cyware.com Open in urlscan Pro
52.24.83.42 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04
Effective URL:
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=8897474...
Submission: On February 04 via api (February 4th 2021, 12:03:03 pm UTC) from DE

Summary HTTP 46 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 28 IPs in 6 countries across 24 domains to perform 46 HTTP transactions. The main IP is 52.24.83.42, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is cyware.com.
TLS certificate: Issued by Amazon on January 23rd 2021. Valid for: a year.

This is the only time cyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	199.60.103.2 199.60.103.2	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
4	52.24.83.42 52.24.83.42	16509 (AMAZON-02) (AMAZON-02)
13	2600:9000:206... 2600:9000:206f:fe00:1:d92a:12c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:600... 2a04:4e42:600::621	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:b949	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:81ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:74b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:47b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:15bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	52.218.213.2 52.218.213.2	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5805	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:cbcc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:10c... 2a02:26f0:10c:58e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:816::2002	15169 (GOOGLE) (GOOGLE)
1	3.12.28.145 3.12.28.145	16509 (AMAZON-02) (AMAZON-02)
46	28

2 199.60.103.2 (Canada) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

info.silobreaker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.24.83.42 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-24-83-42.us-west-2.compute.amazonaws.com

cyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:9000:206f:fe00:1:d92a:12c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

production.cyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::621 (Ascension Island)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:b949 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:81ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:74b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:47b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:15bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.213.2 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-w.amazonaws.com

cyware-ent.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5805 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cbcc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:58e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.12.28.145 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-12-28-145.us-east-2.compute.amazonaws.com

debugger.cyware.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	cyware.com cyware.com production.cyware.com	2 MB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
2	google.de www.google.de	215 B
2	google.com www.google.com	215 B
2	doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	1 KB
2	hubspot.com forms.hubspot.com track.hubspot.com	1 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	gstatic.com fonts.gstatic.com	18 KB
2	silobreaker.com 1 redirects info.silobreaker.com	3 KB
1	cyware.io debugger.cyware.io	242 B
1	googleadservices.com www.googleadservices.com	12 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	hubapi.com api.hubapi.com	569 B
1	hsforms.com forms.hsforms.com	589 B
1	amazonaws.com cyware-ent.s3.amazonaws.com	316 KB
1	hs-banner.com js.hs-banner.com	13 KB
1	hs-analytics.net js.hs-analytics.net	18 KB
1	hsadspixel.net js.hsadspixel.net	2 KB
1	hscollectedforms.net js.hscollectedforms.net	24 KB
1	hsforms.net js.hsforms.net	127 KB
1	hs-scripts.com js.hs-scripts.com	681 B
1	polyfill.io polyfill.io	509 B
1	googleapis.com fonts.googleapis.com	750 B
46	24

	Domain	Requested by
13	production.cyware.com	cyware.com production.cyware.com
4	cyware.com	info.silobreaker.com cyware.com production.cyware.com
2	px.ads.linkedin.com	1 redirects
2	www.google.de	cyware.com
2	www.google.com	cyware.com
2	www.google-analytics.com	production.cyware.com
2	fonts.gstatic.com	fonts.googleapis.com
2	info.silobreaker.com	1 redirects
1	debugger.cyware.io	production.cyware.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	snap.licdn.com	js.hsadspixel.net
1	www.googletagmanager.com	js.hsadspixel.net
1	track.hubspot.com
1	api.hubapi.com	production.cyware.com
1	forms.hsforms.com	cyware.com
1	stats.g.doubleclick.net	production.cyware.com
1	forms.hubspot.com	production.cyware.com
1	cyware-ent.s3.amazonaws.com	cyware.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hsforms.net	cyware.com
1	js.hs-scripts.com	cyware.com
1	polyfill.io	cyware.com
1	fonts.googleapis.com	cyware.com
46	28

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com
www.kryptoslogic.com
www.menlosecurity.com
www.google.com
apps.apple.com
play.google.com
twitter.com
www.linkedin.com
www.youtube.com
www.iubenda.com

Subject Issuer	Validity	Valid
info.silobreaker.com Cloudflare Inc ECC CA-3	`2020-06-30` - `2021-06-30`	a year	crt.sh
*.cyware.com Amazon	`2021-01-23` - `2022-02-20`	a year	crt.sh
cyware.com Amazon	`2020-10-04` - `2021-11-03`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2020-07-27` - `2021-07-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2020-07-03` - `2021-07-03`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.cyware.io Amazon	`2021-01-06` - `2022-02-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Frame ID: 382453BE4EE34E7C708D51AB77AB4CFD
Requests: 49 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04 Page URL
https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkR... HTTP 307
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-15... Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-v(?:ue)-/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

