max-age
0
apigw-requestid
PEGwTh3CoAMEJ0g=
date
Mon, 27 Nov 2023 15:38:41 GMT
server
nginx
services
sumome.com/ Frame
0
0
Preflight
General
Full URL
https://sumome.com/services
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.215.250.209 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-215-250-209.us-west-2.compute.amazonaws.com
Software
nginx/1.21.5 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
x-sumo-auth
Access-Control-Request-Method
POST
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods
GET,HEAD,PUT,POST,DELETE
access-control-allow-origin
https://www.trendmicro.com
access-control-max-age
2592000
date
Mon, 27 Nov 2023 15:38:41 GMT
server
nginx/1.21.5
services
sumome.com/
124 B
541 B
XHR
General
Full URL
https://sumome.com/services
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.215.250.209 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-215-250-209.us-west-2.compute.amazonaws.com
Software
nginx/1.21.5 /
Resource Hash
88d1d0dd8730d866219619561304b3b5c22e3999a59dab5f70b88384312eff0f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

X-Sumo-Auth
hcu16N5COYmYDXrCt13hR34W
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
server
nginx/1.21.5
x-frame-options
SAMEORIGIN
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.trendmicro.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
content-length
124
img.gif
b.6sc.co/v1/beacon/
43 B
486 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A40%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222005%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
v3
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 7796
25 B
89 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v3
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
57ab6bca07be50db
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
15
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
widget_bootstrap
bootstrap.api.drift.com/ Frame 7796
43 KB
13 KB
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
fa30c62b357bcfb917c369e75bb02351e336bbb6b282de80b72b5db72529f1d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
server
istio-envoy
requestid
30bd0fea98866152
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
354
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
6.ce9d3b69dd1815269e54.js
load.sumome.com/
95 KB
32 KB
Script
General
Full URL
https://load.sumome.com/6.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
21b4b5ff7892c77646bc393bfc752994256c973b941efa1aec36293a69fd2f44

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1082
x-amz-request-id
89W2NSFBV75H5YQ1
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
CkJq8tyhUClqtTLpaPU3pNWgdG+HZ3JyUkuGXhvBP8ip+/WibRbQMLNFXHDEmevSeLu2aNCKuZI=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"6f4c087b28164d947a47fb62257f909e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
39a6d756033936c640896530ebbe6a9a
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
7.ce9d3b69dd1815269e54.js
load.sumome.com/
5 KB
3 KB
Script
General
Full URL
https://load.sumome.com/7.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
b9e78be0f5224e190705834d95672a44d55bc8f81a20c4f1c5d00d0a5aacd4d4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
89WCY3107VXXJJF7
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
x0OubzfoXk4/4RwHaxLVDQ6Ujjc4tUqvgmK0iwEPxiGiNv53TiIa07dSewACHaVCqPLzSikyLnQ=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"a862561e5de97b31ada3930894ce0b62"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
1d98a2563cc67760c448d2c8bad65e8d
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
3.ce9d3b69dd1815269e54.js
load.sumome.com/
3 KB
2 KB
Script
General
Full URL
https://load.sumome.com/3.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
e833b1b7985a4d05ae0fc5e7a9414f3faf83686d39113ebcf7caf305e7950aaa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1082
x-amz-request-id
89WFHSTJW1PC964C
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
Tepn3JzMQEf1q/meoXcyXFLsgtZos9QAE1pBevjQQYbuQUcuunTg3pM9JBfSA+NfEN0L2OCNWQA=
last-modified
Wed, 15 Nov 2023 23:55:49 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"9d03ccd6006f71971d8f911341c7a65a"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
2fed1d26d887cadf055b5d1e9d893b12
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
9.ce9d3b69dd1815269e54.js
load.sumome.com/
11 KB
5 KB
Script
General
Full URL
https://load.sumome.com/9.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
49effd3bbbb1dddb200fbd1272f0e7df5af38625de89f6c8c1f226013ec477e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1082
x-amz-request-id
89WE3J31JA2KMXSF
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
ZcSt2OwFYxMRBCf0stIJjFBpaskbzQauiIX7UUyYmmR7CJMs0DfCB349zvG+CnvEuAVvnUG2YUM=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"568694d3b0dc7e18e01f77ae4d9fac05"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
4f5649b58c9b0849e666ee81b8a2230d
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
22.ce9d3b69dd1815269e54.js
load.sumome.com/
393 KB
112 KB
Script
General
Full URL
https://load.sumome.com/22.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
33a08de9d079cc66b081d02be5d55bec5c60fe10820447395e62e01192bfbd59

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1082
x-amz-request-id
89W0P1V1M7N25AGY
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
DUXJji4VwgT9UHK0nH4tjHR9ZPw5nGNLdEo4iexGGszkVUDYYq4o0o56mb+KfL5wmB7Nm+FD2kE=
last-modified
Wed, 15 Nov 2023 23:55:49 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"9b6511a589c2f43e688980efb584067e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
55b35e3deb241ad62248981597bcd191
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
21.ce9d3b69dd1815269e54.js
load.sumome.com/
175 KB
51 KB
Script
General
Full URL
https://load.sumome.com/21.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
e0e14a820179ab3f4037ececb74d17682f3f2620e0735c36a5c3514cc8fb2fd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:41 GMT
content-encoding
br
cdn-edgestorageid
1081
x-amz-request-id
89W9W09T5P0MCEYZ
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
z/W2qZFyie+aFZ2dNE+goZvyihh4rbeOCvrnC9W4RX7djTsMbOBs3WQUFLJHNt7IsmAqC+CS/nU=
last-modified
Wed, 15 Nov 2023 23:55:49 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"37c125ef38c68c4f7f098147ced4e3f9"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
605b4a7cf296a639dce47e708c49ed30
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
config
api.equally.ai/api/v1/widget/ Frame
0
0
Preflight
General
Full URL
https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=05cb1f3e8765472d22a062dba89e74b0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.56.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-56-144.compute-1.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
x-referer
Access-Control-Request-Method
POST
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
access-control-max-age
0
apigw-requestid
PEGwXimhIAMEJiQ=
date
Mon, 27 Nov 2023 15:38:42 GMT
server
nginx
OpenDyslexic-Regular.otf
widget.equally.ai/fonts/
0
0

config
api.equally.ai/api/v1/widget/
27 B
159 B
XHR
General
Full URL
https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=05cb1f3e8765472d22a062dba89e74b0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.56.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-56-144.compute-1.amazonaws.com
Software
nginx /
Resource Hash
16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776

Request headers

Referer
https://www.trendmicro.com/
accept-language
de-DE,de;q=0.9
X-Referer
https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 27 Nov 2023 15:38:42 GMT
server
nginx
content-length
27
apigw-requestid
PEGwYhELIAMEJPw=
content-type
application/json
en.json
