www.bankinfosecurity.com Open in urlscan Pro
50.56.167.254 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Submission: On February 06 via manual (February 6th 2024, 3:58:13 pm UTC) from US — Scanned from DE

Summary HTTP 212 Redirects Links 47 Behaviour Indicators

Summary

This website contacted 40 IPs in 4 countries across 27 domains to perform 212 HTTP transactions. The main IP is 50.56.167.254, located in United States and belongs to RMH-14, US. The main domain is www.bankinfosecurity.com. The Cisco Umbrella rank of the primary domain is 496904.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 27th 2023. Valid for: 9 months.

This is the only time www.bankinfosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	50.56.167.254 50.56.167.254	33070 (RMH-14) (RMH-14)
2	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	13.32.27.61 13.32.27.61	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:244... 2600:9000:2449:b000:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
78	23.36.233.236 23.36.233.236	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.130.251.6 104.130.251.6	33070 (RMH-14) (RMH-14)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:26b... 2600:9000:26bf:2c00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	3.70.37.50 3.70.37.50	16509 (AMAZON-02) (AMAZON-02)
1	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2	34.117.77.79 34.117.77.79	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.32.23.57 13.32.23.57	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.3.3.203 52.3.3.203	14618 (AMAZON-AES) (AMAZON-AES)
2	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
4 5	2620:109:c002... 2620:109:c002::6cae:a14	14413 (LINKEDIN) (LINKEDIN)
1	108.174.10.24 108.174.10.24	14413 (LINKEDIN) (LINKEDIN)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
4	151.101.64.134 151.101.64.134	54113 (FASTLY) (FASTLY)
8	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
2	18.158.171.174 18.158.171.174	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
11	2600:9000:20b... 2600:9000:20b4:3800:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2404:6800:400... 2404:6800:4003:c05::5e	15169 (GOOGLE) (GOOGLE)
3	20.122.63.128 20.122.63.128	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2600:9000:215... 2600:9000:2156:8e00:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1 2	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
212	40

30 50.56.167.254 (United States)

ASN33070 (RMH-14, US)

www.bankinfosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-61.fra56.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2449:b000:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

78 23.36.233.236 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-233-236.deploy.static.akamaitechnologies.com

130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.130.251.6 (United States)

ASN33070 (RMH-14, US)

worker.ismgcorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26bf:2c00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.70.37.50 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-70-37-50.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

bankinfosecurity.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.23.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-57.fra56.r.cloudfront.net

dnn506yrbagrg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.3.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-3-203.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

051-zxi-237.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:109:c002::6cae:a14 (United States) 4 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.24 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-24.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.64.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.158.171.174 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-171-174.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:20b4:3800:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4003:c05::5e (Singapore, Singapore)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.122.63.128 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

p.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2156:8e00:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
78	rackcdn.com 130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 260811 0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 720457 4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 772633 75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 281484 6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 587730 dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 627581 fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 793521 21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 792007 752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com — Cisco Umbrella Rank: 287774 f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com	9 MB
30	bankinfosecurity.com www.bankinfosecurity.com — Cisco Umbrella Rank: 496904	472 KB
15	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 110 d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 157	191 KB
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 5532 c.6sc.co — Cisco Umbrella Rank: 8403 ipv6.6sc.co — Cisco Umbrella Rank: 5709 b.6sc.co — Cisco Umbrella Rank: 3792	22 KB
11	disquscdn.com c.disquscdn.com — Cisco Umbrella Rank: 5881	288 KB
10	gstatic.com fonts.gstatic.com csi.gstatic.com	178 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 747 p.clarity.ms — Cisco Umbrella Rank: 6913 c.clarity.ms — Cisco Umbrella Rank: 1351	28 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 349 www.linkedin.com — Cisco Umbrella Rank: 632 px4.ads.linkedin.com — Cisco Umbrella Rank: 6550	5 KB
6	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 209	186 KB
6	disqus.com bankinfosecurity.disqus.com — Cisco Umbrella Rank: 905723 disqus.com — Cisco Umbrella Rank: 1324 referrer.disqus.com — Cisco Umbrella Rank: 8238	54 KB
6	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4337 buttons-config.sharethis.com — Cisco Umbrella Rank: 4843 l.sharethis.com — Cisco Umbrella Rank: 4514 platform-cdn.sharethis.com — Cisco Umbrella Rank: 9588	50 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	278 KB
3	ml314.com ml314.com — Cisco Umbrella Rank: 1870 in.ml314.com — Cisco Umbrella Rank: 10729	11 KB
3	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3810	11 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9521	726 B
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2029	306 B
2	mktoresp.com 051-zxi-237.mktoresp.com — Cisco Umbrella Rank: 647420	636 B
2	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2238	3 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3596	6 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	4 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 247	764 B
1	cloudfront.net dnn506yrbagrg.cloudfront.net	822 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 783	16 KB
1	bizographics.com sjs.bizographics.com — Cisco Umbrella Rank: 38807	16 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 230	29 KB
1	ismgcorp.com worker.ismgcorp.com — Cisco Umbrella Rank: 890605	305 B
212	27

