www.trendmicro.com Open in urlscan Pro
104.84.86.114 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Submission: On October 03 via manual (October 3rd 2020, 11:30:19 pm UTC) from US

Summary HTTP 118 Redirects Links 47 Behaviour Indicators

Summary

This website contacted 43 IPs in 6 countries across 36 domains to perform 118 HTTP transactions. The main IP is 104.84.86.114, located in United States and belongs to AKAMAI-ASN1, EU. The main domain is www.trendmicro.com.
TLS certificate: Issued by AffirmTrust Extended Validation CA - EV1 on March 25th 2020. Valid for: 2 years.

This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
33	104.84.86.114 104.84.86.114	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:10:... 2606:4700:10::ac43:e8b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6814:7c67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	104.111.215.136 104.111.215.136	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:81b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81f::2008	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:81e::200e	15169 (GOOGLE) (GOOGLE)
7	34.96.102.137 34.96.102.137	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c04::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2008	15169 (GOOGLE) (GOOGLE)
2	104.109.95.62 104.109.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:825::2008	15169 (GOOGLE) (GOOGLE)
1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:2b0... 2a02:26f0:2b00:79b::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	54.208.202.231 54.208.202.231	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	52.8.244.49 52.8.244.49	16509 (AMAZON-02) (AMAZON-02)
1	35.201.125.192 35.201.125.192	15169 (GOOGLE) (GOOGLE)
1 2	216.58.207.38 216.58.207.38	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	65.9.19.119 65.9.19.119	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.221.14 185.33.221.14	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.225.78.83 13.225.78.83	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20d... 2600:9000:20d7:5600:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1 2	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2600:9000:20e... 2600:9000:20eb:b600:c:90ee:6000:21	16509 (AMAZON-02) (AMAZON-02)
1	35.244.153.179 35.244.153.179	15169 (GOOGLE) (GOOGLE)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	18.203.124.74 18.203.124.74	16509 (AMAZON-02) (AMAZON-02)
118	43

33 104.84.86.114 (United States)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-84-86-114.deploy.static.akamaitechnologies.com

www.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:e8b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.datatables.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:7c67 (United States)

ASN13335 (CLOUDFLARENET, US)

customer.cludo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.111.215.136 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-136.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:81e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.96.102.137 (United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.95.62 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-95-62.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:79b::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.73.206 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.208.202.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-202-231.compute-1.amazonaws.com

web-analytics.engagio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.8.244.49 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-8-244-49.us-west-1.compute.amazonaws.com

resources.xg4ken.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 192.125.201.35.bc.googleusercontent.com

cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.207.38 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s24-in-f6.1e100.net

5427711.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.19.119 (Seattle, United States)

ASN16509 (AMAZON-02, US)

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.14 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.83 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-83.fra2.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20d7:5600:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

945-cxd-062.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:b600:c:90ee:6000:21 (United States)

ASN16509 (AMAZON-02, US)

dn1f1hmdujj40.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.153.179 (Mountain View, United States)

ASN15169 (GOOGLE, US)

ixf2-api.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.124.74 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	trendmicro.com www.trendmicro.com resources.trendmicro.com	515 KB
17	tiqcdn.com tags.tiqcdn.com	52 KB
11	google-analytics.com www.google-analytics.com ssl.google-analytics.com	57 KB
7	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com	124 KB
6	doubleclick.net 2 redirects stats.g.doubleclick.net 5427711.fls.doubleclick.net googleads.g.doubleclick.net	4 KB
4	gstatic.com fonts.gstatic.com	37 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	googleapis.com fonts.googleapis.com ajax.googleapis.com	76 KB
2	facebook.com www.facebook.com	523 B
2	google.de www.google.de	645 B
2	google.com 1 redirects www.google.com	1 KB
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	bing.com bat.bing.com	9 KB
2	bc0a.com cdn.bc0a.com ixf2-api.bc0a.com	24 KB
2	engagio.com web-analytics.engagio.com	2 KB
2	facebook.net connect.facebook.net	92 KB
2	googleadservices.com www.googleadservices.com	14 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
2	marketo.net munchkin.marketo.net	7 KB
2	googletagmanager.com www.googletagmanager.com	75 KB
1	twitter.com analytics.twitter.com	650 B
1	cloudfront.net dn1f1hmdujj40.cloudfront.net	8 KB
1	t.co t.co	448 B
1	mktoresp.com 945-cxd-062.mktoresp.com	311 B
1	licdn.com snap.licdn.com	2 KB
1	quantcount.com rules.quantcount.com	358 B
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	284 B
1	xg4ken.com resources.xg4ken.com	5 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	bizographics.com sjs.bizographics.com	761 B
1	ytimg.com s.ytimg.com	37 KB
1	youtube.com www.youtube.com	1 KB
1	cludo.com customer.cludo.com	3 KB
1	datatables.net cdn.datatables.net	3 KB
118	36

	Domain	Requested by
33	www.trendmicro.com	www.trendmicro.com
17	tags.tiqcdn.com	www.trendmicro.com tags.tiqcdn.com
9	www.google-analytics.com	www.trendmicro.com www.google-analytics.com www.googletagmanager.com
7	dev.visualwebsiteoptimizer.com	tags.tiqcdn.com dev.visualwebsiteoptimizer.com www.trendmicro.com
4	fonts.gstatic.com	fonts.googleapis.com
2	www.facebook.com	www.trendmicro.com
2	px.ads.linkedin.com	1 redirects www.trendmicro.com
2	www.google.de	www.trendmicro.com
2	www.google.com	1 redirects www.trendmicro.com
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	secure.adnxs.com	2 redirects
2	bat.bing.com	www.googletagmanager.com www.trendmicro.com
2	5427711.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	web-analytics.engagio.com	tags.tiqcdn.com dn1f1hmdujj40.cloudfront.net
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	www.googleadservices.com	tags.tiqcdn.com www.googleadservices.com
2	ssl.google-analytics.com	tags.tiqcdn.com www.trendmicro.com
2	munchkin.marketo.net	tags.tiqcdn.com munchkin.marketo.net
2	stats.g.doubleclick.net	www.google-analytics.com
2	www.googletagmanager.com	www.trendmicro.com tags.tiqcdn.com
2	ajax.googleapis.com	www.trendmicro.com
1	insight.adsrvr.org	js.adsrvr.org
1	analytics.twitter.com	static.ads-twitter.com
1	ixf2-api.bc0a.com	cdn.bc0a.com
1	dn1f1hmdujj40.cloudfront.net	web-analytics.engagio.com
1	t.co	www.trendmicro.com
1	www.linkedin.com	1 redirects
1	pixel.quantserve.com	www.trendmicro.com
1	945-cxd-062.mktoresp.com	munchkin.marketo.net
1	snap.licdn.com	sjs.bizographics.com
1	rules.quantcount.com	secure.quantserve.com
1	attr.ml-api.io	www.trendmicro.com
1	s.ml-attr.com	1 redirects
1	js.adsrvr.org	www.googletagmanager.com
1	cdn.bc0a.com	tags.tiqcdn.com
1	resources.xg4ken.com	tags.tiqcdn.com
1	static.ads-twitter.com	tags.tiqcdn.com
1	resources.trendmicro.com	tags.tiqcdn.com
1	sjs.bizographics.com	tags.tiqcdn.com
1	secure.quantserve.com	tags.tiqcdn.com
1	s.ytimg.com	www.youtube.com
1	www.youtube.com	tags.tiqcdn.com
1	fonts.googleapis.com	www.trendmicro.com
1	customer.cludo.com	www.trendmicro.com
1	cdn.datatables.net	www.trendmicro.com
118	45

This site contains links to these domains. Also see Links.

Domain
downloadcenter.trendmicro.com
store.trendmicro.com
buyonline.trendmicro.com
renewonline.trendmicro.com
www.trendmicro.cz
success.trendmicro.com
esupport.trendmicro.com
community-trendmicro.force.com
www.trendsecure.com
pwm.trendmicro.com
clp.trendmicro.com
sso.trendmicro.com
tm.login.trendmicro.com
app.deepsecurity.trendmicro.com
signup.cj.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
www.zerodayinitiative.com
resources.trendmicro.com
newsroom.trendmicro.com
plus.google.com
technet.microsoft.com
support.microsoft.com
www.zoomerang.com
feeds.feedburner.com

Subject Issuer	Validity	Valid
www.trendmicro.com AffirmTrust Extended Validation CA - EV1	`2020-03-25` - `2022-03-26`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-29` - `2021-07-29`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2020-03-16` - `2021-06-15`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2020-06-19` - `2022-07-06`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2020-03-23` - `2022-03-28`	2 years	crt.sh
resources.trendmicro.com Cloudflare Inc ECC CA-3	`2020-07-25` - `2021-07-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.engagio.com Sectigo RSA Organization Validation Secure Server CA	`2020-06-16` - `2021-06-16`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.xg4ken.com Go Daddy Secure Certificate Authority - G2	`2017-12-17` - `2020-12-17`	3 years	crt.sh
cdn.bc0a.com GTS CA 1D2	`2020-09-03` - `2020-12-02`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
ixf2-api.bc0a.com GTS CA 1D2	`2020-08-27` - `2020-11-25`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Frame ID: 9287B8F34476B693020DB720408EBC75
Requests: 116 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F
Frame ID: 07C0245A5C1F470EF5D85983A4405ED0
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&upid=803df29&upv=1.1.0
Frame ID: C4820DB1869DFE8494491336405CEE16
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

118
Requests

100 %
HTTPS

57 %
IPv6

36
Domains

45
Subdomains

43
IPs

6
Countries

1160 kB
Transfer

3737 kB
Size

2
Cookies

47 Outgoing links

These are links going to different origins than the main page.