46
Requests

100 %
HTTPS

82 %
IPv6

24
Domains

28
Subdomains

28
IPs

6
Countries

2563 kB
Transfer

3452 kB
Size

4
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.zdnet.com/article/new-trickbot-module-uses-masscan-for-local-network-reconnaissance/
Title: a new module

Search URL Search Domain Scan URL

URL: https://www.kryptoslogic.com/blog/2021/02/trickbot-masrv-module/
Title: Kryptos Logic

Search URL Search Domain Scan URL

URL: https://www.menlosecurity.com/blog/trickbot-new-year-old-lure
Title: spam campaign

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/place/Cyware+Labs/@40.7559136,-73.9881915,17z/data=!3m1!4b1!4m5!3m4!1s0x0:0xc1e4c88980c6b2fe!8m2!3d40.7559136!4d-73.9860028?hl=en
Title: Cyware Labs, 1460 Broadway, New York, NY 10036

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/cyware-social/id1082345915

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=co.cyware

Search URL Search Domain Scan URL

URL: https://twitter.com/CywareCo

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/10407612/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCBPcVKjzXijVkBWwV3wNjag

Search URL Search Domain Scan URL

URL: https://www.iubenda.com/terms-and-conditions/13599757
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.iubenda.com/privacy-policy/13599757/legal
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04 Page URL
https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04?_ud=bff1b67c-e57c-4940-923e-092b8b816322&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2232740%26time%3D1612440163536%26url%3Dhttps%253A%252F%252Fcyware.com%252Fnews%252Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%253F_hsmi%253D88974744%2526_hsenc%253Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&liSync=true

46 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04 Show response
info.silobreaker.com/e2t/sc2/ 7 KB
2 KB 117ms
116ms Document
text/html 199.60.103.2
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.60.103.2 , Canada, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 903ae5fada489883e7aeca6c41b1512ad7d22836b6187b7c3afa8e0416ceaf43

Request headers

:method: GET
:authority: info.silobreaker.com
:scheme: https
:path: /e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:38 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=d895ad2c8f42df81e25d2db11d34af1f01612440158; expires=Sat, 06-Mar-21 12:02:38 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=77abf5f68b01840d33349aadec84c705345dc087-1612440158; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray: 61c43e6e5c741fea-AMS
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 080e8558f800001feaa605a000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
server: cloudflare
content-encoding: br

GET
H2

200

Primary Request new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa Show response
cyware.com/news/
Redirect Chain

https://info.silobreaker.com/events/public/v1/track/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04?_ud=bff1b67c-e57c-4940-923e-092b8b816322&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M...

293 KB
49 KB

1048ms
595ms

Document
text/html

52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4

Requested by

Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

c9135488238506768788d901ac1ce80816f79dc21ea16e2fbf392b833959ac66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: cyware.com
:scheme: https
:path: /news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04

Response headers

date: Thu, 04 Feb 2021 12:02:40 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
access-control-allow-origin: *
set-cookie: auth.strategy=local; Path=/
etag: "494c6-e+0fjgOhzw5fqBWGDOZhz/nJeLM"
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
server: Cyware
cache-control: max-age=86400, no-cache, public
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains; preload;

Redirect headers

date: Thu, 04 Feb 2021 12:02:39 GMT
location: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
cf-ray: 61c43e6f2e781fea-AMS
link: <https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4>; rel="canonical"
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 080e85597400001fea840f9000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-robots-tag: none
server: cloudflare

GET
H2 200 a9e3035c06ced5018150.js Show response
production.cyware.com/social/ 3 KB
3 KB 59ms
7ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 82efa3a52ca2051d452e2c6b30a6574889b4ddf2e59345f223e5c2966f3a1816

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:39:15 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 15806
etag: "8b2018b56e28fde177a68eb40c1df483"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 2906
x-amz-cf-id: Bobnt6tqa4ymnXO3MiWHFDVrRf8EnVchCOiw4WDBelUXCqK7pw91Iw==

GET
H2 200 850ac2d58c15bb0d48f7.js Show response
production.cyware.com/social/ 188 KB
188 KB 61ms
9ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/850ac2d58c15bb0d48f7.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d16896edf8050f6a0cd7a7b9359ca7522be23382eac47ada9aa693c88cc519d1

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 01:45:51 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 37010
etag: "9e01af82290654e86a004c337a98972b"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 192230
x-amz-cf-id: lH6VETL62Hwj3lCDE1ZBjniw-36rV5f3B-ixWtjyO4f6aK7AfQAxIw==

GET
H2 200 ab3c3fdc11d8a5319fde.js Show response
production.cyware.com/social/ 1 MB
1 MB 76ms
24ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 74d8bcba84408837591b6a12b342594272aad99a02eafe4a0280e6f8a444dea2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:00:45 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 10320
etag: "204dcdd0e6393cda79bb2e7abea7e11e"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 1373863
x-amz-cf-id: VZoHqMTikzZKxSHOW7NBj44JwVaXKUv7qNu1GtXWpYTTyg6ggfYftQ==

