urlscan.io logo urlscan.io
SecurityTrails logo

www.trendmicro.com Open in urlscan Pro
2.21.61.16  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/
Effective URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Submission: On October 19 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 21 IPs in 6 countries across 19 domains to perform 74 HTTP transactions. The main IP is 2.21.61.16, located in France and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by AffirmTrust Extended Validation CA - EV1 on March 25th 2020. Valid for: 2 years.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 24 2.21.61.16 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
8 23.37.38.214 16625 (AKAMAI-AS)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
7 23.210.248.44 16625 (AKAMAI-AS)
7 34.96.102.137 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 23.210.250.213 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 88.221.60.75 16625 (AKAMAI-AS)
4 2a00:1450:400... 15169 (GOOGLE)
1 3 142.93.197.211 14061 (DIGITALOC...)
1 206.189.189.226 14061 (DIGITALOC...)
1 104.17.71.206 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 192.28.144.124 15224 (OMNITURE)
2 2a03:2880:f01... 32934 (FACEBOOK)
74 21
24    2.21.61.16 (France)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-61-16.deploy.static.akamaitechnologies.com
blog.trendmicro.com
www.trendmicro.com
1    2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700:10::6814:7c67 (United States)

ASN13335 (CLOUDFLARENET, US)
customer.cludo.com
8    23.37.38.214 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-214.deploy.static.akamaitechnologies.com
tags.tiqcdn.com
2    2a02:26f0:6c00:287::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
s.go-mpulse.net
686eb519.akstat.io
1    2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
7    23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
m.addthis.com
api-public.addthis.com
7    34.96.102.137 (United States)

ASN15169 (GOOGLE, US)
dev.visualwebsiteoptimizer.com
5    2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s.ytimg.com
1    23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com
z.moatads.com
2    2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
2    88.221.60.75 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com
munchkin.marketo.net
4    2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    142.93.197.211 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: accessibe-lb-nyc1.jetserver.net
acsbap.com
cdn.acsbapp.com
acsbapp.com
1    206.189.189.226 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: accessibe-lb-nyc2.jetserver.net
acsbapp.com
1    104.17.71.206 (United States)

ASN13335 (CLOUDFLARENET, US)
resources.trendmicro.com
1    2a02:26f0:6c00:192::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
c.go-mpulse.net
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
945-cxd-062.mktoresp.com
2    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)
graph.facebook.com
Domain Requested by
22 www.trendmicro.com www.trendmicro.com
8 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
7 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
dev.visualwebsiteoptimizer.com
www.trendmicro.com
5 fonts.gstatic.com fonts.googleapis.com
4 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
www.trendmicro.com
3 s7.addthis.com www.trendmicro.com
s7.addthis.com
2 api-public.addthis.com s7.addthis.com
2 graph.facebook.com s7.addthis.com
2 acsbapp.com www.trendmicro.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 customer.cludo.com www.trendmicro.com
2 blog.trendmicro.com 2 redirects
1 cdn.acsbapp.com s.go-mpulse.net
1 686eb519.akstat.io s.go-mpulse.net
1 945-cxd-062.mktoresp.com munchkin.marketo.net
1 c.go-mpulse.net s.go-mpulse.net
1 resources.trendmicro.com tags.tiqcdn.com
1 acsbap.com 1 redirects
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 s.ytimg.com www.youtube.com
1 www.youtube.com www.trendmicro.com
1 s.go-mpulse.net www.trendmicro.com
1 fonts.googleapis.com www.trendmicro.com
74 26
Subject Issuer Validity Valid
www.trendmicro.com
AffirmTrust Extended Validation CA - EV1		 2020-03-25 -
2022-03-26		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-09-22 -
2020-12-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-05 -
2021-08-05		 a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2020-03-16 -
2021-06-15		 a year crt.sh
akstat.io
DigiCert Secure Site ECC CA-1		 2020-05-06 -
2021-08-05		 a year crt.sh
*.google.com
GTS CA 1O1		 2020-09-22 -
2020-12-15		 3 months crt.sh
odc-prod-01.oracle.com
DigiCert Secure Site ECC CA-1		 2020-07-22 -
2021-10-13		 a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2020-06-19 -
2022-07-06		 2 years crt.sh
*.gstatic.com
GTS CA 1O1		 2020-09-22 -
2020-12-15		 3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-09-22 -
2020-12-15		 3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2020-03-14 -
2021-04-13		 a year crt.sh
*.acsbapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-10-05 -
2021-10-05		 a year crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3		 2020-07-25 -
2021-07-25		 a year crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-09-11 -
2020-12-10		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Frame ID: 530424AEC7B727341F0DF09EE6451735
Requests: 70 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Frame ID: 98FF895E8BCB812DB15B3E92DC5F2EB2
Requests: 2 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: AB8360605A8D1CCB5011844F3113DAD3
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: C4800B3A462D7EDE1440A5DE0C0384A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-bot... HTTP 301
    https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-bot... HTTP 301
    https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