URL: http://downloadcenter.trendmicro.com/index.php?clk=left_nav&clkval=rss_feed&regs=NABU
Title: Subscribe to Download Center RSS

Search URL Search Domain Scan URL

URL: http://store.trendmicro.com/store/tmamer/Content/pbPage.Home/pgm.4823570300/
Title: Home Office Online Store

Search URL Search Domain Scan URL

URL: http://store.trendmicro.com/store/tmamer/html/pbPage.ManualRenew/ThemeID.7735600
Title: Renew Online

Search URL Search Domain Scan URL

URL: http://buyonline.trendmicro.com/
Title: Buy Online

Search URL Search Domain Scan URL

URL: http://renewonline.trendmicro.com/
Title: Renew Online

Search URL Search Domain Scan URL

URL: http://www.trendmicro.cz/
Title: Česká Republika

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/sign-in
Title: My Support

Search URL Search Domain Scan URL

URL: https://esupport.trendmicro.com/en-us/home/index.aspx
Title: Log In to Support

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Partner
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://www.trendsecure.com/my_account/signin/login
Title: My Account

Search URL Search Domain Scan URL

URL: https://www.trendsecure.com/report_stolen/locker/report
Title: Trend Micro Vault

Search URL Search Domain Scan URL

URL: http://pwm.trendmicro.com/
Title: Password Manager

Search URL Search Domain Scan URL

URL: https://clp.trendmicro.com/
Title: Customer Licensing Portal

Search URL Search Domain Scan URL

URL: https://esupport.trendmicro.com/oct
Title: Online Case Tracking

Search URL Search Domain Scan URL

URL: https://sso.trendmicro.com/sso/form/authenticate.aspx
Title: Worry-Free Business Security Services

Search URL Search Domain Scan URL

URL: https://tm.login.trendmicro.com/authenticate/api/false/tmrm
Title: Remote Manager

Search URL Search Domain Scan URL

URL: https://app.deepsecurity.trendmicro.com/
Title: Deep Security as a Service

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1157059
Title: Referral Affiliate

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t
Title: Referral Affiliate

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/technical-support
Title: Support

Search URL Search Domain Scan URL

URL: https://www.facebook.com/TrendMicro/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/trendmicro
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro/
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/TrendMicroInc
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.zerodayinitiative.com/about/
Title: Zero Day Initiative (ZDI)

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/business-support
Title: Business Support

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/virus-and-threat-help
Title: Virus & Threat Help

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/renewals-and-registration
Title: Renewals & Registration

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/contact-support-north-america
Title: Contact Support

Search URL Search Domain Scan URL

URL: http://downloadcenter.trendmicro.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/virus-and-threat-help#threat-removal
Title: Free Cleanup Tools

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/deep-security-10-0
Title: Deep Security

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/apex-one
Title: Apex One

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/product-support/worry-free-business-security
Title: Worry-Free

Search URL Search Domain Scan URL

URL: http://renewonline.trendmicro.com/us/default.aspx
Title: Worry-Free Renewals

Search URL Search Domain Scan URL

URL: https://resources.trendmicro.com/Partner-Sign-Up.html
Title: Become a Partner (Reseller, Integrator)

Search URL Search Domain Scan URL

URL: https://newsroom.trendmicro.com/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&text=Trojan.Win32.ZURGOP.BE&tw_p=tweetbutton&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=Trojan.Win32.ZURGOP.BE%20https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Title: Google+

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&title=Trojan.Win32.ZURGOP.BE&summary=Trojan.Win32.ZURGOP.BE
Title: Linkedin

Search URL Search Domain Scan URL

URL: http://technet.microsoft.com/en-us/sysinternals/bb896653
Title: here

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/977380/the-search-programs-and-files-box-does-not-display-search-results-corr
Title: following Microsoft page

Search URL Search Domain Scan URL

URL: http://www.zoomerang.com/Survey/WEB22CWQU9N2PR
Title: Did this description help? Tell us how we did.

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro
Title: linkedin

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Trendmicro/
Title: facebook

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/TrendmicroSecurityNews
Title: rss

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F HTTP 302
https://5427711.fls.doubleclick.net/activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F

Request Chain 88

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=1799188272190335132

Request Chain 102

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1601767793721%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fvinfo%252Fus%252Fthreat-encyclopedia%252Fmalware%252Ftrojan.win32.zurgop.be%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&liSync=true

Request Chain 103

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=cQl5X5PfK_G6lQePuYvIBA&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=cQl5X5PfK_G6lQePuYvIBA&cid=CAQSKQCNIrLMP8iDIA1uwj9ZpH0OVd1yeVguhJHdqb_8YQGtgiddZT5JINao&random=3398381594&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=cQl5X5PfK_G6lQePuYvIBA&cid=CAQSKQCNIrLMP8iDIA1uwj9ZpH0OVd1yeVguhJHdqb_8YQGtgiddZT5JINao&random=3398381594&resp=GooglemKTybQhCsO&ipr=y

118 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/ 118 KB
19 KB 2975ms
2706ms Document
text/html 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b040960c2cfd59dcfae30f724d6701192821ff53b7349eb4ab5d835bb70606c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

:method: GET
:authority: www.trendmicro.com
:scheme: https
:path: /vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
content-type: text/html; charset=utf-8
strict-transport-security: max-age=15552000; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
x-prod-n-02: Yes
content-encoding: gzip
content-length: 18720
vary: Accept-Encoding
cache-control: private, max-age=865
date: Sat, 03 Oct 2020 23:29:53 GMT
set-cookie: __AntiXsrfToken=f315a37055c34b08bde12aeb0d43d60f; path=/; HttpOnly

GET
H2 200 TEx.css
www.trendmicro.com/vinfo/css/ 92 KB
16 KB 69ms
64ms Stylesheet
text/css 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/TEx.css?v1.1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

38955525fa945d94f96d6c5d969f5c1299fdd30c48ea471cba7f71490ee1ab61

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 16453
x-prod-n-02: Yes
last-modified: Mon, 04 Mar 2019 06:59:58 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: text/css
x-xss-protection: 1;mode=block
cache-control: max-age=1732
etag: W/"4c814ce157d2d41:0"
expires: Sat, 03 Oct 2020 23:58:45 GMT

GET
H2 200 jquery.min.js Show response
www.trendmicro.com/etc/clientlibs/granite/ 111 KB
38 KB 88ms
83ms Script
application/javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc/clientlibs/granite/jquery.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9f0173ed05fe8618c76272aaae6711ae0fa7ece07de8522cb6b0159d22b691f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 38305
x-prod-n-02: Yes
x-prod-a-04: Yes
last-modified: Fri, 02 Oct 2020 21:09:01 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: application/javascript
x-xss-protection: 1;mode=block
cache-control: max-age=683
etag: "1ba4e-5b0b68abb2932"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:41:16 GMT

GET
H2 200 utils.min.js Show response
www.trendmicro.com/etc/clientlibs/granite/ 9 KB
4 KB 93ms
88ms Script
application/javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc/clientlibs/granite/utils.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

fcea66becd77485eb760a9a65e38d47319f69b724ae046f9b246842a1daa6c18

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
x-prod-n-01: Yes
content-length: 3644
x-xss-protection: 1;mode=block
x-frame-options: SAMEORIGIN
last-modified: Fri, 02 Oct 2020 23:55:48 GMT
server: nginx
x-prod-a-02: Yes
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=614
etag: "2547-5b0b8df35ee5a"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:40:07 GMT

GET
H2 200 font-awesome.min.css
www.trendmicro.com/vinfo/css/ 30 KB
7 KB 72ms
67ms Stylesheet
text/css 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/font-awesome.min.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
x-prod-n-01: Yes
content-length: 6930
x-xss-protection: 1;mode=block
last-modified: Thu, 22 Dec 2016 07:50:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=515
etag: W/"0c15513285cd21:0"
expires: Sat, 03 Oct 2020 23:38:28 GMT

GET
H2 200 clientlibs.min.css
www.trendmicro.com/vinfo/css/ 303 KB
44 KB 84ms
80ms Stylesheet
text/css 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

01dbbe1ad2037e8bc294848eaccc27958f69e1ac205db64c6db69405e361b22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 44964
x-prod-n-02: Yes
last-modified: Fri, 15 May 2020 09:47:31 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: text/css
x-xss-protection: 1;mode=block
cache-control: max-age=1748
etag: W/"79c98da9d2ad61:0"
expires: Sat, 03 Oct 2020 23:59:01 GMT

GET
H2 200 customSiteStyle.css
www.trendmicro.com/vinfo/css/ 103 KB
16 KB 70ms
66ms Stylesheet
text/css 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

27dbc587cdeb9b04598011c76ee9511866c57028688169613a37005ed6d8ad84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 15923
x-prod-n-02: Yes
last-modified: Tue, 14 Jul 2020 01:42:05 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: text/css
x-xss-protection: 1;mode=block
cache-control: max-age=1556
etag: W/"8bbd9dfa7f59d61:0"
expires: Sat, 03 Oct 2020 23:55:49 GMT

GET
H2 200 jquery.dataTables.min.css
cdn.datatables.net/1.10.16/css/ 14 KB
3 KB 42ms
17ms Stylesheet
text/css 2606:4700:10::ac43:e8b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.datatables.net/1.10.16/css/jquery.dataTables.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:e8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 618d62ceaca1223e16de2c8939a1963a95c34b0ac75852f835f93e5b42f20871

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 12258524
status: 200
content-length: 2109
cf-request-id: 059265f9b10000beab3fafb200000001
last-modified: Tue, 12 May 2020 14:02:48 GMT
server: cloudflare
etag: "11211af-364c-5a573eb2d1e28-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
access-control-allow-methods: GET
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 5dca72a2bb92beab-FRA
access-control-allow-headers: origin, x-requested-with, content-type
expires: Sat, 15 May 2021 02:21:08 GMT