widget.equally.ai/locales/
10 KB
4 KB
Fetch
General
Full URL
https://widget.equally.ai/locales/en.json
Requested by
Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f3d804706c6ccb7955d146f5b9a86c200ee5788031e0c8601a0d758da2ce6e54
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 12:35:33 GMT
content-encoding
gzip
via
1.1 a4f5633e78f92f983940236e96220232.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
18968
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"c8654951b307d59acadb3324470b6d22"
access-control-max-age
3000
access-control-allow-methods
HEAD, GET
content-type
application/json
access-control-allow-origin
*
vary
Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
x-frame-options
SAMEORIGIN
x-amz-cf-id
XzV90tI5rG2fxCAJYKcrRJYfhfHIgPbTZ3CdV3VN13l4czaBupCrsw==
0.ce9d3b69dd1815269e54.js
load.sumome.com/
5 KB
3 KB
Script
General
Full URL
https://load.sumome.com/0.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
aa306e3f9d8088342bd9b2782ae2d5aec86d705fbe6582d7f162f7258672fbef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:42 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
89WAXKK57VE59HS9
cdn-cachedat
11/16/2023 00:10:19
cdn-pullzone
1686293
x-amz-id-2
jBP49pybisDSdbO+Pi6Y5p27DWjX6dhy/PAWRTRxx/ZeCx0OQItcBAJvvcT2d5Q1piwSSyhFJmM=
last-modified
Wed, 15 Nov 2023 23:55:49 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"83819fa0ff76bb1a8c38339998b60f70"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
d9043fc53759140ae0168601c2dc5807
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
94.ce9d3b69dd1815269e54.js
load.sumome.com/
1 MB
79 KB
Script
General
Full URL
https://load.sumome.com/94.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
ea05ad76e8d224961ca5fd4a3b7d0d00eb2c2322346ce81bc0c0112beb001594

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:42 GMT
content-encoding
br
cdn-edgestorageid
1080
x-amz-request-id
NRGJXCAWQ2CX3A7Q
cdn-cachedat
11/16/2023 00:10:20
cdn-pullzone
1686293
x-amz-id-2
a/cTL3kFsuTnL/GmhwdYBK5HD5bhz5SXFnEw9Bz04wjuM+rSyepYtyECq4rzzq/2fHXXxO74N5Q=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"2c1c97212628e38c04a9bdc6a6d98c26"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
d71480d9caca16969636b42b8f86cfb2
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
96.ce9d3b69dd1815269e54.js
load.sumome.com/
221 B
763 B
Script
General
Full URL
https://load.sumome.com/96.ce9d3b69dd1815269e54.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
3cfb3d15a79010b9427845e8f3f1ac5b740ff60f7c0f28d241420fad9275d51a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:42 GMT
content-encoding
br
cdn-edgestorageid
1082
x-amz-request-id
NRGPDP3JCEXRVDQ7
cdn-cachedat
11/16/2023 00:10:20
cdn-pullzone
1686293
x-amz-id-2
pwCCrzg4iS6hSUBRrKp/8fQhg+i3iulP6W8HDuUmEfZbRb/0c6sp2yKs7ulsIQQblVRwKIRpRI8=
last-modified
Wed, 15 Nov 2023 23:55:50 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"3a6030bbbfe46a13e32a2bd0a3c25620"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cache-control
public, max-age=2592000
cdn-requestid
534f8b96ce9ebf8292504d48a49d367b
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
css
fonts.googleapis.com/
32 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
df3f46edd3dc78e34e7b8df01b494936e06e68f1566df5666d3a9e502b040b27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 27 Nov 2023 15:38:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 27 Nov 2023 15:16:19 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 27 Nov 2023 15:38:42 GMT
features
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/
0
0

features
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ Frame
0
0
Preflight
General
Full URL
https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.215.250.209 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-215-250-209.us-west-2.compute.amazonaws.com
Software
nginx/1.21.5 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
x-sumo-auth
Access-Control-Request-Method
GET
Origin
https://www.trendmicro.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods
GET,HEAD,PUT,POST,DELETE
access-control-allow-origin
https://www.trendmicro.com
access-control-max-age
2592000
date
Mon, 27 Nov 2023 15:38:44 GMT
server
nginx/1.21.5
equallyai-widget.css
widget.equally.ai/ Frame E134
32 KB
7 KB
Stylesheet
General
Full URL
https://widget.equally.ai/equallyai-widget.css
Requested by
Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
652efd827c7d4bdbc5062da31da261ea6aff861b1735ab640eb5aea11e52deda
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:00 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22065
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"f36e46b286460d4bdf52555bcf3c77fc"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-amz-cf-id
bZDw4QYtByDYtl5lUK4kBRd_Rw8-uYqsSH26ooj8XD-_7aIMezaExQ==
en.svg
widget.equally.ai/flags/ Frame E134
1 KB
978 B
Image
General
Full URL
https://widget.equally.ai/flags/en.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8f57ae36e7533f330d488d78955b84759053d8890dbc12a940f5f16c0169c47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 19:50:44 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
71281
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"ebf36f856cee41bb0004b1be873bc62f"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
T02Sd5HFnlKtDg-IbKrfUlV8oElz5In4Wuo7TNhCkFIiv3Xg33YfuQ==
es.svg
widget.equally.ai/flags/ Frame E134
148 KB
36 KB
Image
General
Full URL
https://widget.equally.ai/flags/es.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f8b2beb661f2060ad9acfc574d17fb9b51d984c3ec4559defc2360a1192ba667
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"ce15a45bbe7193fd267a2b79f695f851"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
R3fC2UHs_7Kr2YI_4US6mqL2-Q9GOQijZgJ34OdRgLV9nVKv1SKYpQ==
de.svg
widget.equally.ai/flags/ Frame E134
411 B
918 B
Image
General
Full URL
https://widget.equally.ai/flags/de.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
22c3fd46dc28317aef90042c0753148aa68707737146640e11165d6df6c02178
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
411
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"53d375e4d05c0f07c61381c149666a95"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
j1HYn3LiuoUu1lyRSZOW69oEQiJdz_iF04w9v72OdfHKny7iM8KvWw==
pt.svg
widget.equally.ai/flags/ Frame E134
11 KB
6 KB
Image
General
Full URL
https://widget.equally.ai/flags/pt.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
42f2a22d45c6f2d8ba1ebc17ed8b417762baeed4f314c68deb39d8534b8f8ab0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"3db75d5500aac310ba9be72fe78c09a0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
fqqyvRat0B61drUVQgsN0SUuOCDTxp5ygYnS5LCORyXIeKUq5oJh0A==
fr.svg
widget.equally.ai/flags/ Frame E134
468 B
983 B
Image
General
Full URL
https://widget.equally.ai/flags/fr.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3d85ea6dbd284d131f55a919eccaf1eb6bc6b8b57804859ee984bc57bb931a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
468
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"aba229ec8b9399af14875fba8715b4e5"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
5nedig4n_kI1TJHmxn8I4V8IrFkSAOu4Wzp7WTLeGlo3iqeCjCo7aw==
it.svg
widget.equally.ai/flags/ Frame E134
202 B
709 B
Image
General
Full URL
https://widget.equally.ai/flags/it.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
985a85728ad37064b2b77bf64f50abedc823aee1f9f85918aa1adbb54e6af176
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
202
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"4f6374bbba141514028cfee25e6b8b50"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
uL8qz3dDQpENrrNy4ZdAm3m3Fwpw3xR8f6U4yn6GUEqT25d_zU693Q==
ru.svg
widget.equally.ai/flags/ Frame E134
232 B
748 B
Image
General
Full URL