GET
H2 200 84185a6080992cbb4815.js Show response
production.cyware.com/social/ 283 KB
283 KB 93ms
41ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/84185a6080992cbb4815.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f30acdaa946790462d6bd75c16d7b1559b24c57317e9bf78a1646bdb2d647ef3

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 01:13:04 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 38977
etag: "e2680a3159b5a3aa314c4bd1c442d4d1"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 289648
x-amz-cf-id: fSQxolPYPqo7Eojua_rIp-fioiWWHkRwA5tAz3VsGboni2Y8nwTGbw==

GET
H2 200 20d9a83167db52d23cd4.js Show response
production.cyware.com/social/ 14 KB
14 KB 93ms
42ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/20d9a83167db52d23cd4.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a6f5b70c11a59bd2b27a534812185b21e5c2c4a4367a69bf7069ebee21fdd07

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 22:52:20 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 47421
etag: "33c65c9badff270e60ba508134c2911b"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 13840
x-amz-cf-id: TZuTExgjWmI7lePtxPbYmKasbJppSQRdlnPQ-rY26TeRZ16WNZnPCA==

GET
H2 200 css
fonts.googleapis.com/ 4 KB
750 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Requested by

Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2e8b49e8529d1acbd9834ac3ea1993ef3d37323bacac1acf2823cfa3939916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 04 Feb 2021 11:01:09 GMT
server: ESF
date: Thu, 04 Feb 2021 12:02:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Feb 2021 12:02:40 GMT

GET
H2 200 37ae63c.svg
production.cyware.com/social/img/ 5 KB
6 KB 7ms
7ms Image
image/svg+xml 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/37ae63c.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d6aa44d7515541e116c9a091bb0b5a70e4f81728126347261635b5cda6aec1e4

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 06:12:16 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 21025
etag: "37ae63c6a9fe1cfb6c915056f0bba93a"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 5434
x-amz-cf-id: BrODxD4bx1C76G7QxKrvmznpZvbsggaFClTjTXt5vc90cmXmBfNUsw==

GET
H2 200 shutterstock_388569319.jpg
cyware.com/smart/unsafe/120x130/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/ 4 KB
5 KB 272ms
271ms Image
image/jpeg 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/120x130/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_388569319.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware /

Resource Hash

85b72d835785786caeae28d952423f715e423e09416c83bd6f92cdb62ed83686

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:40 GMT
x-content-type-options: nosniff
server: Cyware
etag: "d3b4ed0ad02d84c0241f06e85c5e293889ae87ab"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
cache-control: max-age=315360000, max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4567
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 6fed3be.svg
production.cyware.com/social/img/ 7 KB
7 KB 8ms
6ms Image
image/svg+xml 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/6fed3be.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ec6b9513987f66b5903cebdb93bcc616b68f9909f647d3f50b7a6544dcfd9e2f

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 19:05:42 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 61019
etag: "6fed3be0b0fc000ff8c8e5e1220f4687"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 7075
x-amz-cf-id: pN19ckrfR-jmzmoYpPp227CtRClUEK4-DwILRZcBubNOz1wuC545Jg==

GET
H2 200 1c7498a.svg
production.cyware.com/social/img/ 6 KB
6 KB 9ms
7ms Image
image/svg+xml 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/1c7498a.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 194bf057cf24ac499b27acd6017d5eb780c2ec352c826780e90147ff14e997a2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 01:59:46 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 36175
etag: "1c7498ab808c1be2cfa222749a6e4165"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 5783
x-amz-cf-id: 8DjdQSoxv3f8yL_6NqzVMWQHbc0KilDMl8TFWUYnlAfIle_XwLrwQQ==

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 72 B
509 B 52ms
14ms Script
text/javascript 2a04:4e42:600::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?features=es6%2CPromise%2CMutationObserver%2CIntersectionObserver%2Ces5%2CObject.entries%2CEventSource

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 618449
detected-user-agent: Chrome/83.0.4103
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Thu, 28 Jan 2021 02:35:56 GMT
date: Thu, 04 Feb 2021 12:02:40 GMT
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/83.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 7288424.js Show response
js.hs-scripts.com/ 2 KB
681 B 18ms
17ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/7288424.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b51138e5e61472dbda3e0ab2912184d8468f61c6eaa486b2fbd4db171b0b7850

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:40 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 47
cf-polished: origSize=1807
cf-request-id: 080e8562110000178e548c0000000001
cf-bgj: minify
server: cloudflare
x-trace: 2B3398F576BE14CC95AAFCFE099494154341E2F54B000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://cyware.com
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 61c43e7ceeee178e-FRA
expires: Thu, 04 Feb 2021 12:03:40 GMT