GET
H2 200 cludo-search.min.css
customer.cludo.com/css/296/1798/ 16 KB
3 KB 38ms
16ms Stylesheet
text/css 2606:4700:10::6814:7c67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:7c67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 55375
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 059265f9ae0000dfe3b4a47200000001
last-modified: Fri, 02 Oct 2020 05:47:48 GMT
server: cloudflare
etag: W/"05aea8e7f98d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=300
cf-ray: 5dca72a2bdcbdfe3-FRA
x-lb: 2

GET
H2 200 analytics.js Show response
www.trendmicro.com/vinfo/js/ 451 B
589 B 68ms
65ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/analytics.js?v1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3807e44914c34f9e293702693b49039f774b1eef7798a0fa8dfbb3c1992e32dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Feb 2017 04:38:17 GMT
server: nginx
etag: W/"cee15a297c86d21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 330
x-prod-n-02: Yes

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 83ms
40ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4903c46eb377341675a2ef44e04682d84b20a0dea5ef3f30633d8cf98531b899

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 19:14:20 GMT
server: AkamaiNetStorage
etag: "32ba5e32619e55fe51f3f5da73b6c669:1601320460.570502"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 916
expires: Sat, 03 Oct 2020 23:34:53 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1018 B 17ms
15ms Stylesheet
text/css 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 03 Oct 2020 23:29:53 GMT
server: ESF
date: Sat, 03 Oct 2020 23:29:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 03 Oct 2020 23:29:53 GMT

GET
H2 200 rssfeedgetter2017.js Show response
www.trendmicro.com/vinfo/js/ 5 KB
2 KB 66ms
64ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/rssfeedgetter2017.js?v=1.0

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

aa0fb12210395609982a73f34b179f54280417eb48f18497e9b6a964569c27a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 17 Apr 2017 08:24:01 GMT
server: nginx
etag: W/"cde5f7f753b7d21:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 2038
x-xss-protection: 1;mode=block

GET
H2 200 icn_facebook.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 1 KB
1 KB 47ms
41ms Image
image/svg+xml 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_facebook.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 810
x-prod-n-02: Yes
x-frame-options: SAMEORIGIN
last-modified: Fri, 02 Oct 2020 21:29:40 GMT
server: nginx
x-prod-a-02: Yes
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1;mode=block
cache-control: max-age=1800
etag: "5e2-5b0b6d4964852"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:59:53 GMT

GET
H2 200 icn_twitter.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 394 B
680 B 46ms
41ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_twitter.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
status: 200
content-length: 394
x-prod-n-02: Yes
x-prod-a-04: Yes
last-modified: Fri, 02 Oct 2020 21:45:31 GMT
server: nginx
date: Sat, 03 Oct 2020 23:29:53 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
x-xss-protection: 1;mode=block
cache-control: max-age=1777
etag: "18a-5b0b70d3d6a25"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:59:30 GMT

GET
H2 200 icn_linkedin.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 970 B
889 B 68ms
63ms Image
image/svg+xml 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_linkedin.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 579
x-prod-n-02: Yes
x-frame-options: SAMEORIGIN
last-modified: Fri, 02 Oct 2020 22:07:31 GMT
server: nginx
x-prod-a-02: Yes
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1;mode=block
cache-control: max-age=1757
etag: "3ca-5b0b75bec18ec"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:59:10 GMT

GET
H2 200 icn_youtube.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 870 B
838 B 53ms
48ms Image
image/svg+xml 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_youtube.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 528
x-prod-n-02: Yes
x-frame-options: SAMEORIGIN
last-modified: Fri, 02 Oct 2020 21:22:38 GMT
server: nginx
x-prod-a-02: Yes
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1;mode=block
cache-control: max-age=1674
etag: "366-5b0b6bb7140cd"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:57:47 GMT

GET
H2 200 logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/ 13 KB
13 KB 42ms
37ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
status: 200
content-length: 13089
x-prod-n-02: Yes
x-prod-a-04: Yes
last-modified: Fri, 02 Oct 2020 22:23:13 GMT
server: nginx
date: Sat, 03 Oct 2020 23:29:53 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
x-xss-protection: 1;mode=block
cache-control: max-age=836
etag: "3321-5b0b794184717"
accept-ranges: bytes
expires: Sat, 03 Oct 2020 23:43:49 GMT

GET
H2 200 search-script.min.js Show response
www.trendmicro.com/vinfo/js/ 227 KB
41 KB 33ms
32ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/search-script.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

95c483d25f3a25069cb236935aa0cf2fae798d087078610b9634e052780f8ed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 15 May 2020 11:55:55 GMT
server: nginx
etag: W/"9da94ecaaf2ad61:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 41541
x-xss-protection: 1;mode=block

GET
H2 200 low.jpg
www.trendmicro.com/vinfo/imgFiles/ 14 KB
14 KB 587ms
583ms Image
image/jpeg 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/low.jpg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e245fbff2e30d272a758d502365776c924538aee1f5c5b7c555f3188810c5e61

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 25 Sep 2014 10:57:57 GMT
server: nginx
etag: "8c06790afd8cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
status: 200
x-xss-protection: 1;mode=block
cache-control: max-age=1780
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
content-length: 14313
x-prod-n-02: Yes
expires: Sat, 03 Oct 2020 23:59:33 GMT

GET
H2 200 legend.jpg
www.trendmicro.com/vinfo/imgFiles/ 4 KB
4 KB 202ms
197ms Image
image/jpeg 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/legend.jpg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8dcb49c6eed588b44599017b80a2709ebc2e11799c4919b12ea0523bbf81da79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 25 Sep 2014 12:12:52 GMT
server: nginx
etag: "f872ca7bad8cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
status: 200
x-xss-protection: 1;mode=block
cache-control: max-age=1800
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
content-length: 3970
x-prod-n-02: Yes
expires: Sat, 03 Oct 2020 23:59:53 GMT

GET
H2 200 trojan.png
www.trendmicro.com/vinfo/imgFiles/ 3 KB
3 KB 740ms
736ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/trojan.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

da1009faef6e5de07dd8540c5cc4d18b59f119c7529a181733372ce85f28f1f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Tue, 23 Sep 2014 11:49:41 GMT
server: nginx
etag: "8268f77524d7cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
cache-control: max-age=1709
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 3177
x-xss-protection: 1;mode=block
expires: Sat, 03 Oct 2020 23:58:22 GMT

GET
H2 200 no.png
www.trendmicro.com/vinfo/imgFiles/ 2 KB
3 KB 655ms
651ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/no.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

802c7cbfbc9af0b77e4715de030cf7c219e31eb54a3eaf79944b8447114b5d06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Tue, 23 Sep 2014 11:49:41 GMT
server: nginx
etag: "c54efa7524d7cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
cache-control: max-age=1795
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 2520
x-xss-protection: 1;mode=block
expires: Sat, 03 Oct 2020 23:59:48 GMT

GET
H2 200 in-the-wild.png
www.trendmicro.com/vinfo/imgFiles/ 2 KB
3 KB 627ms
624ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/in-the-wild.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e40de67375a4a4e45cc867b8f34ea1703a4c0dff37bcdb25bd54ffa0ef9b34b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Tue, 23 Sep 2014 11:49:41 GMT
server: nginx
etag: "5eaefb7524d7cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
x-xss-protection: 1;mode=block
cache-control: max-age=1800
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
content-length: 2428
x-prod-n-02: Yes
expires: Sat, 03 Oct 2020 23:59:53 GMT

GET
H2 200 customPageScripts.js Show response
www.trendmicro.com/vinfo/js/ 19 KB
5 KB 34ms
33ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/customPageScripts.js?Ver3.1

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bc40f55dc0399b99382412b3f312bd466bf2b0c3d1b227edc7bf2152ad7f43ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 May 2020 08:51:09 GMT
server: nginx
etag: W/"c79e7ea5329d61:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 4360
x-prod-n-02: Yes

GET
H2 200 share.js Show response
www.trendmicro.com/vinfo/js/ 2 KB
1022 B 43ms
36ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/share.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d1d326206efc842a8035a2d3a1d53aa66176de9d45039389d090c0ee72a39a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Feb 2017 03:51:24 GMT
server: nginx
etag: W/"3ddd4e9ebe81d21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 762
x-prod-n-02: Yes

GET
H2 200 TEX.tooltip.js Show response
www.trendmicro.com/vinfo/js/ 3 KB
1 KB 45ms
38ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/TEX.tooltip.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6f2adcf50cdc9374afa8b93818776ca2f36eef0f27b356df715d4d98aa6b5e19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Jan 2018 07:44:37 GMT
server: nginx
etag: W/"b0101fb31d89d31:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 876
x-xss-protection: 1;mode=block

GET
H2 200 eqlcolList.js Show response
www.trendmicro.com/vinfo/js/ 1 KB
679 B 47ms
41ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/eqlcolList.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

563772f765890f5c4e868355b1c9755deae8e886e1281cec1c15ee708543eb79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 10 Feb 2017 04:02:02 GMT
server: nginx
etag: W/"57233c6f5283d21:0"
x-prod-n-01: Yes
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 420
x-xss-protection: 1;mode=block

GET
H2 200 viewportchecker.js Show response
www.trendmicro.com/vinfo/js/ 3 KB
1 KB 46ms
40ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/viewportchecker.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

42e1111a0ebc79d1aa68af2ccac42031123c6a60fcdcc893c1452c9a76ef33da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Feb 2017 04:19:52 GMT
server: nginx
etag: W/"fdd9636cb085d21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 1217
x-prod-n-02: Yes

GET
H2 200 scroller.js Show response
www.trendmicro.com/vinfo/js/ 8 KB
1 KB 45ms
39ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/js/scroller.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7f57ae8c90a70d08a93990e3a24863fb52ad58e46587ebb3cbb93a0ad030d65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Feb 2017 06:02:40 GMT
server: nginx
etag: W/"5d6699c8be85d21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 1217
x-prod-n-02: Yes