https://widget.equally.ai/flags/ru.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8b719965d947ab374c07d0da488c475e73334fc9ca9f2c970f0c176ea609f0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
232
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"8c35008bdd453eb7092e5589433ee345"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
cAfD1t87YJG9MOToXn9Yh53SNYAvHpnfssz0HTPFmT3eIBpjqbb38w==
nl.svg
widget.equally.ai/flags/ Frame E134
175 B
691 B
Image
General
Full URL
https://widget.equally.ai/flags/nl.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0d04d9eadc49c5514881c1c3f7c465a10a37ead378bc5e61cf96fdfcb3599e54
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
175
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"5f6ef944bbde5608a5cfd566abc3a61a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
Eo_gBtmJtVlFTk-xgT7S95TtnZJcYAO1-_XNVJBc2rldsxEzNfCCtg==
pl.svg
widget.equally.ai/flags/ Frame E134
142 B
658 B
Image
General
Full URL
https://widget.equally.ai/flags/pl.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
608e5ed6a0820b02ac00e5ee7457a9822b5e5c1be9cba69d17c5a3e9ca4a4377
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
142
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"e2afe0f6676f52f2142f71e9b3570e81"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
VcOQBFAb8LxmE7m5e_x7CwPgdgduD8C53muZ4JWSDnYyZX6N0Ji-Uw==
bg.svg
widget.equally.ai/flags/ Frame E134
294 B
809 B
Image
General
Full URL
https://widget.equally.ai/flags/bg.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3beaf2aa05abc754a560f723315ba58156356abc654d952382c6e6bb60cfb7f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
294
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"d35abad4c97cd9e2b3cc342cb745d11d"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
hYGoFHEcU7fq-tfkrb0vwxEh68rJOvvhGiG-aGkTaf70OUG7qtIV1Q==
he.svg
widget.equally.ai/flags/ Frame E134
856 B
1 KB
Image
General
Full URL
https://widget.equally.ai/flags/he.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0d86756671757b1622e49e7b1405334d749dc18b0377b422fa0b8a0c493d9dc6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
856
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"39aa6f7e5890377271d5434c4f76386b"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
zjO8p4v3GZ_n-XRNYmsKpiKds7LjUIRrKWWQZo2Ni9Can84290sN-A==
cz.svg
widget.equally.ai/flags/ Frame E134
212 B
718 B
Image
General
Full URL
https://widget.equally.ai/flags/cz.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a71bcb7e97223bdca2ff6105c4e261e96eaed1009d6326c404abe20011ed7dad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
212
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"047e732decd62b9d3ce350a2cd8f4de6"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
z1lKgCNzTsFlmRSRtxp6-kHj9DwetuTuoq9LMa13cJW_yDKOyaPpZw==
dk.svg
widget.equally.ai/flags/ Frame E134
222 B
737 B
Image
General
Full URL
https://widget.equally.ai/flags/dk.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
dc4827058fb343b6fa6383fb5e3471f4ab744a82d0f6ec9d895e8ce5d2a969ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
222
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"c0cd63470ccdd66eb1b70437c4897d2e"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
T2sCOVkmCuOUc5a9NJsU2IPCrKeuUsVz-SRAXi0J3LV1Rlix6AXWzA==
fi.svg
widget.equally.ai/flags/ Frame E134
233 B
749 B
Image
General
Full URL
https://widget.equally.ai/flags/fi.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f57f5b4ec3968d3127d25c1ba8973b593df0bfa8171a12d7c9f399a038ca071
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
233
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"079f4bcbd1f4a3a2ac55d1071961eaa4"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
UlcWQuLCSsCpwJB5b-5IZhXyX-l84N28dJBLxYP4uNehD1470hGVjw==
se.svg
widget.equally.ai/flags/ Frame E134
216 B
731 B
Image
General
Full URL
https://widget.equally.ai/flags/se.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1d7c3fc0594c8fb856d9fd0a13a752dfaf8643c8b073582909c88be24e7e416f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
216
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"1f642770ccba1a8f5948ac69923c15ba"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
QRiotXRu-6aYsFe91T6x3QXzbKuxzQHNF9FkGeSmT7Pfn-lhydC2qg==
lt.svg
widget.equally.ai/flags/ Frame E134
178 B
683 B
Image
General
Full URL
https://widget.equally.ai/flags/lt.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
429d40e370103a47cb2fa03e143136308ce0ad387fc05acfff349d40406440a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
178
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"60ce52ef375f0a7bf84149719ad6a8e2"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
0mjT5vOodETqBaq5DJo8FzeMxYkTeIs1efjpxRbYiDDjwcU1jgurtg==
ro.svg
widget.equally.ai/flags/ Frame E134
178 B
687 B
Image
General
Full URL
https://widget.equally.ai/flags/ro.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ea3e3c17cfd414a403313ddc73a62a264cbc205d962214e272321566e0d78ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
178
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"a9e8cdfefb0cb78dfe786276f500656a"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
h1OUWLGsHgpIJQK_CZDE7lNR5VjsKRBqRXf0kU-vNFVIGQrHAPB3Dw==
gr.svg
widget.equally.ai/flags/ Frame E134
206 B
721 B
Image
General
Full URL
https://widget.equally.ai/flags/gr.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
86cce2a11b19e83087b4ea15be2c293563f8dc90df958488174c2194e2adac07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
206
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"abd7d677957e863655f6bc059dbaebfb"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
hZmaaAaPBxc7QZ9ORmqB2HcJfj0dhwe5Y3nSxKsszegBY6Fb0N1jXw==
hr.svg
widget.equally.ai/flags/ Frame E134
66 KB
29 KB
Image
General
Full URL
https://widget.equally.ai/flags/hr.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ecd619e1013f1de98ab10d4693d8d17ff1924494c099aaef02b0700636b51339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"f4e06f4da88eab5e630a6263b8f5ebdf"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
p65MCdFoyo8VlscNzR1vYZRb7tHj4vz-0Hw61gdQB9wNTUiThadzvw==
lv.svg
widget.equally.ai/flags/ Frame E134
138 B
653 B
Image
General
Full URL
https://widget.equally.ai/flags/lv.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
442240b6d0d4290a8a5bf289beae6d52665dc71f7cb529034682c8fdcf313bb1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
138
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"12cebcfb5d166f7cd2b6a3fb48c0924d"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
HVZxV3oDuhlYX0w2ClWLezfs978fGOyENb9fj43TyT-i5rg0vVhiuA==
sl.svg
widget.equally.ai/flags/ Frame E134
2 KB
1 KB
Image
General
Full URL
https://widget.equally.ai/flags/sl.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aa4fda18694f1e60c937933eebd752cc3ed0701652f0dfca84677c3267b26db9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"9b4bb3b189e8285e10fc2637df225958"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
d-JFaP2uPuIEhc29k9mInZBfz3tARXaqTcguG1-taqS--uWaIgMlTw==
mt.svg
widget.equally.ai/flags/ Frame E134
15 KB
8 KB
Image
General
Full URL
https://widget.equally.ai/flags/mt.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a5c2eee915ed72695afcc7898018bf57c41e62c9b7b964e8de8bbbec9e895d2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"66e76e37d320e1ef728362a420f7eb3e"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
6LvR3AmNErOLy8btpRCI33qps7G4sLvfSIoUuguZyiMYi0bOvksv1A==
sk.svg
widget.equally.ai/flags/ Frame E134
1 KB
1 KB
Image
General
Full URL
https://widget.equally.ai/flags/sk.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