74
Requests

99 %
HTTPS

50 %
IPv6

19
Domains

26
Subdomains

21
IPs

6
Countries

1632 kB
Transfer

4111 kB
Size

21
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ HTTP 301
    https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ HTTP 301
    https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js

74 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request emotet-returns-starts-spreading-via-spam-botnet.html
www.trendmicro.com/en_us/research/17/i/
Redirect Chain
  • http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/
  • https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/
  • https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
80 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5b89171c58d13e98e6c9956a5599490ca3937aa90b73af54246da9770d3d128
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:method
GET
:authority
www.trendmicro.com
:scheme
https
:path
/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
content-type
text/html;charset=utf-8
x-prod-a-01
Yes
strict-transport-security
max-age=15552000; preload
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1;mode=block
x-prod-n-02
Yes
content-encoding
gzip
content-length
16045
vary
Accept-Encoding
date
Mon, 19 Oct 2020 19:34:35 GMT
set-cookie
trendMicroVisitorContextIsBusiness=true; path=/

Redirect headers

Server
nginx
Content-Type
text/html
Content-Length
178
Location
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Strict-Transport-Security
max-age=15552000; preload
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
X-XSS-Protection
1;mode=block
X-BlogDispatch
Yes
X-Akamai-Path-Stats
[3:16404:596]
Date
Mon, 19 Oct 2020 19:34:34 GMT
Connection
keep-alive
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 		111 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6068e194fbcc63e770a21498d0c7a8bf6ac91c75aea4325772d2b71aadd46ff8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Fri, 03 Jul 2020 21:01:33 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
38334
x-xss-protection
1;mode=block
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Fri, 21 Jun 2019 19:39:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
3706
x-xss-protection
1;mode=block
css
fonts.googleapis.com/ 		12 KB
1018 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 19 Oct 2020 19:34:35 GMT
server
ESF
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 19 Oct 2020 19:34:35 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/ 		16 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7c67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
cf-cache-status
HIT
age
40995
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
05e3f44d650000c2e0b49a8000000001
last-modified
Thu, 15 Oct 2020 20:27:18 GMT
server
cloudflare
etag
W/"017a89331a3d61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=300
cf-ray
5e4ceff56acac2e0-FRA
x-lb
4
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 		238 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a2e0ac600a17d67a6fd921ad00480b4f031df232f2be66c223df5a168b902da8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 08 Oct 2020 17:10:23 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
text/css;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
34641
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
248c05ae630c4731c0aeec5b4894dc655284048418638ba751c80c9017fc08a2

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Fri, 16 Oct 2020 17:06:32 GMT
server
AkamaiNetStorage
etag
"d5a824a37c98a5b9e8d91b5645eb4dcf:1602867992.438484"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
915
expires
Mon, 19 Oct 2020 19:39:35 GMT
icn_facebook.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_facebook.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
810
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 17:26:12 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
max-age=279
etag
"5e2-5b209692e040e"
accept-ranges
bytes
x-content-type-options
nosniff
expires
Mon, 19 Oct 2020 19:39:14 GMT
icn_twitter.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		394 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_twitter.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
394
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 17:25:45 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=99
etag
"18a-5b2096795d33b"
accept-ranges
bytes
x-content-type-options
nosniff
x-akamai-path-stats
[1:14842:1158]
expires
Mon, 19 Oct 2020 19:36:14 GMT
icn_linkedin.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		970 B
888 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_linkedin.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
status
200
content-length
579
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 17:27:10 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=396
etag
"3ca-5b2096ca26412"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Mon, 19 Oct 2020 19:41:11 GMT
icn_youtube.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		870 B
871 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_youtube.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
528
x-prod-n-02
Yes
x-prod-a-04
Yes
last-modified
Mon, 19 Oct 2020 17:28:38 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
image/svg+xml
x-xss-protection
1;mode=block
cache-control
max-age=45
etag
"366-5b20971dd604d"
accept-ranges
bytes
x-akamai-path-stats
[1:15926:4294966370]
expires
Mon, 19 Oct 2020 19:35:20 GMT
logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
status
200
x-prod-n-01
Yes
content-length
13089
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 17:31:30 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
x-prod-a-02
Yes
content-type
image/png
cache-control
max-age=390
etag
"3321-5b2097c18c9da"
accept-ranges
bytes
expires
Mon, 19 Oct 2020 19:41:05 GMT
search-script.js
customer.cludo.com/scripts/bundles/ 		217 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7c67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f60fa81793a8c06335c1e7ad1609402ba5856517ab93df50764698937e70a8aa