GET
H2 200 jquery.dataTables.min.js Show response
www.trendmicro.com/vinfo/cloudlink/datatables/ 80 KB
28 KB 45ms
39ms Script
application/x-javascript 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/cloudlink/datatables/jquery.dataTables.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a9c575c2bf9b9f836806dc58aa0866cb558806fc5ea1ef2f4250a8c0b1be7278

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2018 12:41:33 GMT
server: nginx
etag: W/"71114878daabd31:0"
x-frame-options: SAMEORIGIN
content-type: application/x-javascript
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-length: 27832
x-prod-n-02: Yes

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ 36 KB
8 KB 11ms
5ms Stylesheet
text/css 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 01:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78845
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Oct 2021 01:35:48 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ 248 KB
66 KB 12ms
7ms Script
text/javascript 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 08:28:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226902
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Oct 2021 08:28:11 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 81 KB
32 KB 23ms
20ms Script
application/javascript 2a00:1450:4001:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5b6b52465dad7422a1144e82b39ed3bad0bf0acb03169f0485d34ec04d042a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32181
x-xss-protection: 0
last-modified: Sat, 03 Oct 2020 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 03 Oct 2020 23:29:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/js/analytics.js?v1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 854
date: Sat, 03 Oct 2020 23:15:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Sun, 04 Oct 2020 01:15:39 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 6 KB
2 KB 31ms
11ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&f=1&r=0.49279842101671156
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 28633a526029f302b4531dc715d7ba944057144df977c1cc25a189b76747e0cd

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: gzip
server: gfra1
content-type: application/javascript; charset=UTF-8
status: 200
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via: 1.1 google

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 96 KB
24 KB 224ms
221ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c67e2be274dc4d368657d965174181542c149afba7e605e93c393cfb0aacf7e5

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 19:14:19 GMT
server: AkamaiNetStorage
etag: "3d038a0b2c1e01662b4337cad5235d0a:1601320458.854986"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 23944
expires: Sat, 03 Oct 2020 23:34:53 GMT

GET
H2 200 icomoon.ttf
www.trendmicro.com/vinfo/css/clientlibs/fonts/ 21 KB
21 KB 46ms
42ms Font
application/octet-stream 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs/fonts/icomoon.ttf

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a6a263a68b55f1629a4096b4fb6e81e2ba99c571185a5a6471c564fd7e334f84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Fri, 15 May 2020 00:56:45 GMT
server: nginx
etag: "4825bab4532ad61:0"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
status: 200
x-xss-protection: 1;mode=block
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
content-length: 21532
x-prod-n-02: Yes

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 11ms
5ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 18:23:16 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 363997
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Wed, 29 Sep 2021 18:23:16 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 10ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 18:22:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 364022
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 29 Sep 2021 18:22:51 GMT

GET
H3-Q050 200 mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 29ms
13ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 18:26:31 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:16 GMT
server: sffe
age: 363802
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9016
x-xss-protection: 0
expires: Wed, 29 Sep 2021 18:26:31 GMT

GET
H2 200 customSiteStyle.css
www.trendmicro.com/vinfo/css/ 64 KB
64 KB 22ms
21ms Image
text/css 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 15923
x-prod-n-02: Yes
last-modified: Tue, 14 Jul 2020 01:42:05 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Sat, 03 Oct 2020 23:29:53 GMT
vary: Accept-Encoding
content-type: text/css
x-xss-protection: 1;mode=block
cache-control: max-age=1556
etag: W/"8bbd9dfa7f59d61:0"
expires: Sat, 03 Oct 2020 23:55:49 GMT

GET
H2 200 search.png
www.trendmicro.com/vinfo/imgFiles/ 1 KB
1 KB 55ms
53ms Image
image/png 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/vinfo/imgFiles/search.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

71f32e6afe9e18f7c787439e9f12929ff7e5d087fe127330dc60a8cb5488d85f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/css/customSiteStyle.css?Ver3.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Mon, 09 Jun 2014 02:54:32 GMT
server: nginx
etag: "a56bdd238e83cf1:0"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
cache-control: max-age=1729
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 1248
x-xss-protection: 1;mode=block
expires: Sat, 03 Oct 2020 23:58:42 GMT

GET
H2 200 fontawesome-webfont.woff2
www.trendmicro.com/vinfo/fonts/ 75 KB
76 KB 49ms
48ms Font
application/x-font-woff2 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/font-awesome.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 22 Dec 2016 07:50:34 GMT
server: nginx
etag: "0c15513285cd21:0"
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff2
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 77160
x-xss-protection: 1;mode=block

GET
H2 200 e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
www.trendmicro.com/vinfo/css/clientlibs/fonts/interstate-light/ 68 KB
68 KB 542ms
542ms Font
application/x-font-woff 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/vinfo/css/clientlibs/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/css/clientlibs.min.css?Ver3.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
last-modified: Thu, 18 Sep 2014 11:08:13 GMT
server: nginx
etag: "7382b6d630d3cf1:0"
x-frame-options: SAMEORIGIN
content-type: application/x-font-woff
status: 200
date: Sat, 03 Oct 2020 23:29:53 GMT
accept-ranges: bytes
x-prod-n-01: Yes
content-length: 69724
x-xss-protection: 1;mode=block

GET
H3-Q050 200 mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v18/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 18:23:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:34 GMT
server: sffe
age: 363990
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9728
x-xss-protection: 0
expires: Wed, 29 Sep 2021 18:23:23 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
71 B 13ms
13ms XHR
text/plain 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1056917570&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&ul=en-us&de=UTF-8&dt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1521873789&gjid=638192516&cid=1251043556.1601767793&tid=UA-15678759-2&_gid=1427755774.1601767793&_r=1&_slc=1&z=742185246

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 va-0ca7acdf418d8c12f3819dda65c35024.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 203 KB
58 KB 20ms
11ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&f=1&r=0.49279842101671156
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: c550c2cb542badba20619f1796478db9dd7fad51f821ef61432f2d5e78099cc3

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: br
last-modified: Thu, 01 Oct 2020 09:00:17 GMT
server: gfra1
status: 200
etag: "5f759aa1-e82f"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59439
via: 1.1 google

GET
H3-Q050 200 track-0ca7acdf418d8c12f3819dda65c35024.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 11 KB
3 KB 23ms
14ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/track-0ca7acdf418d8c12f3819dda65c35024.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&f=1&r=0.49279842101671156
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 45d2f2a721af2f8678d2967e3937e9dce650b9565df776c2977ce6aa8ff0d43d

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: br
last-modified: Thu, 01 Oct 2020 09:00:17 GMT
server: gfra1
status: 200
etag: "5f759aa1-da8"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3496
via: 1.1 google

GET
H3-Q050 200 opa-a4111607dc5ce718c2993c75e25e5d78.js Show response
dev.visualwebsiteoptimizer.com/analysis/4.0/ 91 KB
24 KB 23ms
14ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-a4111607dc5ce718c2993c75e25e5d78.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&f=1&r=0.49279842101671156
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: df8c3f6e6ab35d427f8c5824cdf2ae94d0c6d3f1d2a910ee090efbd1b6e4536b

Request headers

Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: br
last-modified: Wed, 30 Sep 2020 08:14:27 GMT
server: gfra1
status: 200
etag: "5f743e63-5db2"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23986
via: 1.1 google

GET
H3-Q050 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
301 B 105ms
96ms Image
image/gif 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=D77453202C874EF303D39BE87E58C6CFE&h=d141e4f0da8b6f689246e8de88fb15f9&t=false&r=0.5113391107191361

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv1c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv1c
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 dict.en.json Show response
www.trendmicro.com/libs/cq/i18n/ 13 KB
13 KB 41ms
40ms XHR
application/json 104.84.86.114
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/libs/cq/i18n/dict.en.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc/clientlibs/granite/jquery.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-84-86-114.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bd59500def7de45cb7a70ca41442373e9253b3b98ef03b32ac023a49ca685c96

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
server: nginx
etag: "26557aa78bc7e3ddc0a6b26766a2aca2"
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
status: 200
cache-control: public, max-age=854
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
x-prod-n-01: Yes
content-length: 13492
x-xss-protection: 1;mode=block

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
86 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-15678759-2&cid=1251043556.1601767793&jid=1521873789&gjid=638192516&_gid=1427755774.1601767793&_u=IEBAAEAAAAAAAC~&z=521342151

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 03 Oct 2020 23:29:53 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
1 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

14b3941128194fc62549acd945e9b35bbfcb9ab14bd31070364d47bda7a5dd86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status: 200
cache-control: no-cache
content-type: application/javascript
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 utag.69.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 20ms
20ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.42.202006041752
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:03 GMT
server: AkamaiNetStorage
etag: "96165357acc3d7253ab0fc2f07c66ff9:1486318443"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1007
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.81.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 23 KB
6 KB 33ms
29ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.42.202002262042
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Wed, 26 Feb 2020 20:41:18 GMT
server: AkamaiNetStorage
etag: "76e9ea9a97ed91d0c8a5d6014b090bf2:1582749678.346226"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 5819
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.29.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 31ms
27ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:02 GMT
server: AkamaiNetStorage
etag: "7b0575b394704ec7f76bef0f68cfc059:1486318442"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1706
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.18.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 30ms
26ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:01 GMT
server: AkamaiNetStorage
etag: "15598bba639efba2403d00ec82947e93:1486318441"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1024
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.22.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 30ms
27ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.22.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1c0c3ded4bc24bbeaf3c728afd0e56ca95e44714285fca8d8f0edcaa471806c4