645f75dbf15f9931d4c25509f2d3b55e8be7d97209957535382ecfd96658d7b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:32:30 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
21975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"45bde9f51532f5f7cc44fa912e57fa26"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
yixJ0et6_IRtJxJb56SRGlgFI1Aq4ClpgTcoavIr6x2FlartyzCxzg==
ar.svg
widget.equally.ai/flags/ Frame E134
28 KB
11 KB
Image
General
Full URL
https://widget.equally.ai/flags/ar.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b0b36326e3e5b74624ee8b5de8273ea00f7bbe9b5ba0da6250cbe7b3c637505e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"1b79db27bb882afead5050e6fa59818c"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
WI2zlMZBQ7EPyNPj4RumbEY4Uh7HMeV7AZS7_8PBTuAdQ_04Ta9r-w==
ja.svg
widget.equally.ai/flags/ Frame E134
209 B
725 B
Image
General
Full URL
https://widget.equally.ai/flags/ja.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
35e785339e19d1ec1987cb9c3d8e66fc97f29a287db0b0b590b8dfdd96d4766b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
209
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"a1e1ea513a3fcd801e85db4373ce8cd6"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
gvzl_yv2rJ18A-KYG2SXgCSk5VxhFF_WUoJFzJ3kU8TVq49eI2GGrg==
zh.svg
widget.equally.ai/flags/ Frame E134
589 B
1 KB
Image
General
Full URL
https://widget.equally.ai/flags/zh.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2992931db929f1541337b2427833930743899025888d5df0cd8359179c3a6eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
589
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"70f58c27d22d2fc42e3ae42109a6165b"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
7s-jOJQ1XG2Td4KFePOjhrdzmaFtPE_IWDV98_8lZvvE1ODeW_Sq3g==
ko.svg
widget.equally.ai/flags/ Frame E134
628 B
1 KB
Image
General
Full URL
https://widget.equally.ai/flags/ko.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
557804ca07c2ab312bddc4c711c548563a1302a25eeebbff8dae19cbd4cc5e3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
628
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"10679d585c351917622b94494b8a0329"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
gc4CKnHMcA4PqdHVzXwVYTTxm3A35F2qpDtHoxh3RndxNqFMGSuGng==
sq.svg
widget.equally.ai/flags/ Frame E134
8 KB
5 KB
Image
General
Full URL
https://widget.equally.ai/flags/sq.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e223abdb13c475b827e74fa29a44a98e26675402fb46513eadc875faca72305e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
content-encoding
gzip
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
W/"9ca1e7c55a76c6f0c5b34c29ed911c8f"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-amz-cf-id
BPw0Jy0NMHh7yg4Z6GhzDeUlGn0MUYhvmsjMei3hXbzFu8oxyqLOMQ==
mk.svg
widget.equally.ai/flags/ Frame E134
416 B
932 B
Image
General
Full URL
https://widget.equally.ai/flags/mk.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.243.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-243-43.ams58.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5a9c8a96b2d409c2295838d5e7c6182170f35aba3ec747dc2a818b96d8e8b23d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 09:31:37 GMT
via
1.1 9bc84c94880403a2bdfe0bc8f1800e4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-cf-pop
AMS58-P1
age
22028
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
416
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Oct 2023 09:56:30 GMT
server
AmazonS3
etag
"93c15186533262b4a99e531c484d4459"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
Rv-b-D1zj1TOYlNKrjbV1SO2lCVGAWucgt-fXRla9U590u8ODlWpJA==
img.gif
b.6sc.co/v1/beacon/
43 B
487 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
487 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A42%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event3/ Frame 7796
25 B
113 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event3/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 27 Nov 2023 15:38:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
a93db12434677568
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
13
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
img.gif
b.6sc.co/v1/beacon/
43 B
486 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=4d46ddc2-5c93-4820-8202-64fff599e4f6&session=7157de85-83a6-4c8b-838c-b72eafaa86d8&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2027%20Nov%202023%2015%3A38%3A43%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22We%20detail%20the%20modular%20framework%20of%20malicious%20Chrome%20extensions%20that%20consist%20of%20various%20highly%20obfuscated%20components%20that%20leverage%20Google%20Chrome%20API%20to%20monitor%2C%20intercept%2C%20and%20exfiltrate%20victim%20data.%20%22%2C%22keywords%22%3A%22articles%2C%20news%2C%20reports%2Ccyber%20threats%2Cresearch%22%2C%22title%22%3A%22ParaSiteSnatcher%20How%20Malicious%20Chrome%20Extensions%20Target%20Brazil%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&pageViewId=96b23a74-13f0-4a10-88cd-72130be94824&an_uid=0&v=1.1.11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-184.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 15:38:44 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 14:29:28 GMT
x-content-type-options
nosniff
age
263356
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2024 14:29:28 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 14:29:28 GMT
x-content-type-options
nosniff
age
263356
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2024 14:29:28 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 14:29:28 GMT
x-content-type-options
nosniff
age
263356
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2024 14:29:28 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/
47 KB
47 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 24 Nov 2023 14:29:28 GMT
x-content-type-options
nosniff
age
263356
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48432
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:40:31 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Nov 2024 14:29:28 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v36/
49 KB
49 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a246c4de8a0f1f1fdb6ee52565018dc341063aa9efe8481034bc3ef7d697e334
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 12:35:48 GMT
x-content-type-options
nosniff
age
97376
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50368
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:04:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2024 12:35:48 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v36/
49 KB
49 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v36/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:200italic,300italic,400italic,500italic,600italic,700italic,800italic,900italic,200,300,400,500,600,700,800
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a246c4de8a0f1f1fdb6ee52565018dc341063aa9efe8481034bc3ef7d697e334
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 12:35:48 GMT
x-content-type-options
nosniff
age
97376
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50368
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 01:04:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Nov 2024 12:35:48 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
5427711.fls.doubleclick.net
URL
https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=1349609714562;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;gtm=45He3b81v72003116;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html?
Domain
9572106.fls.doubleclick.net
URL
https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=2315715416687;auiddc=1240429162.1701099519;u1=%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html;gtm=45He3b81v72003116;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html?