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
cf-cache-status
HIT
age
105
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
05e3f44dd40000c2e0d9813000000001
last-modified
Wed, 14 Oct 2020 13:58:10 GMT
server
cloudflare
etag
W/"045c0c32a2d61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
cf-ray
5e4ceff61c31c2e0-FRA
x-lb
4
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 		648 B
912 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
x-prod-a-02
Yes
content-type
image/svg+xml
status
200
cache-control
max-age=902
x-prod-n-01
Yes
content-length
648
x-xss-protection
1;mode=block
expires
Mon, 19 Oct 2020 19:49:37 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 		409 B
673 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
max-age=872
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
409
x-xss-protection
1;mode=block
expires
Mon, 19 Oct 2020 19:49:07 GMT
TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
s.go-mpulse.net/boomerang/ Frame 98FF 		202 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:287::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
br
last-modified
Fri, 09 Oct 2020 17:20:20 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
51580
EMOTET-1.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/ 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/EMOTET-1.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9cac882062c55967840ac0f8d15636b6024cd8b121778e15a9e0224116b46586
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
41134
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 19:34:35 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1800
etag
W/"a0ae-5b20b344cc96d"
accept-ranges
bytes
x-content-type-options
nosniff
x-akamai-path-stats
[3:145874:158126]
expires
Mon, 19 Oct 2020 20:04:35 GMT
EMOTET-2.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/ 		137 KB
138 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/EMOTET-2.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a8a44a3130a2240db3e208bd599e35f3b38baa6ff09237b0e67123cdc22048d5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
content-length
140489
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 19:34:35 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1800
etag
W/"224c9-5b20b34513e0f"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
x-akamai-path-stats
[1:984:595016]
expires
Mon, 19 Oct 2020 20:04:35 GMT
EMOTET-3.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/ 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2017/09/EMOTET-3.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4e1dc5bc32951c98571c96c94b19852b7e484f5660c0ddfd2183c1e761d61c34
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
81863
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 19:34:35 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1751
etag
W/"13fc7-5b20b344ccd55"
accept-ranges
bytes
x-content-type-options
nosniff
x-akamai-path-stats
[3:151748:151252]
expires
Mon, 19 Oct 2020 20:03:46 GMT
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
7185
x-xss-protection
1;mode=block
last-modified
Mon, 19 Oct 2020 17:25:24 GMT
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript
vary
Accept-Encoding
cache-control
max-age=293
etag
"48de-5b209665459c8"
accept-ranges
bytes
x-content-type-options
nosniff
x-akamai-path-stats
[1:17912:4294966384]
expires
Mon, 19 Oct 2020 19:39:28 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 		81 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
26353
x-prod-n-02
Yes
x-frame-options
SAMEORIGIN
last-modified
Mon, 19 Oct 2020 17:44:31 GMT
server
nginx
x-prod-a-02
Yes
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
application/javascript
x-xss-protection
1;mode=block
cache-control
max-age=895
etag
"1457a-5b209aab3728b"
accept-ranges
bytes
expires
Mon, 19 Oct 2020 19:49:30 GMT
iframe_api
www.youtube.com/ 		859 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
dd604e4a9d3132d8aa5c661e20880b07488d65f96386f86e73ec1327293ea2ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status
200
cache-control
no-cache
content-type
application/javascript
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 		379 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1f733e0217b0a53c84553bd264434c5e807faabcd0d877c294fb970d0c619b1c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 10 Sep 2020 17:13:51 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
114969
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
W/"5ed917ff-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
status
200
date
Mon, 19 Oct 2020 19:34:35 GMT
x-host
s7.addthis.com
content-length
116324
x-akamai-path-stats
[3:141006:4294965290],[3:138018:4294830278],[3:145538:4294827758],[3:138797:4294822499],[3:138203:4294829093],[3:138904:4294827392]
j.php
dev.visualwebsiteoptimizer.com/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&f=1&r=0.4550035649752153
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
09d0859296e242edf405fd9e90d55ec8cfaae194706a9282c3d5f04cbad63b34

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:34 GMT
content-encoding
gzip
server
gfra1
content-type
application/javascript; charset=UTF-8
status
200
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		97 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
226b56a10864704e80ddd3d841e8b38816943f5a55b92a6ced6be14cb9b3f0fd