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:00 GMT
server: AkamaiNetStorage
etag: "bd58d1fcdbd29988cdaf2f96d9322e68:1486318440"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1229
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 31ms
28ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 20:29:43 GMT
server: AkamaiNetStorage
etag: "9751bf6877a19200475422195b7c3174:1594153783.485339"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1390
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.43.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 34ms
31ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.42.201510262117
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c8e456c702931234478001bef4424a5063d46be7b65fc032ba05eba7186e08c0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:04 GMT
server: AkamaiNetStorage
etag: "d25bbf3981a87a9c659c1c90890e67ae:1486318444"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 924
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.75.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 34ms
31ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.42.201608171750
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Sun, 05 Feb 2017 18:14:03 GMT
server: AkamaiNetStorage
etag: "afbbd577745f63042227302506a07e1a:1486318443"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1454
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.115.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 35ms
32ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.42.201807241753
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 578459f8ab219b96f7c3d3d0799841ae14894b07b2a2db5c8a518acb4b52b429

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Tue, 24 Jul 2018 17:54:10 GMT
server: AkamaiNetStorage
etag: "506cc61aaf3a606826e06df844659b94:1532454850"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3246
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.89.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 730 B
934 B 32ms
29ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.89.js?utv=ut4.42.201705092005
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e57d7aa2aa173860f1ae7b0b56e8eb3bbe8e1fc20f857c6579d972cda7164e1b

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
last-modified: Tue, 09 May 2017 20:05:45 GMT
server: AkamaiNetStorage
etag: "2d31d4ef6b1e3d47ab14a0e50a32a692:1494360345"
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 730
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.92.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 35ms
32ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.92.js?utv=ut4.42.201707172017
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d474c1bfd9f15eab91498e377767f2b7288db456abb6b29ec50c4e038833eba9

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Mon, 17 Jul 2017 20:17:18 GMT
server: AkamaiNetStorage
etag: "7897983abd6ea6f65c3a5e8ef8d934a8:1500322638"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1613
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.99.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 35ms
33ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.99.js?utv=ut4.42.201709111706
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d2f173c3e8fb35ee2ade37ef2238b67f3d58002efe8e4ab1d995f896e6462f17

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 20:29:44 GMT
server: AkamaiNetStorage
etag: "a73e014a0c492c526a3266c1166de977:1594153784.421082"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2502
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.117.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 35ms
33ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.42.201810152028
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5531265ecdebe91ac3fdfd4841c1d32fd4bd9694507d6448fce0ad21a3faa137

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Mon, 15 Oct 2018 20:28:28 GMT
server: AkamaiNetStorage
etag: "710195e0ca7c52bf6db852c203f53c4e:1539635308"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 974
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H2 200 utag.129.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 36ms
34ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.129.js?utv=ut4.42.201907152124
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5b82e41eac622bd2dc38d4c539e7f0ed1a98563dc5bf1f065620582c51746919

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2019 20:43:50 GMT
server: AkamaiNetStorage
etag: "a14cab2ec83fdeacddd4a4602e867906:1559853830.52632"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1060
expires: Sun, 18 Oct 2020 23:29:53 GMT

GET
H3-Q050 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 360 KB
22 KB 19ms
19ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=7.0&r=0.8633499185054938&exc=69|95
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: 81fdce0b5abd7669c5ca7640653f5f5103662c2db8dceb205a83fb43bcff0a87

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: gzip
server: gfra1
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via: 1.1 google
content-type: application/javascript; charset=UTF-8

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfl_iHi5F/ 104 KB
37 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl_iHi5F/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbaa72e8bd69ad1064fd29c9956caf513d3dff705cc0ecb5599b7c1b81c03530

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 08:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52310
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37678
x-xss-protection: 0
last-modified: Fri, 02 Oct 2020 03:08:42 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Sun, 11 Oct 2020 08:58:03 GMT

GET
H3-Q050 200 gtm.js Show response
www.googletagmanager.com/ 255 KB
43 KB 63ms
48ms Script
application/javascript 2a00:1450:4001:815::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

db2e71651c51f2df93cf96367a906ee298f06a60abee1763dd538bd9f3069f76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43731
x-xss-protection: 0
last-modified: Sat, 03 Oct 2020 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 03 Oct 2020 23:29:53 GMT

GET
H3-Q050 200 worker-1acd6955248e984d8c16ea37afb8cbb7.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 47 KB
13 KB 9ms
9ms XHR
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-1acd6955248e984d8c16ea37afb8cbb7.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-a4111607dc5ce718c2993c75e25e5d78.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gfra1 /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:52 GMT
content-encoding: br
last-modified: Mon, 16 Mar 2020 04:40:32 GMT
server: gfra1
status: 200
etag: "5e6f0340-351f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13599
via: 1.1 google

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 31ms
8ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 24ms
7ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8ee0871459a3907760c86d0958dc415359cd9a23dca62dd61b8979916de97e71

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
etag: "sgUag6uh2WXRxPDbQWE8ig=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Sat, 10 Oct 2020 23:29:53 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:825::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 4309
date: Sat, 03 Oct 2020 22:18:04 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Sun, 04 Oct 2020 00:18:04 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 49ms
19ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.42.201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 03 Oct 2020 23:29:53 GMT

GET
H3-Q050 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:27:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 159
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
expires: Sun, 04 Oct 2020 00:27:14 GMT

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
937 B 6ms
6ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 22:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 2307
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Sat, 03 Oct 2020 23:51:26 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 965 B
761 B 61ms
17ms Script
application/x-javascript 2a02:26f0:2b00:79b::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.89.js?utv=ut4.42.201705092005
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:79b::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=64122
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 revenuepulse-lib-v3.js Show response
resources.trendmicro.com/rs/945-CXD-062/images/ 2 KB
1 KB 418ms
130ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
status: 200
content-length: 695
cf-request-id: 059265fcdf00000818a2a22200000001
last-modified: Sat, 05 Sep 2020 01:52:55 GMT
server: cloudflare
etag: "4c2175-6f3-5ae873e735006"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=60
accept-ranges: bytes
cf-ray: 5dca72a7cd290818-CDG
expires: Sat, 03 Oct 2020 23:30:53 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: khgQXQUewqRwS7K58fQfVXzAUsRrpXdvIFbPujlFspj7i6dpYXnQ6idBvh2M5mCA6vKAO0ZkVLGx8sKwu1qInA==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 03 Oct 2020 23:29:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ei.js Show response
web-analytics.engagio.com/js/ 2 KB
2 KB 560ms
105ms Script
application/javascript 54.208.202.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://web-analytics.engagio.com/js/ei.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.202.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-202-231.compute-1.amazonaws.com
Software: /
Resource Hash: 3bdbfaa0d41b14a6129103957928ca139df4b9e2cf5aad8f22b6b8fa0b751ec4

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 03 Oct 2020 23:29:54 GMT
cache-control: max-age=0
last-modified: Tue, 22 Sep 2020 21:39:13 GMT
content-length: 2070
vary: Origin
content-type: application/javascript; charset=utf-8

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 275ms
8ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.99.js?utv=ut4.42.201709111706
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
age: 7048
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4038-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601767794.865599,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK ktag.js Show response
resources.xg4ken.com/js/v2/ 12 KB
5 KB 3736ms
171ms Script
text/plain 52.8.244.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EB

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.42.201810152028

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.8.244.49 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-8-244-49.us-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c0e2d1ca58d290453aa46ad874b16f5f295dc139dec7466e18b04991d5c9fce2

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:57 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jul 2020 09:34:39 GMT
Server: nginx
ETag: "5f1d4e2f-1110"
Content-Type: text/plain
Cache-Control: max-age=86400, public
Connection: keep-alive
Content-Length: 4368
X-XSS-Protection: 1; mode=block
Expires: Sun, 04 Oct 2020 23:29:57 GMT

GET
H2 200 be_ixf_js_sdk.js Show response
cdn.bc0a.com/ 51 KB
22 KB 1277ms
8ms Script
application/javascript 35.201.125.192
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bc0a.com/be_ixf_js_sdk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.129.js?utv=ut4.42.201907152124
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.125.192 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 192.125.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e4ae312451e68a7e035b14970015b8a66763310c5c52f45a6bd527b4d2a5fbaa