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 520 KB
127 KB 63ms
33ms Script
application/javascript 2606:4700::6811:b949
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6f31a335ef4afee665755556d8d50cfb3239d80601283c56af47c339f887a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:40 GMT
via: 1.1 738984066968793a5714282f49fe0ab9.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
age: 519
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e85622f00004ac2c614b000000001
last-modified: Wed, 03 Feb 2021 03:28:54 UTC
server: cloudflare
etag: W/"2b49c17e03a5c2f522eedf069cfb79a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-version-id: qFuEFzmMzpEnwV6.DIVDel5RqtXWWdE5
access-control-allow-origin: *
cache-control: s-maxage=600, max-age=0
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43e7d1b4a4ac2-FRA
x-amz-cf-id: A4kne_KkfIFfHvh8kHg18XzI_kNaw2UlT3PG1VoEpD9-H7BdqMY-yQ==

GET
DATA 200
OK truncated
/ 823 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5636027d157543583d21ae2574222e4b4ff16ebf12d5a70d6f074940195fb92

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 639 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325bb368e3fc5a1f6ad31c10e3038e41568383733c767ce3d81d88baba391ff8

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 657 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e530afcd39959ea41c6c4d2fc2c4fd097b0ae5bed210dcaf8bad0cd60d31a5ba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cyware.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 16:25:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 243459
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Tue, 01 Feb 2022 16:25:01 GMT

GET
H2 200 647a323.ttf
production.cyware.com/social/fonts/ 12 KB
12 KB 25ms
7ms Font
binary/octet-stream 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/fonts/647a323.ttf
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b8783d5fa087983659871825aaf0c0582509f3fce9174bfbe4d811a6ff04bfb8

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 20:52:20 GMT
via: 1.1 72e8bbddfffeeec486003f867d631025.cloudfront.net (CloudFront)
vary: Origin
age: 54621
x-cache: Hit from cloudfront
content-length: 12212
last-modified: Wed, 20 Jan 2021 09:48:59 GMT
server: AmazonS3
etag: "647a3236a1d84b9c369251168a1ff97f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: rK3V1aRHSBg7d_6nS2EZAdo7w0b2ZxLtVaXaMbf7GlndUlnGsAN6yw==

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cyware.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Feb 2021 05:56:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 194755
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 02 Feb 2022 05:56:45 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 78 KB
24 KB 42ms
16ms Script
application/javascript 2606:4700::6811:81ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:81ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a12ac37a39b2818801153898a9e716122189a054cb0cc0a98131ead6b57751d9

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
via: 1.1 0712e4ad4264127dfcb76a114b130495.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 80422
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.224/bundles/project.js&cfRay=61bc9314bd5a2c2e-IAD
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
cf-request-id: 080e85632500004a924d077000000001
last-modified: Tue, 02 Feb 2021 01:41:22 UTC
server: cloudflare
etag: W/"4175c61bef30fbed4a4fea09f2f20c4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: YxTlDDuGm95GnTHKn2AaGJe9LDW9YpHd
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43e7eaaa54a92-FRA
x-amz-cf-id: 0YgvmAhUGyNfvH_iajngk4cOv0uxVKD87EVRE6cNcONvLMHXDtNzvg==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 5 KB
2 KB 20ms
17ms Script
application/javascript 2606:4700::6811:74b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:74b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3399b34b280df0bae72875db0c8920320cc6b8ce3e64413541fdcb7fd53a2a8f

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
via: 1.1 98e30e5953336545df428a8f5923a289.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 119
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.222/bundles/pixels-release.js&cfRay=61c43b97f91c4aaf-FRA
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
cf-request-id: 080e85630f00002c26e4b7a000000001
last-modified: Fri, 29 Jan 2021 04:30:45 UTC
server: cloudflare
etag: W/"c8d54dcba2e9466890079ae550d834bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: tMGfNCDI8YaArCWxgAwYbahB1RP10YKq
cache-control: max-age=600
x-hs-cache-status: EXPIRED
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43e7e7bf12c26-FRA
x-amz-cf-id: n9Ry2z3Xh4PegjG3PC36EJxchfeXe4K2IpJAQVfICUgusiYeeovrHg==

GET
H2 200 7288424.js Show response
js.hs-analytics.net/analytics/1612440000000/ 61 KB
18 KB 37ms
35ms Script
text/javascript 2606:4700::6811:47b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1612440000000/7288424.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:47b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e4de3133efb8cfc29593809c401f7ad7b5b29533401837bbf8817b12e5c172