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Fri, 16 Oct 2020 17:06:31 GMT
server
AkamaiNetStorage
etag
"26e7edc0740d89187bc4a3c3be7ab3b8:1602867990.90373"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
24163
expires
Mon, 19 Oct 2020 19:39:35 GMT
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/ 		23 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4ae33b96315a8726404109e3a9d79fdbc89149b8ff68b724023ac7318cd4ad02
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 16 Jul 2020 17:11:57 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
x-prod-a-02
Yes
content-type
application/x-font-ttf
status
200
x-xss-protection
1;mode=block
cache-control
public, max-age=915
vary
Accept-Encoding
content-length
13436
x-prod-n-02
Yes
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 09:05:23 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
37752
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Tue, 19 Oct 2021 09:05:23 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 09:05:23 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:49 GMT
server
sffe
age
37752
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9180
x-xss-protection
0
expires
Tue, 19 Oct 2021 09:05:23 GMT
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Mon, 19 Oct 2020 19:34:35 GMT
x-prod-a-02
Yes
content-type
application/x-font-woff
status
200
x-xss-protection
1;mode=block
cache-control
public, max-age=924
content-length
73259
x-prod-n-02
Yes
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:05:59 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:16 GMT
server
sffe
age
1716
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9016
x-xss-protection
0
expires
Tue, 19 Oct 2021 19:05:59 GMT
mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v18/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 09:05:31 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:34 GMT
server
sffe
age
37744
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9728
x-xss-protection
0
expires
Tue, 19 Oct 2021 09:05:31 GMT
memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v18/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 13 Oct 2020 22:56:00 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
506315
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9744
x-xss-protection
0
expires
Wed, 13 Oct 2021 22:56:00 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vfl7r2f24/ 		96 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl7r2f24/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c1ef01366195120d68c9bfdcab0bb8b0f9a5bfcfd16302bb7bf37c5a74d1bb43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
46529
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35387
x-xss-protection
0
last-modified
Thu, 15 Oct 2020 16:54:46 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Tue, 27 Oct 2020 06:39:06 GMT
va-0ca7acdf418d8c12f3819dda65c35024.js
dev.visualwebsiteoptimizer.com/7.0/ 		203 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&f=1&r=0.4550035649752153
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
eddf9f54fac22fd0894e24adf899cd7878813ce12de72610021be8b14c35feda

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
br
last-modified
Mon, 19 Oct 2020 10:14:44 GMT
server
gfra1
status
200
etag
"5f8d6714-e882"
vary
Accept-Encoding, User-Agent
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59522
via
1.1 google
track-0ca7acdf418d8c12f3819dda65c35024.js
dev.visualwebsiteoptimizer.com/7.0/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/7.0/track-0ca7acdf418d8c12f3819dda65c35024.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&f=1&r=0.4550035649752153
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
a156f80e04a73de980f571efd1a43fafb610bfe7a2a5f3ca86e3c0659c43475f

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
br
last-modified
Mon, 19 Oct 2020 10:14:44 GMT
server
gfra1
status
200
etag
"5f8d6714-da8"
vary
Accept-Encoding, User-Agent
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3496
via
1.1 google
opa-56761856850233eb41e36332d7e3cf79.js
dev.visualwebsiteoptimizer.com/analysis/4.0/ 		91 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-56761856850233eb41e36332d7e3cf79.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&f=1&r=0.4550035649752153
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
8f1993495d96383b5fd34d2f942fd512e285ec3eaeb0108f6e21bfd45b3a49e6

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
br
last-modified
Mon, 19 Oct 2020 05:30:35 GMT
server
gfra1
status
200
etag
"5f8d247b-5dc4"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24004
via
1.1 google
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
301 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=DF4E2CA7B91C782F6AFAC32C11FDE661B&h=991b2591db5fb89867b6ede0f58990fb&t=false&r=0.8912709775756431
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Oct 2020 19:34:34 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
status
200
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-250-213.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
FBAF69B7861DE212
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=17424
accept-ranges
bytes
content-length
948
x-amz-id-2
mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=
dict.en_us.json
www.trendmicro.com/libs/cq/i18n/ 		13 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en_us.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
server
nginx
etag
"def5866d2a6bd1b5e1123ce5b1a6217e"
x-frame-options
SAMEORIGIN
content-type
application/json;charset=utf-8
status
200
cache-control
public, max-age=346
date
Mon, 19 Oct 2020 19:34:35 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
13552
x-xss-protection
1;mode=block
emotet-returns-starts-spreading-via-spam-botnet.disruptor.html
www.trendmicro.com/en_us/research/17/i/ 		0
224 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.disruptor.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
status
204
x-content-type-options
nosniff
x-prod-n-01
Yes
x-xss-protection
1;mode=block
x-akamai-path-stats
[3:154927:73]
emotet-returns-starts-spreading-via-spam-botnet.notifications.html
www.trendmicro.com/en_us/research/17/i/ 		1 KB
765 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.notifications.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.61.16 , France, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-61-16.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6c5cd94722f2ae2d1581f6b87559684e2ae517a29a93805b91c708851a611cac
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
server
nginx
date
Mon, 19 Oct 2020 19:34:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/html;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
536
x-xss-protection
1;mode=block
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
etag
1901189993--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
public, max-age=53, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
1129
300lo.json
m.addthis.com/live/red_lojson/ 		90 B
250 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=5f8dea4b71f0f68d&bkl=0&bl=1&pdt=1205&sid=5f8dea4b71f0f68d&pub=ra-57bc9d0c3028a052&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.trendmicro.com&fp=en_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=research%2Cmalware%2Cendpoints&colc=1603136075569&jsl=1&uvs=5f8dea4b176ff597000&skipb=1&callback=addthis.cbs.jsonp__074697079925245770
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
89e7b7eb873215a25f5787b444f888684a8c547ccc16d045681ac0bf1e9f7725