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-meta-sdk_version: 1.4.4
date: Sat, 03 Oct 2020 23:26:21 GMT
content-encoding: gzip
age: 213
status: 200
x-goog-meta-custom: false
x-guploader-uploadid: ABg5-Uz9pqgKRdWjEogFsu-NjK7RfCNrsNNXjo-sgD6Sn5P5XHwoFQFkvBzH6V5pk3hpddhpspRwqgU1P6-obYwZfP0
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: gzip
x-goog-meta-publishingdate: 2020-10-02 01:47:02
alt-svc: clear
content-length: 16231
access-control-allow-origin: *
last-modified: Fri, 02 Oct 2020 01:47:02 GMT
server: UploadServer
etag: "75c053b21847a436141dc710ab3511c9"
vary: Accept-Encoding
x-goog-hash: crc32c=UFxEnQ==, md5=dcBTshhHpDYUHccQqzURyQ==
content-language: en
x-goog-generation: 1601603222677473
x-goog-meta-marvel_api_accounts: {"f00000000114898":{"data-customerid":"f00000000114898"},"f00000000192973":{"data-testmode":true,"data-customerid":"f00000000192973"},"f00000000063676":{"data-testmode":false,"data-cname":"images.closetworks.com","data-customerid":"f00000000063676"},"f00000000105991":{"data-testmode":true,"data-customerid":"f00000000105991"},"f00000000187147":{"data-customerid":"f00000000187147"},"f00000000205375":{"data-testmode":true,"data-customerid":"f00000000205375"},"f00000000188077":{"data-customerid":"f00000000188077"},"f00000000188074":{"data-testmode":true,"data-customerid":"f00000000188074"},"f00000000136490":{"data-testmode":false,"data-customerid":"f00000000136490"},"f00000000116008":{"data-customerid":"f00000000116008"},"f00000000188974":{"data-testmode":false,"data-customerid":"f00000000188974"},"f00000000115225":{"data-testmode":true,"data-customerid":"f00000000115225"},"f00000000168442":{"data-testmode":true,"data-customerid":"f00000000168442"},"f00000000114265":{"data-customerid":"f00000000114265"},"f00000000103447":{"data-testmode":true,"data-customerid":"f00000000103447"},"f00000000135469":{"data-testmode":true,"data-customerid":"f00000000135469"},"f00000000154990":{"data-testmode":true,"data-customerid":"f00000000154990"},"f00000000110071":{"data-testmode":true,"data-customerid":"f00000000110071"},"f00000000046606":{"data-testmode":true,"data-customerid":"f00000000046606"},"f00000000193489":{"data-customerid":"f00000000193489"},"f00000000154984":{"data-testmode":true,"data-customerid":"f00000000154984"},"f00000000181093":{"data-testmode":true,"data-customerid":"f00000000181093"},"f00000000188338":{"data-testmode":false,"data-customerid":"f00000000188338"},"f00000000062059":{"data-testmode":true,"data-customerid":"f00000000062059"},"f00000000041599":{"data-testmode":true,"data-customerid":"f00000000041599"},"f00000000160681":{"data-testmode":true,"data-customerid":"f00000000160681"},"f00000000192166":{"data-testmode":false,"data-customerid":"f00000000192166"},"f00000000146701":{"data-testmode":true,"data-customerid":"f00000000146701"},"f00000000029007":{"data-url":"GetCaptchaImage","data-testmode":true,"data-customerid":"f00000000029007"},"f00000000191929":{"data-customerid":"f00000000191929"},"f00000000167779":{"data-testmode":true,"data-customerid":"f00000000167779"},"f00000000184312":{"data-testmode":false,"data-customerid":"f00000000184312"},"f00000000117406":{"data-testmode":false,"data-customerid":"f00000000117406"},"f00000000116746":{"data-testmode":false,"data-customerid":"f00000000116746"},"f00000000118177":{"data-customerid":"f00000000118177"},"f00000000114847":{"data-testmode":true,"data-customerid":"f00000000114847"},"f00000000052793":{"data-testmode":true,"data-customerid":"f00000000052793"},"f00000000025882":{"data-testmode":true,"data-customerid":"f00000000025882"},"f00000000069367":{"data-testmode":false,"data-cname":"images.labelmaster.com","data-customerid":"f00000000069367"},"f00000000148084":{"data-testmode":false,"data-customerid":"f00000000148084"},"f00000000167977":{"data-customerid":"f00000000167977"},"f00000000114298":{"data-customerid":"f00000000114298"},"f00000000113338":{"data-testmode":false,"data-customerid":"f00000000113338"},"f00000000189529":{"data-testmode":false,"data-customerid":"f00000000189529"},"f00000000185470":{"data-testmode":false,"data-customerid":"f00000000185470"},"f00000000044220":{"data-testmode":true,"data-customerid":"f00000000044220"},"f00000000043431":{"data-testmode":false,"data-customerid":"f00000000043431"},"f00000000184714":{"data-testmode":false,"data-customerid":"f00000000184714"},"f00000000154978":{"data-testmode":true,"data-customerid":"f00000000154978"},"f00000000041735":{"data-customerid":"f00000000041735"},"f00000000114850":{"data-testmode":true,"data-customerid":"f00000000114850"},"f00000000114853":{"data-testmode":true,"data-customerid":"f00000000114853"},"f00000000161092":{"data-testmode":true,"data-customerid":"f00000000161092"},"f00000000102775":{"data-testmode":true,"data-customerid":"f00000000102775"},"f00000000120703":{"data-testmode":true,"data-customerid":"f00000000120703"},"f00000000124363":{"data-testmode":false,"data-customerid":"f00000000124363"},"f00000000190858":{"data-testmode":true,"data-customerid":"f00000000190858"},"f00000000041628":{"data-testmode":true,"data-customerid":"f00000000041628"},"f00000000178855":{"data-testmode":true,"data-customerid":"f00000000178855"},"f00000000154006":{"data-testmode":true,"data-customerid":"f00000000154006"},"f00000000072832":{"data-testmode":false,"data-customerid":"f00000000072832"},"f00000000119260":{"data-testmode":false,"data-customerid":"f00000000119260"},"f00000000169432":{"data-testmode":true,"data-customerid":"f00000000169432"},"f00000000184762":{"data-testmode":false,"data-customerid":"f00000000184762"},"f00000000190864":{"data-testmode":false,"data-customerid":"f00000000190864"},"f00000000184177":{"data-testmode":false,"data-customerid":"f00000000184177"},"f00000000097438":{"data-testmode":false,"data-customerid":"f00000000097438"},"f00000000193222":{"data-customerid":"f00000000193222"},"f00000000114841":{"data-testmode":true,"data-customerid":"f00000000114841"},"f00000000193426":{"data-testmode":false,"data-customerid":"f00000000193426"},"f00000000139987":{"data-customerid":"f00000000139987"},"f00000000182527":{"data-testmode":true,"data-customerid":"f00000000182527"},"f00000000089680":{"data-testmode":true,"data-customerid":"f00000000089680"},"f00000000078396":{"data-customerid":"f00000000078396"},"f00000000181462":{"data-testmode":true,"data-customerid":"f00000000181462"},"f00000000168916":{"data-customerid":"f00000000168916"},"f00000000016565":{"data-testmode":true,"data-customerid":"f00000000016565"},"f00000000165760":{"data-testmode":true,"data-customerid":"f00000000165760"},"f00000000191638":{"data-testmode":true,"data-customerid":"f00000000191638"},"f00000000188002":{"data-testmode":false,"data-customerid":"f00000000188002"},"f00000000192223":{"data-testmode":false,"data-customerid":"f00000000192223"},"f00000000068608":{"data-customerid":"f00000000068608"},"f00000000166744":{"data-testmode":true,"data-customerid":"f00000000166744"},"f00000000223309":{"data-testmode":true,"data-customerid":"f00000000223309"},"f00000000192229":{"data-testmode":true,"data-customerid":"f00000000192229"},"f00000000082522":{"data-testmode":true,"data-customerid":"f00000000082522"},"f00000000117526":{"data-testmode":false,"data-customerid":"f00000000117526"},"f00000000177607":{"data-testmode":true,"data-customerid":"f00000000177607"},"f00000000146195":{"data-testmode":true,"data-customerid":"f00000000146195"},"f00000000154411":{"data-testmode":true,"data-customerid":"f00000000154411"},"f00000000194338":{"data-testmode":false,"data-customerid":"f00000000194338"},"f00000000185851":{"data-testmode":false,"data-customerid":"f00000000185851"}}
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 16231
accept-ranges: bytes
content-type: application/javascript
expires: Sun, 04 Oct 2020 00:26:21 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 20ms
19ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202009281914&cb=1601767793595
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Sat, 03 Oct 2020 23:39:53 GMT

GET
H3-Q050

200

activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftroj...
5427711.fls.doubleclick.net/ Frame 07C0
Redirect Chain

https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftr...
https://5427711.fls.doubleclick.net/activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2F...

0
0

39ms
24ms

Document
text/html

216.58.207.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5427711.fls.doubleclick.net/activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s24-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5427711.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Sat, 03 Oct 2020 23:30:00 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 438
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 03-Oct-2020 23:45:00 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Sat, 03 Oct 2020 23:30:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5427711.fls.doubleclick.net/activityi;dc_pre=CJrtnobKmewCFSnmuwgdeTsOpg;src=5427711;type=remar0;cat=allsi0;ord=1;num=5160371002099;gtm=2wg9n1;auiddc=276254986.1601767794;u1=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bat.js Show response
bat.bing.com/ 27 KB
8 KB 47ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44dd62d6a622a6198df9bfcfc1acbf414706e86c57dfc1d0f15b147fa7f25ae0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
last-modified: Wed, 30 Sep 2020 20:44:24 GMT
x-msedge-ref: Ref A: 65E852C99A54430F938D4640DF2ABECF Ref B: FRAEDGE1421 Ref C: 2020-10-03T23:29:53Z
status: 200
etag: "0417b6a97d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8315

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 7287ms
44ms Script
application/x-javascript 65.9.19.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.19.119 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 15:17:15 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 29566
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 0d54c3ddc4e7347d45d33a921b50661f.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: ZAG50-C1
X-Amz-Cf-Id: Kv7xdXpAN3_A36BMp6gwEiKyFrynrzvPU7wqpk7SLOZ8JC7DRru8sA==

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=1799188272190335132

4 B
484 B

408ms
357ms

Image
image/jpeg

13.225.78.83
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=1799188272190335132
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.83 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-83.fra2.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:54 GMT
Via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
x-amzn-RequestId: 1199ae35-b8eb-4209-aa21-66567b29c3be
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5f790972-7228c80d32fc75c751c2abf7;Sampled=0
Connection: keep-alive
x-amz-apigw-id: T25p3F00IAMFXAw=
Content-Length: 4
X-Amz-Cf-Id: EXd1MnTym3jVNBvBWKnHS7dp1uds_YLrJxACNJiYYTJ1QSjmXw3wjQ==

Redirect headers

Pragma: no-cache
Date: Sat, 03 Oct 2020 23:29:53 GMT
X-Proxy-Origin: 89.249.64.171; 89.249.64.171; 730.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.75:80
AN-X-Request-Uuid: 4af63a60-a2ba-43d1-bb60-40ff2ec5bf19
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=1799188272190335132
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
121 B 8ms
6ms Image
image/gif 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1056917570&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&ul=en-us&de=UTF-8&dt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDACEIrBAAAAC~&cid=1251043556.1601767793&tid=UA-44592531-1&_gid=1427755774.1601767793&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&z=432521296

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 08:16:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54815
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-yyb3JEF9Pm8ey.js Show response
rules.quantcount.com/ 3 B
358 B 74ms
22ms Script
application/x-javascript 2600:9000:20d7:5600:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-yyb3JEF9Pm8ey.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:5600:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 11:43:24 GMT
via: 1.1 cd58d60f2b52ca321822f27453e5f098.cloudfront.net (CloudFront)
last-modified: Sat, 04 Mar 2017 21:25:15 GMT
server: AmazonS3
age: 42390
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: OD6f5WYMcM9VEUS76PV5rf7rvcEHjADnhcNsXLN30gM1ggB0BskCsA==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 9ms
9ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:53 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Mon, 11 Jan 2021 23:29:53 GMT