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
content-encoding: br
cf-cache-status: HIT
age: 115
x-amz-server-side-encryption: AES256
x-amz-request-id: 85B6615DD2620BA7
x-amz-id-2: XHZhnSL+MtIG/ZIbJ2zGS1rU45oWsQpUAvbmjI+hPYJ0A9lxXsxW6Zfkl5Fgx1QcKIJFTxWUY/M=
last-modified: Tue, 02 Feb 2021 23:49:14 GMT
server: cloudflare
etag: W/"206bd4c254149078c6839c807b2f8c94"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-request-id: 080e85630f000016f2e7bbe000000001
cf-ray: 61c43e7e7be416f2-FRA
expires: Thu, 04 Feb 2021 12:05:46 GMT

GET
H2 200 7288424.js Show response
js.hs-banner.com/ 54 KB
13 KB 20ms
18ms Script
text/javascript 2606:4700::6812:15bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/7288424.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaf2fcedc750e57874345df198b57bf5b61a85282630cf4d0270003097693be3

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash: crc32c=6ZzsEQ==, md5=S+40otmoasXCSU0y/3HUTw==
date: Thu, 04 Feb 2021 12:02:41 GMT
content-encoding: br
cf-cache-status: HIT
age: 115
x-guploader-uploadid: ABg5-UytGWGU7Asu21eC7aR_eht-rsHZB_YLE9_vg7UY2ps3XPogjh1X5GsJCSKvr0FtQ-wL6-i-Jng4Yv8ikfg_06w
x-goog-storage-class: STANDARD
access-control-max-age: 604800
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript; charset=UTF-8
cf-request-id: 080e85630f00000621e2bda000000001
timing-allow-origin: *
last-modified: Tue, 05 Jan 2021 19:44:03 GMT
server: cloudflare
etag: W/"4bee34a2d9a86ac5c2494d32ff71d44f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-goog-generation: 1609875843800176
access-control-allow-origin: https://cyware.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
x-goog-stored-content-length: 55617
cf-ray: 61c43e7e78ef0621-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Thu, 04 Feb 2021 12:05:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 2198
date: Thu, 04 Feb 2021 11:26:03 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Thu, 04 Feb 2021 13:26:03 GMT

GET
H2 200 93ca01d.jpg
production.cyware.com/social/img/ 3 KB
4 KB 7ms
7ms Image
image/jpeg 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/93ca01d.jpg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 144f3e783ff9333379de9720b8182e7e1115f51ef29a58059c8be590557b7470

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 05:18:29 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:01 GMT
server: AmazonS3
age: 24253
etag: "93ca01db7b98aec53231108d9a42984a"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 3526
x-amz-cf-id: 4tbeuz8JZ_QIjheDcC3TiW24LiRjTSXtXj1wIJfh8CGPg25yRozCFA==

GET
H2 200 category-slug-map Show response
cyware.com/api-social/ 2 KB
1 KB 297ms
297ms XHR
application/json 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/api-social/category-slug-map

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

3bbc3caa2f3515d496602dc7f4b05045d0d76c573d7ec2ac90af95e8da62fb77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
content-encoding: gzip
etag: W/"97b-oaHxdeUE2UUxkqPjq4nDexjEBV4"
server: Cyware
x-powered-by: Express
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400, no-cache, public
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Origin, Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 event-types Show response
cyware.com/api-social/ 80 B
551 B 278ms
278ms XHR
application/json 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/api-social/event-types

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

1c29911377afb700041f265d91ae3443493511c92e0b7944ad177684f3971fd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
content-encoding: gzip
etag: W/"50-vFfRg8QlCC/fLcnjbRRDa4klWqM"
server: Cyware
x-powered-by: Express
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400, no-cache, public
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Origin, Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK 4fc6_shutterstock_1788902369.jpg
cyware-ent.s3.amazonaws.com/image_bank/ 316 KB
316 KB 867ms
228ms Image
image/jpeg 52.218.213.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cyware-ent.s3.amazonaws.com/image_bank/4fc6_shutterstock_1788902369.jpg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.213.2 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c8b3046ca35121b34cdbc63f0cce915d9263103d736bd0ab493bd48f7ffc1fe8

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Thu, 04 Feb 2021 12:02:43 GMT
Last-Modified: Mon, 28 Sep 2020 15:32:50 GMT
Server: AmazonS3
x-amz-request-id: 41AAB85C579B2AC6
ETag: "5b6903b14b7498ea67016163d4daac14"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 323594
x-amz-id-2: /AZKhD71R+4OyroViWJxhUPCp3866dpHLy2RV8doUJYxfvaNOwfZ/DzLZq790Yhgd3JLAN5adQE=

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
66 B 13ms
13ms XHR
text/plain 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=574754433&t=pageview&_s=1&dl=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&dp=%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&ul=en-us&de=UTF-8&dt=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABEAAAAC~&jid=312194149&gjid=681984817&cid=1611208738.1612440162&tid=UA-74369186-1&_gid=46777831.1612440162&_r=1&_slc=1&z=340984952