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Mon, 19 Oct 2020 19:34:35 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
90
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame AB83 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame C480 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html

Response headers

status
200
server
nginx/1.15.8
content-type
text/html
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
etag
W/"5ed917ff-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.42.202002262042
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Wed, 26 Feb 2020 20:41:18 GMT
server
AkamaiNetStorage
etag
"76e9ea9a97ed91d0c8a5d6014b090bf2:1582749678.346226"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
5819
expires
Tue, 03 Nov 2020 19:34:35 GMT
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:02 GMT
server
AkamaiNetStorage
etag
"7b0575b394704ec7f76bef0f68cfc059:1486318442"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1706
expires
Tue, 03 Nov 2020 19:34:35 GMT
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:01 GMT
server
AkamaiNetStorage
etag
"15598bba639efba2403d00ec82947e93:1486318441"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1024
expires
Tue, 03 Nov 2020 19:34:35 GMT
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.42.201608171750
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:03 GMT
server
AkamaiNetStorage
etag
"afbbd577745f63042227302506a07e1a:1486318443"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1454
expires
Tue, 03 Nov 2020 19:34:35 GMT
utag.124.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.124.js?utv=ut4.42.202009171637
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 17:52:13 GMT
server
AkamaiNetStorage
etag
"9d323f92c46f9880077c1b57db99e5f7:1591293133.081481"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1216
expires
Tue, 03 Nov 2020 19:34:35 GMT
settings.js
dev.visualwebsiteoptimizer.com/ 		360 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=7.0&r=0.34627625172497356&exc=69|95
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/7.0/va-0ca7acdf418d8c12f3819dda65c35024.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
e81dc0a49c431ba97bdc035723ab6b4297284b9585e3f85d71bbf9337d14a241

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
server
gfra1
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
content-type
application/javascript; charset=UTF-8
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
4232
date
Mon, 19 Oct 2020 18:24:03 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Mon, 19 Oct 2020 20:24:03 GMT
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 19 Oct 2020 19:34:35 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Aug 2020 03:11:00 GMT
Server
AkamaiNetStorage
ETag
"a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
1126
date
Mon, 19 Oct 2020 19:15:49 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Mon, 19 Oct 2020 21:15:49 GMT
acsb.js
acsbapp.com/apps/app/assets/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
391 KB
391 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acsbapp.com/apps/app/assets/js/acsb.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
206.189.189.226 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc2.jetserver.net
Software
nginx /
Resource Hash
eb5c0d5d57b0114029d562eb20b2c802dd0872e425e7176f00b5f1d923e5c8fa

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:36 GMT
last-modified
Sat, 17 Oct 2020 21:18:15 GMT
server
nginx
etag
"61a80-5f8b5f97-93d569de2cb3577c;;;"
x-cache-status
HIT
status
200
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
400000
expires
Tue, 20 Oct 2020 19:34:17 GMT

Redirect headers

status
301
date
Mon, 19 Oct 2020 19:34:35 GMT
server
nginx
content-length
162
location
https://acsbapp.com/apps/app/assets/js/acsb.js
content-type
text/html
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2
status
200
content-length
695
cf-request-id
05e3f44ff40000cc3a3a1d8000000001
last-modified
Sat, 17 Oct 2020 01:47:31 GMT
server
cloudflare
etag
"4c1fae-6f3-5b1d4107dcd62"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
5e4ceff988f6cc3a-ZRH
expires
Mon, 19 Oct 2020 19:35:35 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
202 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202010161706&cb=1603136075672
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.214 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-214.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Mon, 19 Oct 2020 19:44:35 GMT
config.json
c.go-mpulse.net/api/ Frame 98FF 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=TU3LW-WPX5W-YK52N-GNWRK-Z5B9X&d=www.trendmicro.com&t=5343787&v=1.632.0&if=&sl=0&si=uofs7qhp9df-qigrpn&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
6ea1b972214f838901906a45e730c79f65bf61ea300c954074a84206d23e9b15