Domain
analytics.twitter.com
URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=2d31a325-47e0-41dc-94d4-10d3dfea35a1&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5eb49fbf-148e-42bb-95cf-9439c1a1fc53&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.29
Domain
analytics.twitter.com
URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=c4b80526-2e3f-46df-a5e4-2e1090f4721a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5eb49fbf-148e-42bb-95cf-9439c1a1fc53&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&tw_iframe_status=0&txn_id=nuwoi&type=javascript&version=2.3.29
Domain
widget.equally.ai
URL
https://widget.equally.ai/fonts/OpenDyslexic-Regular.otf
Domain
sumome.com
URL
https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a

Verdicts & Comments Add Verdict or Comment

260 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| documentPictureInPicture object| OneTrustStub function| OptanonWrapper function| $ function| jQuery object| matched object| browser object| Granite string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| maxy_pathnames object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| BEJSSDKObserver function| jsElementReady object| BEJSSDK object| BEIXF object| BOOMR_mq string| BOOMR_API_key object| BOOMR object| utag_data object| adobeDigitalData function| Cludo object| cludoSettings object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href undefined| len undefined| linkName function| id object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| Optanon object| OneTrust object| _g function| Sly function| webpackJsonpjwplayer function| jwplayer function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| articleFolioObject object| CludoObject object| disruptorPanel object| folioMessage object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight object| overview function| jumpScroll object| promotionalContent object| savedArticles object| readingTimeCall object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| CludoSearchInstances object| researchUtilityMenu object| bsModal object| TrendMicro undefined| targetAttribute object| google_tag_manager object| google_tag_data object| GooglebQhCsO object| _qevents string| GoogleAnalyticsObject function| ga string| _bizo_data_partner_id function| ktag function| fbq function| _fbq object| techtargetic object| _6si function| drift undefined| driftt function| twq function| aap string| acuityAdsPixelKey object| acuityAdsEventQueue function| saq function| _saq string| EQUALLY_AI_API_KEY number| intervalId string| gtagRename function| gtag function| ttd_dom_ready function| TTDUniversalPixelApi function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression function| UET function| UET_init function| UET_push object| gaGlobal object| ueto_c53d910e85 object| uetq function| quantserve function| __qc object| ezt object| _qoptions object| gaplugins object| gaData function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| _gat object| process function| GooglemKTybQhCsO function| google_trackConversion object| Ktag_Constants object| Ktag_Toggles object| Ktag_Amp_Helpers object| Ktag_Helpers object| Ktag_Functions function| setup object| regeneratorRuntime object| twttr object| sumome object| webpackJsonpsumome function| acuityParseResponse object| MunchkinTracker undefined| _ object| sumo boolean| _storagePopulated number| c_start function| lintrk boolean| _already_called_lintrk object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_46__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked object| res object| saCookies string| current_window_url_param undefined| EquallyAI string| VERSION function| __extends function| __assign function| __rest function| __decorate function| __param function| __metadata function| __awaiter function| __generator function| __exportStar function| __createBinding function| __values function| __read function| __spread function| __spreadArrays function| __spreadArray function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| __makeTemplateObject function| __importStar function| __importDefault function| __classPrivateFieldGet function| __classPrivateFieldSet function| __classPrivateFieldIn object| EquallyAi object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| drift_frameFactory number| BOOMR_onload object| whichUl boolean| __smLoaded object| jQuery110206633686982996574 object| drift_audio_context string| EQUALLY_AI_VISITOR_ID object| drift_sentry_config

60 Cookies

Domain/Path Name / Value
www.trendmicro.com/en_us/research/23/k Name: __smVID
Value: 83c8b55c196e1666c7c58cba548279143fd19b59b1f175b5bad2b669d15a35b4
.trendmicro.com/ Name: AKA_A2
Value: A
.youtube.com/ Name: YSC
Value: dX81SsODO-s
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: jWBxMueOmEo
.trendmicro.com/ Name: utag_main
Value: v_id:018c116ebbf8000e05e3d246ab5a03074007306c00b08$_sn:1$_se:1$_ss:1$_st:1701101318968$ses_id:1701099518968%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/ Name: _c1Ref
Value: /en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
.trendmicro.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Mon+Nov+27+2023+16%3A38%3A39+GMT%2B0100+(Central+European+Standard+Time)&version=6.34.0&hosts=&consentId=d7b0de6e-11fe-488c-945b-1900984aa1ad&interactionCount=0&landingPath=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F23%2Fk%2Fparasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A0%2CC0004%3A0
.trendmicro.com/ Name: _gcl_au
Value: 1.1.1240429162.1701099519
.demdex.net/ Name: demdex
Value: 31247803169938651264609444652043540623
.trendmicro.com/ Name: AMCVS_29C656F85FE1CBB80A495C08%40AdobeOrg
Value: 1
.trendmicro.com/ Name: _ga_4502MK3B94
Value: GS1.1.1701099519.1.0.1701099519.0.0.0
.trendmicro.com/ Name: _uetsid
Value: 095451708d3b11eeb4ff0947535926b5
.trendmicro.com/ Name: _uetvid
Value: 095485008d3b11eebf0feb631f2478e8
.trendmicro.com/ Name: _ga
Value: GA1.2.2141023639.1701099519
.trendmicro.com/ Name: _gid
Value: GA1.2.1229615982.1701099519
.trendmicro.com/ Name: __utma
Value: 44797537.2141023639.1701099519.1701099519.1701099519.1
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: __utmz
Value: 44797537.1701099519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1701099519
.techtarget.com/ Name: __cf_bm
Value: BkcvxFLgGxpqeF9T6N2joDdJNz4z_renpThO_MX1Ff0-1701099519-0-AUxeRWK1yFE/Pfw52Y+EFNN1JbsfpCgMWYOYpQR+gGhDP/H7uhTjioXuQYHLCRzR16Xq55xEu2Xv7SywPTC/Ask=
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZWS3-wAAAFR57gNe
.trendmicro.com/ Name: _fbp
Value: fb.1.1701099519569.349974659
.dpm.demdex.net/ Name: dpm
Value: 31247803169938651264609444652043540623
.trendmicro.com/ Name: _ga_JSMMKXDWBS
Value: GS1.2.1701099519.1.0.1701099519.60.0.0
.trendmicro.com/ Name: AMCV_29C656F85FE1CBB80A495C08%40AdobeOrg