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
forms.hubspot.com/collected-forms/v1/config/ 115 B
572 B 112ms
111ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/collected-forms/v1/config/json?portalId=7288424&utk=

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ea17086828c522aa1ef196dec0bd559e97fd7806af1a26639d71b843e11885a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e85651800004a68ba1cc000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eEmV0i5nb%2BqfmCoSX3uuAvLlcy4hqcF4yuUhyZgkdHTKilLBptSJXhji0vJ%2BORhEpTZkbsLG%2Fb5hfeLZXnVfk8MrnTz6sH8Za98VstcDZD%2F21CNczIDtQjyEKi4SYA%3D%3D"}]}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://cyware.com
access-control-allow-credentials: false
cf-ray: 61c43e81baac4a68-FRA
access-control-allow-headers: *

GET
H2 200 4f96684999e450d0bab7.js Show response
production.cyware.com/social/ 21 KB
21 KB 8ms
7ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/4f96684999e450d0bab7.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dab3dc392b427fa80a47eb075f9c3d5c5485f203cdd68e0bf06b9185bffbc14d

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 06:39:33 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 19389
etag: "970f4da6d022de65dc2dfeed327ceae3"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 21620
x-amz-cf-id: EYjoMi7l2hE7SAZKTxgfFJTG7uIPGQO2HfJAbQBh2KA-Tv1ZHHuFNA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
84 B 19ms
17ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-74369186-1&cid=1611208738.1612440162&jid=312194149&gjid=681984817&_gid=46777831.1612440162&_u=aEBAAEAAEAAAAC~&z=1410950620

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 04 Feb 2021 12:02:41 GMT
content-type: text/plain
access-control-allow-origin: https://cyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 d5ecacc692abc5131009.js Show response
production.cyware.com/social/ 16 KB
16 KB 13ms
8ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/d5ecacc692abc5131009.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8336f858ea70793d6472fc6b485f6c3860422eeb72d68fc8700c5d9ecd9c9623

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 20:59:17 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 54205
etag: "5abd538c146b6785888ce11383060509"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 15928
x-amz-cf-id: GOIexQjnHMLqYYFmJgq-4_TIeg0isJ9H_ZuqxWebPizlheIQ4M4IDw==

GET
H2 200 81fe404f670a24fa71fa.js Show response
production.cyware.com/social/ 5 KB
5 KB 13ms
9ms Script
application/javascript 2600:9000:206f:fe00:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/81fe404f670a24fa71fa.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c5181ce795e6e315c32deb6862f1ae2ebbd7099a5a698ee66a1ccd731242e606

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 00:47:26 GMT
via: 1.1 28ccbefb54459137bb0b0d946fd75e49.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 40516
etag: "3a7d6402de48a6998c4948c8eb82b9a7"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 5056
x-amz-cf-id: t3e5O6eV0khleUipTqWRE9N6I9WbjGG3grr6XdBIh7PtKoYv5fNmAg==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 33ms
32ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-74369186-1&cid=1611208738.1612440162&jid=312194149&_u=aEBAAEAAEAAAAC~&z=621597619

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 20ms
18ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-74369186-1&cid=1611208738.1612440162&jid=312194149&_u=aEBAAEAAEAAAAC~&z=621597619

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
589 B 147ms
113ms Image
image/gif 2606:4700::6810:5805
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-trace: 2B55CAC8A2E2F3BB56DAE2958B5997E7202A1E89FD000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 61c43e82da590ea7-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
cf-request-id: 080e8565c600000ea758bb1000000001

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixel/ 132 B
569 B 401ms
398ms XHR
application/json 2606:4700::6811:cbcc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=7288424

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cbcc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29306b4929334133441b534c9a071db089f6d00852f5ea8faf7b1c224caf052c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e856b34000005dc1bbdf000000001
server: cloudflare
x-trace: 2B261F9C0AADFEC5230375D1459C8EE2FDC2092BB3000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JJaZmJeWffutIPH1EI6ojjBOBW4Uts0lmf9aj6zcQyctkNdNj0o6fnw9H2ys7L56FVt2fXKVdAQxTWHkLxeO52gHIxuWCam%2B9ezbSnJ31UW4OAGRWnbT%2BhTD%2Bg%3D%3D"}]}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://cyware.com
access-control-allow-credentials: false
cf-ray: 61c43e8b8c3505dc-FRA
access-control-allow-headers: *

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
470 B 30ms
24ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=7288424&pu=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&t=New+Trickbot+Malware+Component+Performs+Local+Network+Reconnaissance+%7C+Cyware+Alerts+-+Hacker+News&cts=1612440163164&vi=220812d347be01a1d19cf3fa93999ae3&nc=true&u=86885063.220812d347be01a1d19cf3fa93999ae3.1612440163126.1612440163126.1612440163126.1&b=86885063.1.1612440163127