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 19 Oct 2020 19:34:35 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
949
ec.js
www.google-analytics.com/plugins/ua/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:10:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
1455
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Mon, 19 Oct 2020 20:10:20 GMT
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
937 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:13:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
1272
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Mon, 19 Oct 2020 20:13:23 GMT
__utm.gif
ssl.google-analytics.com/r/ 		35 B
418 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=969129921&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=EMOTET%20Returns%2C%20Starts%20Spreading%20via%20Spam%20Botnet&utmhid=596335386&utmr=-&utmp=%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&utmht=1603136075730&utmac=UA-29051577-12&utmcc=__utma%3D44797537.1232236899.1603136076.1603136076.1603136076.1%3B%2B__utmz%3D44797537.1603136076.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2121902689&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Oct 2020 19:34:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
worker-70faafffa0475802f5ee03ca5ff74179.js
dev.visualwebsiteoptimizer.com/analysis/ 		47 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-56761856850233eb41e36332d7e3cf79.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gfra1 /
Resource Hash
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:35 GMT
content-encoding
br
last-modified
Mon, 16 Mar 2020 04:40:32 GMT
server
gfra1
status
200
etag
"5e6f0340-351f"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13599
via
1.1 google
collect
www.google-analytics.com/ 		35 B
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j86&a=596335386&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&ul=en-us&de=UTF-8&dt=EMOTET%20Returns%2C%20Starts%20Spreading%20via%20Spam%20Botnet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.1232236899.1603136076.1603136076.1603136076.1&_utmz=44797537.1603136076.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1603136075780&_u=aGBCCAIrB~&cid=1232236899.1603136076&tid=UA-44592531-1&_gid=1738085528.1603136076&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&z=753237057
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Oct 2020 04:03:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
55860
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
munchkin.js
munchkin.marketo.net/159/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/159/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.221.60.75 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 19 Oct 2020 19:34:35 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 May 2020 02:24:14 GMT
Server
AkamaiNetStorage
ETag
"79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4810
Expires
Wed, 27 Jan 2021 19:34:35 GMT
layers.33f5b85045a5f2308467.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
W/"5ed917ff-41b9f"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86313600
date
Mon, 19 Oct 2020 19:34:35 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77540
visitWebPage
945-cxd-062.mktoresp.com/webevents/ 		2 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1603136075843&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1603136075842-19926&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/159/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 19 Oct 2020 19:34:36 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
fd0512b3-0bf0-48e8-85bf-ed4eedcda4b2
/
graph.facebook.com/ 		228 B
619 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_lefo0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0e1c7f06adcdfa1ba0130ef3ff30470eee96bd19bc02c0978a8e730b52b779eb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status
200
x-fb-rev
1002843585
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
173
pragma
no-cache
x-fb-debug
szK/Ah8jOyleThYjIHkGa/1zQlbQIyQt3OIIDEH3gqIkYMHuZPiOeEKoIUufTYRmKHqQ/Rk0H4TjPOcNnu0tHg==
x-fb-trace-id
AVfmqFbcpo1
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AMsyU2NLGD3qrXA2bhy7-SD
cache-control
no-store
facebook-api-version
v3.1
expires
Sat, 01 Jan 2000 00:00:00 GMT
shares.json
api-public.addthis.com/url/ 		33 B
334 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&callback=_ate.cbs.rcb_9xbt0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
42a0835218904fb067598fd399367f23fd3eb93178bb3e7d1d6ed2197da9e16b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
last-modified
Mon, 19 Oct 2020 19:34:36 GMT
server
nginx/1.15.8
date
Mon, 19 Oct 2020 19:34:36 GMT
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
/
graph.facebook.com/ 		228 B
328 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_art70
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
032527396003c8687ee148c0f875b28102230f63c2e3e146086740760509b3c3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status
200
x-fb-rev
1002843585
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
173
pragma
no-cache
x-fb-debug
NaEFHWZmrdkqbUthGFZEh4D2rFD14fIBmnSy+HvPnBPdtx2c9JXx77OvFtFTF8gTNG86FNbSCkx5W1TT4f0CIQ==
x-fb-trace-id
GiHbXt1pVBa
date
Mon, 19 Oct 2020 19:34:35 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AX2lNCC3ZW6ZISVAfbF1zOo
cache-control
no-store
facebook-api-version
v3.1
expires
Sat, 01 Jan 2000 00:00:00 GMT
shares.json
api-public.addthis.com/url/ 		33 B
334 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F17%2Fi%2Femotet-returns-starts-spreading-via-spam-botnet.html&callback=_ate.cbs.rcb_avav0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
ee0b7727a4031f6bf120afdd912015dcd4232667e2dfc0fa90448f8e2eb067bd
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
last-modified
Mon, 19 Oct 2020 19:34:35 GMT
server
nginx/1.15.8
date
Mon, 19 Oct 2020 19:34:36 GMT
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
/
686eb519.akstat.io/ 		0
233 B 		Other
General
Check archive.org
Download Go to
Full URL
https://686eb519.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:287::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Mon, 19 Oct 2020 19:34:37 GMT
status
204
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
x-akamai-path-stats
[3:91191:809]
expires
Mon, 19 Oct 2020 19:34:37 GMT
en.build.json
cdn.acsbapp.com/cache/app/trendmicro.com/ 		227 KB
25 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.acsbapp.com/cache/app/trendmicro.com/en.build.json
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.93.197.211 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc1.jetserver.net
Software
nginx /
Resource Hash
080a15e4483ec9178b350680edf8a31cc5eaf82c2a3bfc2d2eca8860c6073b18