Value: 179643557%7CMCIDTS%7C19689%7CMCMID%7C24179475743853494393831222820708142614%7CMCAAMLH-1701704319%7C6%7CMCAAMB-1701704319%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1701106719s%7CNONE%7CMCSYNCSOP%7C411-19696%7CvVersion%7C5.5.0
.doubleclick.net/ Name: IDE
Value: AHWqTUkfE52qM6LgbKB0098ig_G6HAbR73DCg4lYSwbf3Jf6jwEA8DO3A2wu-mrs
.trendmicro.com/ Name: _mkto_trk
Value: id:945-CXD-062&token:_mch-trendmicro.com-1701099519701-34132
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-35422625-07e6-558c-5cb7-358959792d49.KT360rvQ34GqiL8DvMSbjzlFDEq0f52B3yxDjONkZG4
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-35422625-07e6-558c-5cb7-358959792d49.KT360rvQ34GqiL8DvMSbjzlFDEq0f52B3yxDjONkZG4
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ANUImJQfmVYxctzWJWXktSdly2hw.pLqKOJGpQS%2Bt6m4WU%2FT74a%2BLCfpzPKXwB2SfHrjp3Rg
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ANUImJQfmVYxctzWJWXktSdly2hw.pLqKOJGpQS%2Bt6m4WU%2FT74a%2BLCfpzPKXwB2SfHrjp3Rg
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIJZtxV4rItxX0nJnoXntTm6nqIrJEkM-zhatKeGOmjObEHwYBCD_75KrBjABOgRyABfNQgRu4bMR.smtG8m75ewkKRkMH6aMDulrOs7vORSl1BN2lIPR2dxc
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIJZtxV4rItxX0nJnoXntTm6nqIrJEkM-zhatKeGOmjObEHwYBCD_75KrBjABOgRyABfNQgRu4bMR.smtG8m75ewkKRkMH6aMDulrOs7vORSl1BN2lIPR2dxc
www.trendmicro.com/ Name: sa-user-id
Value: s%253A0-35422625-07e6-558c-5cb7-358959792d49.KT360rvQ34GqiL8DvMSbjzlFDEq0f52B3yxDjONkZG4
www.trendmicro.com/ Name: sa-user-id-v2
Value: s%253ANUImJQfmVYxctzWJWXktSdly2hw.pLqKOJGpQS%252Bt6m4WU%252FT74a%252BLCfpzPKXwB2SfHrjp3Rg
www.trendmicro.com/ Name: sa-user-id-v3
Value: s%253AAQAKIJZtxV4rItxX0nJnoXntTm6nqIrJEkM-zhatKeGOmjObEHwYBCD_75KrBjABOgRyABfNQgRu4bMR.smtG8m75ewkKRkMH6aMDulrOs7vORSl1BN2lIPR2dxc
www.trendmicro.com/ Name: _gd_visitor
Value: 4d46ddc2-5c93-4820-8202-64fff599e4f6
www.trendmicro.com/ Name: _gd_session
Value: 7157de85-83a6-4c8b-838c-b72eafaa86d8
.adnxs.com/ Name: uuid2
Value: 186693726241257388
.quantserve.com/ Name: mc
Value: 6564b7ff-bae16-b772b-18bed
.resources.trendmicro.com/ Name: __cf_bm
Value: FQ4TUKg55niqvOIv_Zpcq49_RUcDmlwsNAxp76fy8Vw-1701099519-0-AShDKTaiuo3EHBt6BSZqfOluBWxO9UfHJJ3PnHPDazk7vijCNmQSRaQYqx94iLx66umFMrYd0Gz9c+WCxRmnD78=
www.trendmicro.com/ Name: _an_uid
Value: 0
.trendmicro.com/ Name: __qca
Value: P0-1167718740-1701099519420
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPr7hnZlcnNpb27C+w=="
.acuityplatform.com/ Name: auid
Value: 857131005811
.t.co/ Name: muc_ads
Value: 594c9a28-597a-470e-b7e0-c2e28d60f4a4
.linkedin.com/ Name: li_sugr
Value: 0da4e606-edc5-4aef-92c7-2982e4337bf7
.linkedin.com/ Name: bcookie
Value: "v=2&7cbe90d6-7cf5-49a6-8cb5-aa6f30d9d84c"
.linkedin.com/ Name: lidc
Value: "b=VGST04:s=V:r=V:a=V:p=V:g=3064:u=1:x=1:i=1701099519:t=1701185919:v=2:sig=AQFauso02z8nFXOU0VdtJ63S1KnEQC1K"
.6sc.co/ Name: 6suuid
Value: b8d01702c5d6130000b8646538000000ed695900
.linkedin.com/ Name: UserMatchHistory
Value: AQJ_Wbb6F7ncqwAAAYwRbsBi12pQY6CKNQfLaCfwJBEksrQu74sqJOfx4I4yeIpDrYEGi6G6oQLfZA
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJyR1XojUs6BwAAAYwRbsBirirc3zJs7HQUETj2Q4V2T2MuHtcIInZBqHmMQ2Wu-PyurElzW2_fPlsB8241ag
.www.linkedin.com/ Name: bscookie
Value: "v=1&20231127153840bb243db3-7b7e-4375-8d85-e4b007ba2a29AQGTmciMtKmFu_gUWlwsuudDdw5dKqW-"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MDEwOTk1MjA7MjswMjHicrCwY9ZGADQc5AFN7kapOtfgvPep+AdfTyvj7QTEXQ==
www.trendmicro.com/ Name: drift_campaign_refresh
Value: b184bedf-537a-47e3-86eb-97db4b928f6d
.www.trendmicro.com/ Name: RT
Value: "z=1&dm=www.trendmicro.com&si=dc3433bb-9a49-40c2-b5f5-13fb42915f73&ss=lph2qcix&sl=1&tt=2an&bcn=%2F%2F684dd32e.akstat.io%2F&ld=2ap"
www.trendmicro.com/ Name: __smToken
Value: hcu16N5COYmYDXrCt13hR34W
www.trendmicro.com/ Name: drift_aid
Value: 35b086ba-3c9b-4531-99ab-4c3df19aa0de
www.trendmicro.com/ Name: driftt_aid
Value: 35b086ba-3c9b-4531-99ab-4c3df19aa0de

7 Console Messages

Source Level URL
Text
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 4)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.trendmicro.com/libs/granite/csrf/token.json
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://js.driftt.com/include/1701099600000/sv2uuh4gw3ms.js
Message:
The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
javascript error URL: https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html
Message:
Access to font at 'https://widget.equally.ai/fonts/OpenDyslexic-Regular.otf' from origin 'https://www.trendmicro.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://widget.equally.ai/fonts/OpenDyslexic-Regular.otf
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
684dd32e.akstat.io
945-cxd-062.mktoresp.com
9572106.fls.doubleclick.net
analytics.twitter.com
api.equally.ai
assets.adobedtm.com
attr.ml-api.io
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.go-mpulse.net
cdn.bc0a.com
cdn.cookielaw.org
cm.everesttech.net
connect.facebook.net
customer.cludo.com
dpm.demdex.net
e.acuityplatform.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ibc-flow.techtarget.com
insight.adsrvr.org
ipv6.6sc.co
ixfd2-api.bc0a.com
j.6sc.co
js.adsrvr.org
js.driftt.com
load.sumome.com
metrics.api.drift.com
munchkin.marketo.net
origin.acuityplatform.com
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
region1.google-analytics.com
resources.trendmicro.com
resources.xg4ken.com
rules.quantcount.com
s.go-mpulse.net
s.ml-attr.com
s7.addthis.com
secure.adnxs.com
secure.quantserve.com
sjs.bizographics.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
sumome.com
t.co
tags.srv.stackadapt.com
tags.tiqcdn.com
trendmicro.demdex.net
trendmicro.scene7.com
trk.techtarget.com
widget.equally.ai
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
5427711.fls.doubleclick.net
9572106.fls.doubleclick.net
analytics.twitter.com
sumome.com
widget.equally.ai
104.17.71.206
104.244.42.69
13.107.42.14
142.250.185.130
146.75.116.157
154.59.122.94
18.155.145.87
18.155.158.118
18.195.36.121
18.238.243.43
185.89.210.101
192.28.144.124
2.23.65.88
2001:4860:4802:32::36
2001:4860:4802:34::36
23.197.7.9
23.45.238.53
23.57.31.196
2400:52e0:1e00::1080:1
2600:9000:211e:1800:12:3734:2a40:93a1
2600:9000:223c:6e00:6:44e3:f8c0:93a1
2600:9000:223e:d800:7:2bfb:7c00:93a1
2606:4700:10::6816:1c60
2606:4700:4400::6812:2089
2606:4700:4400::6812:24c4
2606:4700::6812:82ec
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:80b::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2008
2a00:1450:4001:813::2003
2a00:1450:4001:81c::200e
2a00:1450:4001:828::2004
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2008
2a00:1450:400c:c09::9b
2a02:26f0:3500:16::215:148d
2a02:26f0:3500:16::215:1490
2a02:26f0:3500:586::11a6
2a02:26f0:3500:981::11a6
2a02:26f0:480:23::1726:62a7
2a02:26f0:480:7a4::1e80
2a02:26f0:480:f::213:7ee2