GET
H3-Q050 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
386 B 33ms
20ms Image
image/gif 2a00:1450:4001:825::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=697182673&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&utmhid=1056917570&utmr=-&utmp=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&utmht=1601767793648&utmac=UA-29051577-12&utmcc=__utma%3D44797537.1251043556.1601767793.1601767794.1601767794.1%3B%2B__utmz%3D44797537.1601767794.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=477233114&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 243552383039605 Show response
connect.facebook.net/signals/config/ 234 KB
69 KB 50ms
49ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/243552383039605?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

76df70eedd7afa09fb1b98087589045aeac7d10b74cbf08491339534d1e44ef6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: l3wWbzXdb/6w2UUZSZFWC6caYmy0MBF+J3AHcXRyIysq16JODcSIxwNxB/GQJScx8qjcer0LsUb5A4UZcrl2aQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 03 Oct 2020 23:29:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-Q050 200 / Show response
www.googleadservices.com/pagead/conversion/1015287688/ 2 KB
2 KB 37ms
22ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1015287688/?random=1601767793683&cv=9&fst=1601767793683&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

777acf4a6d6afca6054ab1df5399f8dea23b28a14581d48db42be790b0e14045

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1162
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1601767793687&cv=9&fst=1601767793687&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9n1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56886e5556e3e30589ab606f19d5a5a59de0902eec33ed5fea397eddeea980d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1068
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 29ms
13ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=72451
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H/1.1 200
OK visitWebPage Show response
945-cxd-062.mktoresp.com/webevents/ 2 B
311 B 1634ms
96ms XHR
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1601767793694&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1601767793693-65374&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/159/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 03 Oct 2020 23:29:55 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 07536055-b560-4f53-847f-4f130d1fe66b

GET
H2 204 0
bat.bing.com/action/ 0
148 B 28ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26044208&Ver=2&mid=e20683b6-0c9f-42fd-80f7-fff4e407a3b2&sid=5710f56005d011eb9332a5f1661ee5de&vid=5710df9005d011eb9958059b6f1c542e&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&p=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&r=&lt=3370&evt=pageLoad&msclkid=N&sv=1&rn=851744
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C5B70774C86549D182DE669B2633ABF4 Ref B: FRAEDGE1421 Ref C: 2020-10-03T23:29:53Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/929919117/ 42 B
107 B 24ms
22ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/929919117/?random=1601767793687&cv=9&fst=1601766000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9n1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&async=1&fmt=3&is_vtc=1&random=2070645573&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/929919117/ 42 B
107 B 20ms
20ms Image
image/gif 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/929919117/?random=1601767793687&cv=9&fst=1601766000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9n1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&async=1&fmt=3&is_vtc=1&random=2070645573&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=2012012761;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;fpan=1;fpa=P0-804514136-1601767793713;ns=0;ce...
pixel.quantserve.com/ 35 B
372 B 10ms
9ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2012012761;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F;fpan=1;fpa=P0-804514136-1601767793713;ns=0;ce=1;qjs=1;qv=7298e392-20200929010851;cm=;gdpr=0;ref=;d=trendmicro.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1601767793713;tzo=-120;ogl=

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8866%26time%3D1601767793721%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fvi...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&liSync=true

0
80 B

170ms
170ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&liSync=true
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:54 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: ca6Wf1KfOhbQIYMu/ioAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: L/9HeVKfOhagpEtWcSsAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: E304F1ED1AA0404C926985909042456A Ref B: FRAEDGE0719 Ref C: 2020-10-03T23:29:53Z
x-frame-options: sameorigin
date: Sat, 03 Oct 2020 23:29:53 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1601767793721&url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050

200

/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=12...
https://www.google.com/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200...
https://www.google.de/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&...

42 B
538 B

43ms
27ms

Image
image/gif

2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=cQl5X5PfK_G6lQePuYvIBA&cid=CAQSKQCNIrLMP8iDIA1uwj9ZpH0OVd1yeVguhJHdqb_8YQGtgiddZT5JINao&random=3398381594&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:29:53 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/1015287688/?random=997275477&cv=9&fst=*&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/&tiba=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=cQl5X5PfK_G6lQePuYvIBA&cid=CAQSKQCNIrLMP8iDIA1uwj9ZpH0OVd1yeVguhJHdqb_8YQGtgiddZT5JINao&random=3398381594&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
377 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&rl=&if=false&ts=1601767793756&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1601767793755.1322401411&it=1601767793680&coo=false&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 03 Oct 2020 23:29:53 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 1441ms
136ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Sat, 03 Oct 2020 23:29:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 8b090bf44b89f93181a27b37acddcfd5
x-transaction: 008dcea70025d030
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 ei_track_all_packed.js Show response
dn1f1hmdujj40.cloudfront.net/js/ 8 KB
8 KB 28ms
6ms Script
application/javascript 2600:9000:20eb:b600:c:90ee:6000:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dn1f1hmdujj40.cloudfront.net/js/ei_track_all_packed.js
Requested by: Host: web-analytics.engagio.com
URL: https://web-analytics.engagio.com/js/ei.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:b600:c:90ee:6000:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bef63fdeac2142057db2ecc9979b79e3d4d4b7912521d2943c10a83552dadc33

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:26:56 GMT
via: 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
last-modified: Tue, 22 Sep 2020 21:39:13 GMT
age: 179
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300
x-amz-cf-pop: FRA2-C1
content-length: 8185
x-amz-cf-id: FqC7ZF6OdMVHnCkPR3V4Kdbj-CqlvZUwuQystksqSebZfgKI1tUrTQ==

GET
H2 200 stat Show response
web-analytics.engagio.com/api/ 70 B
162 B 110ms
110ms Script
text/javascript 54.208.202.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://web-analytics.engagio.com/api/stat?page_url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&page_title=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&track_type=page&action=ei_view&category=ei_page_tracking&client_id=&account_id=9cf19ee08e632a1354184ed388f4d5f4602a763b&method=post&callback=EI.api._callbacks.s37520297
Requested by: Host: dn1f1hmdujj40.cloudfront.net
URL: https://dn1f1hmdujj40.cloudfront.net/js/ei_track_all_packed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.202.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-202-231.compute-1.amazonaws.com
Software: /
Resource Hash: 02f96ebd3c664b19159407ca5f7d1ed4622562e8d32784b61429db8e535694e1

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 03 Oct 2020 23:29:54 GMT
content-length: 70
vary: Origin
content-type: text/javascript; charset=utf-8

GET
H2 200 1674211837 Show response
ixf2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/ 2 KB
2 KB 372ms
106ms XHR
application/json 35.244.153.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ixf2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/1674211837?client=js_sdk&client_version=1.4.4&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&user_agent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36
Requested by: Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/be_ixf_js_sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.153.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Apache /
Resource Hash: 1ffdb80488ddd78fadd6c6902b6598826cfabc9396252537772e8ba9024be1f9

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:55 GMT
via: 1.1 google
last-modified: Fri, 31 May 2019 15:43:04 GMT
server: Apache
etag: "c36d2-74f-58a30dec3f200"
status: 200
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: clear
content-length: 1871

GET
H2 200 /
www.facebook.com/tr/ 44 B
146 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=Microdata&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&rl=&if=false&ts=1601767795259&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5Cn%5CtTrojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA%5Cn%22%2C%22meta%3Adescription%22%3A%22This%20Trojan%20%20arrives%20on%20a%20system%20as%20a%20file%20dropped%20by%20other%20malware%20or%20as%20a%20file%20downloaded%20unknowingly%20by%20users%20when%20visiting%20malicious%20sites.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmtealium&ec=1&o=30&fbp=fb.1.1601767793755.1322401411&it=1601767793680&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:29:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 03 Oct 2020 23:29:55 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
650 B 169ms
136ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuwoi&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 03 Oct 2020 23:30:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 122
pragma: no-cache
last-modified: Sat, 03 Oct 2020 23:30:01 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a17b7de3848e03041f38065bee5ff6f9
x-transaction: 00744d8800e15cb2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 up
insight.adsrvr.org/track/ Frame C482 0
0 345ms
31ms Document
text/html 18.203.124.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&upid=803df29&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.124.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&upid=803df29&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/

Response headers

status: 200
date: Sat, 03 Oct 2020 23:30:01 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
47 B 13ms
12ms XHR
text/plain 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1056917570&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&ul=en-us&de=UTF-8&dt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&el=10%25%20Scroll&ev=0&_u=aGjACEIrBAAAAC~&jid=1569853952&gjid=676158624&cid=1251043556.1601767793&tid=UA-15678759-2&_gid=733008537.1601767801&_r=1&gtm=2wg9n1MT6DHL8&z=247373171

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 23:30:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 862
date: Sat, 03 Oct 2020 23:15:39 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Sun, 04 Oct 2020 01:15:39 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
6ms Image
image/gif 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1056917570&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&ul=en-us&de=UTF-8&dt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&el=25%25%20Scroll&ev=0&_u=aGjACEIrBAAAAC~&jid=&gjid=&cid=1251043556.1601767793&tid=UA-15678759-2&_gid=733008537.1601767801&gtm=2wg9n1MT6DHL8&z=1338910124

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 08:16:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54823
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
57 B 7ms
7ms Image
image/gif 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1056917570&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&ul=en-us&de=UTF-8&dt=Trojan.Win32.ZURGOP.BE%20-%20Threat%20Encyclopedia%20-%20Trend%20Micro%20USA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Tracking&ea=%2Fvinfo%2Fus%2Fthreat-encyclopedia%2Fmalware%2Ftrojan.win32.zurgop.be%2F&el=50%25%20Scroll&ev=0&_u=aGjACEIrBAAAAC~&jid=&gjid=&cid=1251043556.1601767793&tid=UA-15678759-2&_gid=733008537.1601767801&gtm=2wg9n1MT6DHL8&z=1416095068