Request headers

Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 19 Oct 2020 19:34:38 GMT
content-encoding
br
last-modified
Mon, 19 Oct 2020 19:32:52 GMT
server
nginx
status
200
etag
"38c3a-5f8de9e4-3a0263a1e092f129;br"
x-cache-status
HIT
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
25725
expires
Tue, 20 Oct 2020 19:34:18 GMT
acsbi.ttf
acsbapp.com/apps/app/assets/fonts/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://acsbapp.com/apps/app/assets/fonts/acsbi.ttf?qj8z5u
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.93.197.211 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc1.jetserver.net
Software
nginx /
Resource Hash
9abdb3b3eb61358ec6439f8588ba57d83b46137d500ccf3afbe62470f8f2cd46

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/17/i/emotet-returns-starts-spreading-via-spam-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 19 Oct 2020 19:34:38 GMT
last-modified
Thu, 09 Jul 2020 12:08:22 GMT
server
nginx
etag
"4404-5f0708b6-50d137ede543b6ba;;;"
x-cache-status
HIT
status
200
content-type
application/x-font-ttf
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
17412
expires
Tue, 19 Oct 2021 19:34:29 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

215 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| BOOMR number| BOOMR_lstart object| BOOMR_mq function| $ function| jQuery object| matched object| browser object| Granite object| maxy_pathnames number| settings_timer number| _vwo_settings_timer object| _vwo_code object| utag_data object| base64 function| Cludo object| CludoSearch string| cludo_language function| Sly function| webpackJsonpjwplayer function| jwplayer object| YT object| YTConfig function| onYTReady function| id function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| disruptorPanel object| folioMessage number| globalBodyScroll function| toggleFilterListNav function| hideSearchBar function| setFocus object| searchButton object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight function| jumpScroll object| promotionalContent object| savedArticles object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| researchUtilityMenu object| bsModal number| _vwo_acc_id object| _vwo_style string| _vwo_css string| _vwo_cookieDomain string| _vwo_uuid string| _vis_opt_file number| _vwo_library_timer string| _vis_opt_lib undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| VWO object| vwo_iehack_queue object| _vwo_exp_ids object| _vwo_exp object| _vwo_pa string| _vwo_opa_cb string| _vwo_worker_cb function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| CludoSearchInstances object| $navSticky object| addthis_share object| addthis_config object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href number| len undefined| linkName object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev object| _vwo_t object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath number| _vis_opt_experiment_id boolean| _vwo_settings_timed_out boolean| __@@##MUH string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| _gat number| ___vwo boolean| DISABLE_NATIVE_CONSTANTS object| __nls object| _vwo_geo object| oattr function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin number| c_start object| MunchkinTracker object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks number| BOOMR_configt object| _bmrEvents object| EJS object| acsb object| acsbJS object| AccessiBe object| _0xbd91 boolean| acsbInited boolean| acsbPendingLoad number| BOOMR_onload object| whichUl object| EJSEventListeners object| acsbActiveLang function| acsbIframeActionReporter boolean| acsbFramerBound function| acsbFireAlert

21 Cookies

Domain/Path Name / Value
.trendmicro.com/ Name: RT
Value: "z=1&dm=trendmicro.com&si=710f7bc4-2d1b-43fe-9fad-50026134abfe&ss=kggxtrbl&sl=1&tt=299&bcn=%2F%2F686eb519.akstat.io%2F&ld=29e"
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1603136076
.trendmicro.com/ Name: _vwo_sn
Value: 0%3A1
.trendmicro.com/ Name: utag_main
Value: v_id:0175425b37400040566d35833ae000078006307000b08$_sn:1$_ss:1$_st:1603137875585$ses_id:1603136075585%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/ Name: _ga
Value: GA1.2.1232236899.1603136076
.trendmicro.com/ Name: _mkto_trk
Value: id:945-CXD-062&token:_mch-trendmicro.com-1603136075842-19926
.trendmicro.com/ Name: _vis_opt_s
Value: 1%7C
.addthis.com/ Name: loc
Value: MDAwMDBFVUNIVkQyMjY2MTg2NjAwMDAwMDBDSA==
.trendmicro.com/ Name: _vwo_uuid
Value: DF4E2CA7B91C782F6AFAC32C11FDE661B
www.trendmicro.com/ Name: __atuvc
Value: 1%7C43
.trendmicro.com/ Name: __utma
Value: 44797537.1232236899.1603136076.1603136076.1603136076.1
.trendmicro.com/ Name: _vis_opt_test_cookie
Value: 1
.addthis.com/ Name: uvc
Value: 1%7C43
.trendmicro.com/ Name: _vwo_ds
Value: 3%3Aa_0%2Ct_0%3A0%241603136074%3A76.757866%3A%3A%3A95_0%2C69_0%3A0
www.trendmicro.com/ Name: __atuvs
Value: 5f8dea4b176ff597000
.trendmicro.com/ Name: __utmz
Value: 44797537.1603136076.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.trendmicro.com/ Name: _gid
Value: GA1.2.1738085528.1603136076
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: _vwo_uuid_v2
Value: DF4E2CA7B91C782F6AFAC32C11FDE661B|991b2591db5fb89867b6ede0f58990fb
www.trendmicro.com/ Name: trendMicroVisitorContextIsBusiness
Value: true