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:43 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61c43e8bea8e4a8c-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
cf-request-id: 080e856b7100004a8ccfadb000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0JyB%2FCDLYjYCqf82B4Q0%2FcfSG5kIfrUZCkAu5Ht%2BrtK3L659DktN4CADB%2BBNfSLP3hhkii%2Ff0EbUhgvUNw6EjYPrbVl%2Fr4cHZMpU4662DCryEwbcD%2BND4r19UkANsg%3D%3D"}],"max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
38 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-712433333

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06c5b71d44db800a76f776a12573f25adecb4e0cfae8b2643e06ed85d27fe40a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:43 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39016
x-xss-protection: 0
expires: Thu, 04 Feb 2021 12:02:43 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Feb 2021 12:02:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=79660
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2232740%26time%3D1612440163536%26url%3Dhttps%253A%252F%252Fcyware.com%252Fnews%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_...

0
66 B

182ms
179ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:44 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: 8OUYOcmJYBZwVNdzzCoAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
content-length: 0
x-li-uuid: Fq4kMsmJYBYw6oX0oCsAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 709C104944F4436A89E490D879B09A0C Ref B: FRAEDGE0717 Ref C: 2021-02-04T12:02:43Z
x-frame-options: sameorigin
date: Thu, 04 Feb 2021 12:02:43 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=31536000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440163536&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
12 KB 73ms
72ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-712433333

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

c4eb51f22f568120cf9ab08fbeae1a5369ec10fd7dba0ceba07038b07a9a9975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 12189
x-xss-protection: 0
server: cafe
etag: 7685221537260973389
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 04 Feb 2021 12:02:43 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/712433333/ 3 KB
1 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/712433333/?random=1612440163672&cv=9&fst=1612440163672&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55d285fba051a88be6aa487cb372722368396d8ce5aaed173a89b7ca6a8e1085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1251
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/712433333/ 42 B
108 B 21ms
19ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/712433333/?random=1612440163672&cv=9&fst=1612440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&async=1&fmt=3&is_vtc=1&random=4115229936&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/712433333/ 42 B
108 B 21ms
19ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/712433333/?random=1612440163672&cv=9&fst=1612440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&async=1&fmt=3&is_vtc=1&random=4115229936&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--WWpxFHZShnIJE-0ArTHyKI0JB0T9XkTKMvSrxY5515hazCdA2koMU7bMzm9aCC9M1fJ3c33SfQ18zMVu5nOxrMfoEZ8LbBBdnM_2sTwXWFOsHdE4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:02:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
debugger.cyware.io/api/14/store/ 41 B
242 B 482ms
150ms Fetch
application/json 3.12.28.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://debugger.cyware.io/api/14/store/?sentry_key=9c07e881c5374efaaa34073581390682&sentry_version=7
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.12.28.145 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-12-28-145.us-east-2.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3cca5f468fd5715ed04ded0e2696a3144e08687ab59785d5351db9b7713be9b

Request headers

Referer: https://cyware.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://cyware.com
date: Thu, 04 Feb 2021 12:02:53 GMT
server: nginx/1.14.0 (Ubuntu)
content-type: application/json
content-length: 41
vary: Origin
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cyware.com/	1970-01-19 15:54:01	Name: __hssc Value: 86885063.1.1612440163127
.cyware.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cyware.com/	1970-01-20 01:15:36	Name: hubspotutk Value: 220812d347be01a1d19cf3fa93999ae3
.cyware.com/	1970-01-20 01:15:36	Name: __hstc Value: 86885063.220812d347be01a1d19cf3fa93999ae3.1612440163126.1612440163126.1612440163126.1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://info.silobreaker.com/e2t/sc2/MmZ-8yjRqsbW74mWSq8TJ7-4W839blQ5MPY8pW2xl36D69gkRFdBBD6K04(Line 13) Message: toS
console-api	log	URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js(Line 2) Message: default