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
3.224.56.144
3.248.147.241
34.111.194.12
34.111.208.231
34.215.250.209
35.201.125.192
35.71.131.137
52.19.222.237
52.57.88.70
54.147.21.139
54.228.115.105
68.67.153.60
95.101.111.184
0055333d5526c36eb45523247a3b0adc7c04e9c1051ccd97ef4cad6945d5d3b3
020326877e1d509a74b7c7f6a81e1ce4c78106da7cdca708c7c77b20d5f1e087
045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
07be671a165671d1106a94e0477c88c9d69cad7688c660a06282a02ef112178a
08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0a48041cebe64deb1a98cab2c0fd76840d957edc76fc58fd0e3f8e44076e4371
0b99ed3d94a1d1dbfe7458b86939f5378756aa5d64880344bb1a631f2ed75b9e
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c175faf04782b81ff1d1c1297ed6dec12e66d736dd70de4fd35ce90988e0c9c
0d04d9eadc49c5514881c1c3f7c465a10a37ead378bc5e61cf96fdfcb3599e54
0d86756671757b1622e49e7b1405334d749dc18b0377b422fa0b8a0c493d9dc6
0de2a176ad08f62d4eb01561e51936094f156760b03746e2f17e69345824f7b2
1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
13043181b75e04d7b92e350e94ce762e36560d15a5d1cd6a1d1e021a3bb4042d
135af090c219f450ddce6af0188d76c4d0a45ee07dacb06efab1e237cd2157bc
149eb0e1edeaf44be577a0b3ddc51fe9c82c0cf9e8d7b38c936b61a90b510c6c
14c7ed6b9b540b42d3ec969bbe0cb8d4ea30965c15f5669b4fffddd405c0b3c7
1509dc217819ad2dd4014e253baa32792ce544333a8916444f93989b8d6ab7b8
16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1a69e8e540cedfb163ea767f3ad91f2ac49eb93db72e5d4dfad1aad64d4dd3eb
1a942c4e7372897cb501fba0ddb4b51fb3533d71975bd2d9d3a1f39ac5403831
1b57ba30ba4abb40d8ecf6680ce4218317fbc16eee5999bd0543d1cb88be817c
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
1d7c3fc0594c8fb856d9fd0a13a752dfaf8643c8b073582909c88be24e7e416f
1e92810ef3030da7403227f4b986ecce82a867c10da87f58838c7a3baeadf76e
1f1af18d64fdcfd9d2191eec42881a3e16a482792ff4d1c4a7da67981a51d899
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
218696130b4ddb728c99f9eede695715788fdfb385874ad4614c74fff54d1e3e
21b4b5ff7892c77646bc393bfc752994256c973b941efa1aec36293a69fd2f44
22c3fd46dc28317aef90042c0753148aa68707737146640e11165d6df6c02178
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2b4a2c91c9bd0e4ed72eb465692871a7518685da394bb57b2e7b0889e8c69532
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f57f5b4ec3968d3127d25c1ba8973b593df0bfa8171a12d7c9f399a038ca071
2f6ade4293488af8ca3636b7a8571c03a8fccae5acd544bc40ea8e5827c73d66
310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95
316558d71ad59f41ec8cbf9095f956415e6d35aaa0d11f2b2d386410f0137c00
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
33a08de9d079cc66b081d02be5d55bec5c60fe10820447395e62e01192bfbd59
33bc1e4cb0149bcd78b51946dd003707ffa7ecfce57fc898f60a2ca39538cfbf
33f36ffa4f8478d7263983e315a7e62d42026dc210d045f6f81a446aeb299d63
3563345a94ccba87561a45bc118e44150e02bc7da3ce270936eadb23ce6996c8
35e785339e19d1ec1987cb9c3d8e66fc97f29a287db0b0b590b8dfdd96d4766b
3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e
3beaf2aa05abc754a560f723315ba58156356abc654d952382c6e6bb60cfb7f2
3c220fb0f16431a4a269511c64f390b29fb30f8374ecc429f533b0763a9e2023
3cfb3d15a79010b9427845e8f3f1ac5b740ff60f7c0f28d241420fad9275d51a
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3de99c7432f432aeea6d2f665aea44348a0b316b11cf04a3f35aa477c05a9b8e
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3efdf09e51f3ec616ed534a682bb3db5eb060dd912e51adc58a9170089ea84e5
3f3863d004819d9ca0bb572c2063698a610de89d5d3901dcb8ce9d9c702782e7
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b
4026d6520eabe64b68e8617b1053894283541cacb30f362dbaab39fa64fa6f28
4114174ea444a24929b4d21935883cd91b9cf9beaee908b322aa3107b3ac3692
4161e36b7f5ad0c7837733c26f513c9665ef06a8e3f33cd2d8ae9ca8fd49de43
429d40e370103a47cb2fa03e143136308ce0ad387fc05acfff349d40406440a2
42f2a22d45c6f2d8ba1ebc17ed8b417762baeed4f314c68deb39d8534b8f8ab0
439a1743209122f34446fb66d2b510a96601776e9868993088ef051e74d2b42f
442240b6d0d4290a8a5bf289beae6d52665dc71f7cb529034682c8fdcf313bb1
443746c308fe991b78c8f840b5e110cc95bb7e0f4a3964cc9484496e413f3d59
450b58f0da233b187d384f0190935c709619eda6f9b7d3dcd085a30a2127bba8
45b9acd0d7acb13b08ea42e95827e94bd8be3cbf18202713e93bf79d6bb512ec
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
49effd3bbbb1dddb200fbd1272f0e7df5af38625de89f6c8c1f226013ec477e1
4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
4f6d6614ecec4d410a09138dc60634f6dbd70a5f4b8c24d0054bd8513c364fc1
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
523e8e412693994fe6b7c57035ee70d6d0981da58428747101852ac0710fbded
5384f72a7c721365e38dcf5fd29e5b3b27a67c2179763f87b7ce5ab04681d960
557804ca07c2ab312bddc4c711c548563a1302a25eeebbff8dae19cbd4cc5e3a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
5a9c8a96b2d409c2295838d5e7c6182170f35aba3ec747dc2a818b96d8e8b23d
5b3086a886aa8649ecbf496ac913a1aa443926cd2fff610be2d136c9598bcd8b
5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d
5cca4cddd4f59dc1890d79a18b1dd68d69c68e4c28c568d7edca037a2dce1979
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b
608e5ed6a0820b02ac00e5ee7457a9822b5e5c1be9cba69d17c5a3e9ca4a4377
622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec
645f75dbf15f9931d4c25509f2d3b55e8be7d97209957535382ecfd96658d7b2
652efd827c7d4bdbc5062da31da261ea6aff861b1735ab640eb5aea11e52deda
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
6870a159c9680c3ea16aa528b5b3a0cb9dfd7d3e2b4367068dd2536ac294b69a
68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6c103980ef9acd760daed97b96d96ccc68bd8dfd9085f963594b007c98ef599b
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6d34cace5073f691a7024b6dd563eda0874bf4ce25bc29ceda006e398b8275c8
6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a
6ecad4dffbfb54b23db3b0ea63b3749934d1fa75e2b6f9fcbaa939ca715dbde8
7324817de67a98d0a6ebc71fd6a13fe2f5ee0e521a578198a45aed0a8e5d1cb3
74c39b5ec5a61c19ff20d81c0418fabd61d6deb6ac0c967da28761d6b895ff7d
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
77daa4388c965a3e23b5a6c800727d8025ab108f89cf5679e79136986d5b4561
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7a0bde1acd31ff832a492f3790d5128d22a1a988e0af81a429e74e2e6ad10e3c
7a13ed6ca8a90a2bb60ef518a36ec6d87fdc0cc0df514d75d4eaff7bb9414e98
7aa5165924f115f6e8c64a1e2d6bf238c5f33665fac27c6d69ba9e05a6bc701a
7b497ac7beae5f18fead362010dae4cfa0a3942659b0afb7467eed655fe5f297
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c8b113cce07a87ca4cb9dc4f1c55d701efd44834430e1939c27b2e5e1c12ac1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84bf3385585c2a81cf961332af338f36d0fe2d2529a70cec26336a2a47945b2d
84d65ec5b183b19a3a243732bee14343667252d65b6b01feb08f3c641e392462
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
86cce2a11b19e83087b4ea15be2c293563f8dc90df958488174c2194e2adac07
88d1d0dd8730d866219619561304b3b5c22e3999a59dab5f70b88384312eff0f