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

686eb519.akstat.io
945-cxd-062.mktoresp.com
acsbap.com
acsbapp.com
api-public.addthis.com
blog.trendmicro.com
c.go-mpulse.net
cdn.acsbapp.com
customer.cludo.com
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
m.addthis.com
munchkin.marketo.net
resources.trendmicro.com
s.go-mpulse.net
s.ytimg.com
s7.addthis.com
ssl.google-analytics.com
tags.tiqcdn.com
v1.addthisedge.com
www.google-analytics.com
www.trendmicro.com
www.youtube.com
z.moatads.com
s7.addthis.com
104.17.71.206
142.93.197.211
192.28.144.124
2.21.61.16
206.189.189.226
23.210.248.44
23.210.250.213
23.37.38.214
2606:4700:10::6814:7c67
2a00:1450:4001:801::200a
2a00:1450:4001:816::200e
2a00:1450:4001:819::200e
2a00:1450:4001:81c::2008
2a00:1450:4001:81e::2003
2a00:1450:4001:825::200e
2a02:26f0:6c00:192::11a6
2a02:26f0:6c00:287::11a6
2a03:2880:f01c:800e:face:b00c:0:2
34.96.102.137
88.221.60.75
032527396003c8687ee148c0f875b28102230f63c2e3e146086740760509b3c3
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
080a15e4483ec9178b350680edf8a31cc5eaf82c2a3bfc2d2eca8860c6073b18
09d0859296e242edf405fd9e90d55ec8cfaae194706a9282c3d5f04cbad63b34
0e1c7f06adcdfa1ba0130ef3ff30470eee96bd19bc02c0978a8e730b52b779eb
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1f733e0217b0a53c84553bd264434c5e807faabcd0d877c294fb970d0c619b1c
226b56a10864704e80ddd3d841e8b38816943f5a55b92a6ced6be14cb9b3f0fd
248c05ae630c4731c0aeec5b4894dc655284048418638ba751c80c9017fc08a2
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35
42a0835218904fb067598fd399367f23fd3eb93178bb3e7d1d6ed2197da9e16b
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
4ae33b96315a8726404109e3a9d79fdbc89149b8ff68b724023ac7318cd4ad02
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96
4e1dc5bc32951c98571c96c94b19852b7e484f5660c0ddfd2183c1e761d61c34
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
6068e194fbcc63e770a21498d0c7a8bf6ac91c75aea4325772d2b71aadd46ff8
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6c5cd94722f2ae2d1581f6b87559684e2ae517a29a93805b91c708851a611cac
6ea1b972214f838901906a45e730c79f65bf61ea300c954074a84206d23e9b15
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89e7b7eb873215a25f5787b444f888684a8c547ccc16d045681ac0bf1e9f7725
8f1993495d96383b5fd34d2f942fd512e285ec3eaeb0108f6e21bfd45b3a49e6
8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
9abdb3b3eb61358ec6439f8588ba57d83b46137d500ccf3afbe62470f8f2cd46
9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9
9cac882062c55967840ac0f8d15636b6024cd8b121778e15a9e0224116b46586
a156f80e04a73de980f571efd1a43fafb610bfe7a2a5f3ca86e3c0659c43475f
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a2e0ac600a17d67a6fd921ad00480b4f031df232f2be66c223df5a168b902da8
a8a44a3130a2240db3e208bd599e35f3b38baa6ff09237b0e67123cdc22048d5
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c1ef01366195120d68c9bfdcab0bb8b0f9a5bfcfd16302bb7bf37c5a74d1bb43
d5b89171c58d13e98e6c9956a5599490ca3937aa90b73af54246da9770d3d128
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
dd604e4a9d3132d8aa5c661e20880b07488d65f96386f86e73ec1327293ea2ca
e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d
e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e81dc0a49c431ba97bdc035723ab6b4297284b9585e3f85d71bbf9337d14a241
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
eb5c0d5d57b0114029d562eb20b2c802dd0872e425e7176f00b5f1d923e5c8fa
ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10
eddf9f54fac22fd0894e24adf899cd7878813ce12de72610021be8b14c35feda
ee0b7727a4031f6bf120afdd912015dcd4232667e2dfc0fa90448f8e2eb067bd
f60fa81793a8c06335c1e7ad1609402ba5856517ab93df50764698937e70a8aa
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305