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
cyware-ent.s3.amazonaws.com
cyware.com
debugger.cyware.io
fonts.googleapis.com
fonts.gstatic.com
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
info.silobreaker.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
polyfill.io
production.cyware.com
px.ads.linkedin.com
snap.licdn.com
stats.g.doubleclick.net
track.hubspot.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
142.250.185.194
199.60.103.2
2600:9000:206f:fe00:1:d92a:12c0:93a1
2606:4700::6810:5805
2606:4700::6811:47b0
2606:4700::6811:74b0
2606:4700::6811:81ab
2606:4700::6811:b949
2606:4700::6811:cbcc
2606:4700::6811:d4cc
2606:4700::6812:15bf
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:808::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2004
2a00:1450:4001:812::200a
2a00:1450:4001:816::2002
2a00:1450:4001:821::200e
2a00:1450:4001:824::2008
2a00:1450:4001:829::2003
2a00:1450:400c:c00::9c
2a02:26f0:10c:58e::25ea
2a04:4e42:600::621
2a05:f500:11:101::b93f:9005
3.12.28.145
52.218.213.2
52.24.83.42
06c5b71d44db800a76f776a12573f25adecb4e0cfae8b2643e06ed85d27fe40a
0ea17086828c522aa1ef196dec0bd559e97fd7806af1a26639d71b843e11885a
144f3e783ff9333379de9720b8182e7e1115f51ef29a58059c8be590557b7470
194bf057cf24ac499b27acd6017d5eb780c2ec352c826780e90147ff14e997a2
1a6f5b70c11a59bd2b27a534812185b21e5c2c4a4367a69bf7069ebee21fdd07
1c29911377afb700041f265d91ae3443493511c92e0b7944ad177684f3971fd3
29306b4929334133441b534c9a071db089f6d00852f5ea8faf7b1c224caf052c
325bb368e3fc5a1f6ad31c10e3038e41568383733c767ce3d81d88baba391ff8
3399b34b280df0bae72875db0c8920320cc6b8ce3e64413541fdcb7fd53a2a8f
3bbc3caa2f3515d496602dc7f4b05045d0d76c573d7ec2ac90af95e8da62fb77
3d2e8b49e8529d1acbd9834ac3ea1993ef3d37323bacac1acf2823cfa3939916
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
55d285fba051a88be6aa487cb372722368396d8ce5aaed173a89b7ca6a8e1085
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
74d8bcba84408837591b6a12b342594272aad99a02eafe4a0280e6f8a444dea2
82efa3a52ca2051d452e2c6b30a6574889b4ddf2e59345f223e5c2966f3a1816
8336f858ea70793d6472fc6b485f6c3860422eeb72d68fc8700c5d9ecd9c9623
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85b72d835785786caeae28d952423f715e423e09416c83bd6f92cdb62ed83686
85e4de3133efb8cfc29593809c401f7ad7b5b29533401837bbf8817b12e5c172
903ae5fada489883e7aeca6c41b1512ad7d22836b6187b7c3afa8e0416ceaf43
a12ac37a39b2818801153898a9e716122189a054cb0cc0a98131ead6b57751d9
a6f31a335ef4afee665755556d8d50cfb3239d80601283c56af47c339f887a7d
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b51138e5e61472dbda3e0ab2912184d8468f61c6eaa486b2fbd4db171b0b7850
b8783d5fa087983659871825aaf0c0582509f3fce9174bfbe4d811a6ff04bfb8
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c4eb51f22f568120cf9ab08fbeae1a5369ec10fd7dba0ceba07038b07a9a9975
c5181ce795e6e315c32deb6862f1ae2ebbd7099a5a698ee66a1ccd731242e606
c5636027d157543583d21ae2574222e4b4ff16ebf12d5a70d6f074940195fb92
c8b3046ca35121b34cdbc63f0cce915d9263103d736bd0ab493bd48f7ffc1fe8
c9135488238506768788d901ac1ce80816f79dc21ea16e2fbf392b833959ac66
d16896edf8050f6a0cd7a7b9359ca7522be23382eac47ada9aa693c88cc519d1
d6aa44d7515541e116c9a091bb0b5a70e4f81728126347261635b5cda6aec1e4
dab3dc392b427fa80a47eb075f9c3d5c5485f203cdd68e0bf06b9185bffbc14d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cca5f468fd5715ed04ded0e2696a3144e08687ab59785d5351db9b7713be9b
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e530afcd39959ea41c6c4d2fc2c4fd097b0ae5bed210dcaf8bad0cd60d31a5ba
eaf2fcedc750e57874345df198b57bf5b61a85282630cf4d0270003097693be3
ec6b9513987f66b5903cebdb93bcc616b68f9909f647d3f50b7a6544dcfd9e2f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f30acdaa946790462d6bd75c16d7b1559b24c57317e9bf78a1646bdb2d647ef3

cyware.com Open in urlscan Pro 52.24.83.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

46 Requests

100 %HTTPS

82 %IPv6

24 Domains

28 Subdomains

28 IPs

6 Countries

2563 kBTransfer

3452 kBSize

4 Cookies

11 Outgoing links

Page URL History

Redirected requests

46 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cyware.com Open in urlscan Pro
52.24.83.42 Public Scan

Screenshot
Live screenshot

Full Image

46
Requests

100 %
HTTPS

82 %
IPv6

24
Domains

28
Subdomains

28
IPs

6
Countries

2563 kB
Transfer

3452 kB
Size

4
Cookies

46 HTTP transactions
3 data transactions