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Oct 2020 08:16:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54823
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
66 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-15678759-2&cid=1251043556.1601767793&jid=1569853952&gjid=676158624&_gid=733008537.1601767801&_u=aGjACEIrBAAAAC~&z=1533509725

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zurgop.be/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 03 Oct 2020 23:30:01 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.trendmicro.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

162 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.google.com/	1970-01-19 17:19:38	Name: NID Value: 204=appomSFQLajUdEiJlsCc6VTk2NQzJCIurSlLc_zzAdjnUXuvGOGkzwsuUJglEWS9ez3j9UbR8nioi5ZsTUMaTqHw1w7-d07QOn2V8aPate5yuBX0rdVLBn61XBW6yeRSP6XaKfORcDiZzS6oJGWzKUiWvhMZa3etd5-NQGAGAh0
			.doubleclick.net/	1970-01-19 12:56:08	Name: test_cookie Value: CheckForPermission

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5427711.fls.doubleclick.net
945-cxd-062.mktoresp.com
ajax.googleapis.com
analytics.twitter.com
attr.ml-api.io
bat.bing.com
cdn.bc0a.com
cdn.datatables.net
connect.facebook.net
customer.cludo.com
dev.visualwebsiteoptimizer.com
dn1f1hmdujj40.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
insight.adsrvr.org
ixf2-api.bc0a.com
js.adsrvr.org
munchkin.marketo.net
pixel.quantserve.com
px.ads.linkedin.com
resources.trendmicro.com
resources.xg4ken.com
rules.quantcount.com
s.ml-attr.com
s.ytimg.com
secure.adnxs.com
secure.quantserve.com
sjs.bizographics.com
snap.licdn.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.tiqcdn.com
web-analytics.engagio.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
104.109.95.62
104.111.215.136
104.17.73.206
104.244.42.131
104.244.42.133
104.84.86.114
13.225.78.83
142.250.74.194
151.101.112.157
18.203.124.74
185.33.221.14
192.28.144.124
216.58.207.38
2600:9000:20d7:5600:6:44e3:f8c0:93a1
2600:9000:20eb:b600:c:90ee:6000:21
2606:4700:10::6814:7c67
2606:4700:10::ac43:e8b
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:808::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:815::2003
2a00:1450:4001:815::2008
2a00:1450:4001:818::2002
2a00:1450:4001:81b::200a
2a00:1450:4001:81c::2004
2a00:1450:4001:81e::200e
2a00:1450:4001:81f::2008
2a00:1450:4001:821::200e
2a00:1450:4001:824::200e
2a00:1450:4001:825::2008
2a00:1450:400c:c04::9b
2a02:26f0:2b00:79b::3adf
2a02:26f0:6c00:296::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
34.96.102.137
35.201.125.192
35.244.153.179
52.8.244.49
54.208.202.231
65.9.19.119
68.67.153.60
01dbbe1ad2037e8bc294848eaccc27958f69e1ac205db64c6db69405e361b22b
02f96ebd3c664b19159407ca5f7d1ed4622562e8d32784b61429db8e535694e1
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
14b3941128194fc62549acd945e9b35bbfcb9ab14bd31070364d47bda7a5dd86
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b
1c0c3ded4bc24bbeaf3c728afd0e56ca95e44714285fca8d8f0edcaa471806c4
1ffdb80488ddd78fadd6c6902b6598826cfabc9396252537772e8ba9024be1f9
27dbc587cdeb9b04598011c76ee9511866c57028688169613a37005ed6d8ad84
28633a526029f302b4531dc715d7ba944057144df977c1cc25a189b76747e0cd
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3807e44914c34f9e293702693b49039f774b1eef7798a0fa8dfbb3c1992e32dc
38955525fa945d94f96d6c5d969f5c1299fdd30c48ea471cba7f71490ee1ab61
3bdbfaa0d41b14a6129103957928ca139df4b9e2cf5aad8f22b6b8fa0b751ec4
417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9
426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35
42e1111a0ebc79d1aa68af2ccac42031123c6a60fcdcc893c1452c9a76ef33da
44dd62d6a622a6198df9bfcfc1acbf414706e86c57dfc1d0f15b147fa7f25ae0
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
45d2f2a721af2f8678d2967e3937e9dce650b9565df776c2977ce6aa8ff0d43d
4903c46eb377341675a2ef44e04682d84b20a0dea5ef3f30633d8cf98531b899
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120
540c6406140b9c4e6e32aa84fbab230a5c756456d9563903c0856eea77b68b60
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5531265ecdebe91ac3fdfd4841c1d32fd4bd9694507d6448fce0ad21a3faa137
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
563772f765890f5c4e868355b1c9755deae8e886e1281cec1c15ee708543eb79
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56886e5556e3e30589ab606f19d5a5a59de0902eec33ed5fea397eddeea980d9
578459f8ab219b96f7c3d3d0799841ae14894b07b2a2db5c8a518acb4b52b429
5b82e41eac622bd2dc38d4c539e7f0ed1a98563dc5bf1f065620582c51746919
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
618d62ceaca1223e16de2c8939a1963a95c34b0ac75852f835f93e5b42f20871
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
6f2adcf50cdc9374afa8b93818776ca2f36eef0f27b356df715d4d98aa6b5e19
71f32e6afe9e18f7c787439e9f12929ff7e5d087fe127330dc60a8cb5488d85f
76df70eedd7afa09fb1b98087589045aeac7d10b74cbf08491339534d1e44ef6
777acf4a6d6afca6054ab1df5399f8dea23b28a14581d48db42be790b0e14045
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f57ae8c90a70d08a93990e3a24863fb52ad58e46587ebb3cbb93a0ad030d65a
802c7cbfbc9af0b77e4715de030cf7c219e31eb54a3eaf79944b8447114b5d06
81fdce0b5abd7669c5ca7640653f5f5103662c2db8dceb205a83fb43bcff0a87
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8dcb49c6eed588b44599017b80a2709ebc2e11799c4919b12ea0523bbf81da79
8ee0871459a3907760c86d0958dc415359cd9a23dca62dd61b8979916de97e71
8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95c483d25f3a25069cb236935aa0cf2fae798d087078610b9634e052780f8ed7
9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9
9f0173ed05fe8618c76272aaae6711ae0fa7ece07de8522cb6b0159d22b691f5
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a6a263a68b55f1629a4096b4fb6e81e2ba99c571185a5a6471c564fd7e334f84
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
a9c575c2bf9b9f836806dc58aa0866cb558806fc5ea1ef2f4250a8c0b1be7278
aa0fb12210395609982a73f34b179f54280417eb48f18497e9b6a964569c27a1
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b040960c2cfd59dcfae30f724d6701192821ff53b7349eb4ab5d835bb70606c9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bbaa72e8bd69ad1064fd29c9956caf513d3dff705cc0ecb5599b7c1b81c03530
bc40f55dc0399b99382412b3f312bd466bf2b0c3d1b227edc7bf2152ad7f43ab
bd59500def7de45cb7a70ca41442373e9253b3b98ef03b32ac023a49ca685c96
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
bef63fdeac2142057db2ecc9979b79e3d4d4b7912521d2943c10a83552dadc33
c0e2d1ca58d290453aa46ad874b16f5f295dc139dec7466e18b04991d5c9fce2
c550c2cb542badba20619f1796478db9dd7fad51f821ef61432f2d5e78099cc3
c67e2be274dc4d368657d965174181542c149afba7e605e93c393cfb0aacf7e5
c8e456c702931234478001bef4424a5063d46be7b65fc032ba05eba7186e08c0
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d1d326206efc842a8035a2d3a1d53aa66176de9d45039389d090c0ee72a39a48
d2f173c3e8fb35ee2ade37ef2238b67f3d58002efe8e4ab1d995f896e6462f17
d474c1bfd9f15eab91498e377767f2b7288db456abb6b29ec50c4e038833eba9
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
da1009faef6e5de07dd8540c5cc4d18b59f119c7529a181733372ce85f28f1f6
db2e71651c51f2df93cf96367a906ee298f06a60abee1763dd538bd9f3069f76
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df8c3f6e6ab35d427f8c5824cdf2ae94d0c6d3f1d2a910ee090efbd1b6e4536b
e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d
e245fbff2e30d272a758d502365776c924538aee1f5c5b7c555f3188810c5e61
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40de67375a4a4e45cc867b8f34ea1703a4c0dff37bcdb25bd54ffa0ef9b34b2
e4ae312451e68a7e035b14970015b8a66763310c5c52f45a6bd527b4d2a5fbaa
e57d7aa2aa173860f1ae7b0b56e8eb3bbe8e1fc20f857c6579d972cda7164e1b
e77bdb0ba7dd329aaa6c33250e5ce3cc287f47a04de1f6006ecf43202769df0d
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f5b6b52465dad7422a1144e82b39ed3bad0bf0acb03169f0485d34ec04d042a7
f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702
fcea66becd77485eb760a9a65e38d47319f69b724ae046f9b246842a1daa6c18
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

www.trendmicro.com Open in urlscan Pro 104.84.86.114 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

118 Requests

100 %HTTPS

57 %IPv6

36 Domains

45 Subdomains

43 IPs

6 Countries

1160 kBTransfer

3737 kBSize

2 Cookies

47 Outgoing links

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.trendmicro.com Open in urlscan Pro
104.84.86.114 Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

100 %
HTTPS

57 %
IPv6

36
Domains

45
Subdomains

43
IPs

6
Countries

1160 kB
Transfer

3737 kB
Size

2
Cookies

118 HTTP transactions
0 data transactions