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
89b9754fb02fcd0e1427d0e4b2c5d116385abd2848a9833b685fec79e22ac77c
89cf66cb9de8da20fc15e9953845dd4d1de2c0fb465c827a09d818449222c533
8ae30f6f2162279a812bf9e00efd0c985e20e76efece9444125b410f3a6822a6
8c2b5a2945535269c1cefe505e56b663f26b3d322d35ab4fa835a24c543226dc
8dcc53c62676aa4653201bb3b840c749e0f78c970ada8e62f1a8df358eb61d36
8e7fec735da70cd06ad2d2ede0add50ee4d1aef7801aed7a455419f66e3daf0f
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
8f12c5abe51035ac7d3b7e65db736f9eaef715d79d50d10a16c6070102c2257b
8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f
9002702b4dd8576690f7fa8da0c88bcbb7bd74c568cd2a38048f386b53cbe34a
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93b80e24b384219ed900d6c2c57b95e55256988cfd2bd76f9f3c80b399970648
96b997ab041d34adb848adf5e8cddecbf48d3e534aaa685e7b504530d503650e
985a85728ad37064b2b77bf64f50abedc823aee1f9f85918aa1adbb54e6af176
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
9e016bbbbe591db632165d4255231af7e360444d9a3663dbb3c4920221f752b3
9ea1823078c462969eaa59d6ef62623c19d77b72e25a103105b043aefaa0769a
9f5235b382e7052717e8d2f41112bc116472f8f6133c5e498e550a3c0334f58b
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1f4b84cf445b9350febd03d41fb8c4efad00ca01efcce58082c17cc858f2e93
a246c4de8a0f1f1fdb6ee52565018dc341063aa9efe8481034bc3ef7d697e334
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a4328c78cf1b5cc23e5b78142d563d1f2a92eac3ca9d0e0d68c86c4a2084db10
a592d5f47fa61931f84d9c0336bcec6628945763d0009f44882d61f77c6dd19a
a5c2eee915ed72695afcc7898018bf57c41e62c9b7b964e8de8bbbec9e895d2d
a71ba95f3450a26edd86e6d972023ab92364f7bf0149a011bcc5bab46e1511c2
a71bcb7e97223bdca2ff6105c4e261e96eaed1009d6326c404abe20011ed7dad
a8b719965d947ab374c07d0da488c475e73334fc9ca9f2c970f0c176ea609f0c
a8f57ae36e7533f330d488d78955b84759053d8890dbc12a940f5f16c0169c47
a969a82bb3ac58f06a3137d9cbf5c5c51e1311d6ef8986b84c42bab87bdaf7cd
a9ddfc8f6fa5df3944350efd58ed576b4bcd5f7bb49b577da7e795ff9f41140f
aa306e3f9d8088342bd9b2782ae2d5aec86d705fbe6582d7f162f7258672fbef
aa4fda18694f1e60c937933eebd752cc3ed0701652f0dfca84677c3267b26db9
abbac496a218b37d21daa7b235db93974c16362c06e84858f8ee4b15944e1d78
ac2be5f6d404a2cdeef5f6b792544790a88fe8098c9513b2bf0ca2b6363af7f9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae
adb73f5a682a31bf070e2e7955caa7433f0175b15e39f76b3dc5fc45be088eb7
af82cd92cb1df231870f60b847a411fcc4adfffef67f01fff41885828edee2e3
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
afc4bdae016b1b2788b282a23571c692eb31fe782007f3a2244f68ef925e550c
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b0b36326e3e5b74624ee8b5de8273ea00f7bbe9b5ba0da6250cbe7b3c637505e
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
b5fc7649baa5db00a746c067fd19607a54f6e4ae1f536d2c18257671cf7fe99c
b7bab399e87338ff7e75ac15e592a194fce5a9bce2b7e899f6510af38c5c4177
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b9e78be0f5224e190705834d95672a44d55bc8f81a20c4f1c5d00d0a5aacd4d4
baab390c2d7313aff54f9e972aec75d7293ed44cef9fd2eec59c1debe9343dfd
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
bd00e09e2ca8307586ae09f310f92f3c363a2a71e431dbba4fcfc5438375b952
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
c0ddb59fb748963caaaa0d8c1ccee7647d060d92f57b3c8c29cc153deeb791be
c114663a3b5e85919fda876b018c14770096c603ded617faaadd097a9b96ce35
c34c2d2268ab45d0767257f1b78129246fa17e6051d59f33cbb882228b580df3
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2
c867f581b6ab234be9476a2284e95d3ab309adf566d8fdb545dd064ec7399ac7
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
cedc3b05f6b82af9696f663cebb5afdcea4e495d8646316f30fa041b8530d9ff
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d031cc970271e726dd8284f19274e5bc3770fe40a924bee96a4b4eb2ab527722
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d2992931db929f1541337b2427833930743899025888d5df0cd8359179c3a6eb
d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
d6dea5f430dcc6e18d3bb267760ad4a76bf83ff8363d542fa54fbd395a4b3f37
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
db05d4267dfa54efcffce5353b6b16959137d2387075f61974be55c6d3d6413c
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc4827058fb343b6fa6383fb5e3471f4ab744a82d0f6ec9d895e8ce5d2a969ff
dc788a8767abd052db2ea9f05c2c6c6a91442148f5e7aa381bac45a665370992
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd6a60845f874c842a6c0ea1e0a4ca6409e809a48f885bec9e007b216f71a662
ddb3a051562457ce3d69a677341ad2cccad3a6c7dc6ca563c3a0c7a69ea181e7
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df15b0839fb4f70118ce881715052ff8648051a9a01e146212d7e68c0a1d344d
df3f46edd3dc78e34e7b8df01b494936e06e68f1566df5666d3a9e502b040b27
e01d6dc1abdb826d43e6666020867d581d055874b359d932829d252f7588c608
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
e0e14a820179ab3f4037ececb74d17682f3f2620e0735c36a5c3514cc8fb2fd7
e223abdb13c475b827e74fa29a44a98e26675402fb46513eadc875faca72305e
e2e0bae31f3084d1ddbd244ffdfbe62ed5babede11e9897ab70990ba01ec4987
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d85ea6dbd284d131f55a919eccaf1eb6bc6b8b57804859ee984bc57bb931a1
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e4142b08bb91c6729ce36efd4ad1ef33c7a9b8b02f75066b0c2d0c748392fc4e
e5273dbdef1f0e5a3b6692f19f99a6c201d2e9cd866d900d8284b2708d882d18
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e833b1b7985a4d05ae0fc5e7a9414f3faf83686d39113ebcf7caf305e7950aaa
e88dafe889a514ea8b9b07747f53d08b66a473b7caa78645b4aa2167563651e7
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
ea05ad76e8d224961ca5fd4a3b7d0d00eb2c2322346ce81bc0c0112beb001594
ea3e3c17cfd414a403313ddc73a62a264cbc205d962214e272321566e0d78ce8
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ec7b7f2ea7c2691ebf9a7ca8161af36263c9d1a8256c1698e65827aeb97593d8
ecd619e1013f1de98ab10d4693d8d17ff1924494c099aaef02b0700636b51339
edae277827642cd51b689e27e8cc8777276fffb792f0d31d3d50f6aed3923bf0
ede2c62d5d121769b6ddf9fb27add48868880e3f51272d25d3d8ab90216614b7
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
ee066eb5d4337241f1c3f10b1151b4a2b6a56432ae7ef2ddbd480528b65a567b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c52a96f41d5778efb234b215e4e815b8b77e00bf2cc50cd96990e90f35b333
f3d804706c6ccb7955d146f5b9a86c200ee5788031e0c8601a0d758da2ce6e54
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f7c44e9e1d2523536cef6627794db0a3bbd32f5341c09c70ae92443d1b27b90f
f88f89a0cead9c36ddbe19508f32f64bd91e94e92b6006dd575e8d0deb317d7f
f8b2beb661f2060ad9acfc574d17fb9b51d984c3ec4559defc2360a1192ba667
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fa30c62b357bcfb917c369e75bb02351e336bbb6b282de80b72b5db72529f1d1
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff71f3ee3a06deeb569530bfe7174533653a4382a2a327171c52e5825cf90bb6