	Domain	Requested by
30	www.bankinfosecurity.com	www.bankinfosecurity.com
19	130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
13	75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
11	c.disquscdn.com	disqus.com c.disquscdn.com
11	dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
11	0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
8	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
8	b.6sc.co	www.bankinfosecurity.com
7	fonts.gstatic.com	fonts.googleapis.com
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
6	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.bankinfosecurity.com pagead2.googlesyndication.com
6	6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	disqus.com	bankinfosecurity.disqus.com c.disquscdn.com
4	px.ads.linkedin.com	3 redirects sjs.bizographics.com
4	www.googletagmanager.com	www.bankinfosecurity.com www.googletagmanager.com
4	752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
4	4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
3	platform-cdn.sharethis.com	www.bankinfosecurity.com
3	p.clarity.ms	www.clarity.ms
3	csi.gstatic.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
3	nexus.ensighten.com	www.bankinfosecurity.com nexus.ensighten.com
2	c.clarity.ms	1 redirects
2	epsilon.6sense.com	j.6sc.co
2	region1.google-analytics.com	www.googletagmanager.com
2	051-zxi-237.mktoresp.com	munchkin.marketo.net
2	script.crazyegg.com	dnn506yrbagrg.cloudfront.net script.crazyegg.com
2	ipv6.6sc.co	j.6sc.co
2	c.6sc.co	j.6sc.co
2	www.clarity.ms	www.bankinfosecurity.com www.clarity.ms
2	ml314.com	www.bankinfosecurity.com ml314.com
2	munchkin.marketo.net	www.bankinfosecurity.com munchkin.marketo.net
2	f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com	www.bankinfosecurity.com
2	fonts.googleapis.com	www.bankinfosecurity.com client
1	www.google.com	tpc.googlesyndication.com
1	c.bing.com	1 redirects
1	referrer.disqus.com	www.bankinfosecurity.com
1	d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	px4.ads.linkedin.com	www.bankinfosecurity.com
1	www.linkedin.com	1 redirects
1	in.ml314.com	ml314.com
1	dnn506yrbagrg.cloudfront.net	www.bankinfosecurity.com
1	j.6sc.co	www.bankinfosecurity.com
1	snap.licdn.com	www.bankinfosecurity.com
1	sjs.bizographics.com	www.bankinfosecurity.com
1	bankinfosecurity.disqus.com	www.bankinfosecurity.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	www.googletagservices.com	www.bankinfosecurity.com
1	worker.ismgcorp.com	www.bankinfosecurity.com
1	platform-api.sharethis.com	www.bankinfosecurity.com
212	52

This site contains links to these domains. Also see Links.

Domain
www.cuinfosecurity.com
www.govinfosecurity.com
www.healthcareinfosecurity.com
www.inforisktoday.com
www.careersinfosecurity.com
www.databreachtoday.com
www.devicesecurity.io
www.fraudtoday.io
www.paymentsecurity.io
www.cio.inc
www.aitoday.io
www.bankinfosecurity.co.uk
www.bankinfosecurity.eu
www.bankinfosecurity.in
www.bankinfosecurity.asia
ffiec.bankinfosecurity.com
omnibus.healthcareinfosecurity.com
ddos.inforisktoday.com
ransomware.databreachtoday.com
gdpr.inforisktoday.com
covid19.inforisktoday.com
ismg.events
www.facebook.com
twitter.com
www.linkedin.com
www.surveymonkey.com
www.twitter.com
www.proofpoint.com
securityintelligence.inforisktoday.com
ismg.io

Subject Issuer	Validity	Valid
ismg.io Go Daddy Secure Certificate Authority - G2	`2023-10-27` - `2024-07-30`	9 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
sharethis.com Amazon RSA 2048 M02	`2023-05-20` - `2024-06-17`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M02	`2023-09-29` - `2024-10-27`	a year	crt.sh
*.ssl.cf1.rackcdn.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-27` - `2024-03-28`	a year	crt.sh
worker.ismgcorp.com Go Daddy Secure Certificate Authority - G2	`2023-02-12` - `2024-03-15`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-04-20`	a year	crt.sh
event-horizon.gcp.bomm.in GTS CA 1D4	`2024-01-01` - `2024-03-31`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2023-08-10` - `2024-08-09`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2023-12-07` - `2024-12-07`	a year	crt.sh
*.ml314.com Amazon RSA 2048 M02	`2023-10-16` - `2024-11-12`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-09` - `2024-03-08`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-13` - `2024-07-13`	6 months	crt.sh
a.disquscdn.com Amazon RSA 2048 M01	`2023-08-31` - `2024-09-27`	a year	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 01	`2024-01-14` - `2024-06-27`	5 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Frame ID: AC022325E80A52BF0D88AEEB04CFC623
Requests: 173 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
Frame ID: EEF75521D6B71E451BC6262D73A9B263
Requests: 23 HTTP requests in this frame

Frame: https://d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 66A333DA5468FAE1152C3654CB4C388A
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvCPFhVe3vMMh5qp8-I-kRv0clbNFzpdR-5F9H8qcGAkDHV6ju1sm5-aGnRSI7AxzPrggz4NsWLPz35hsi6kRjNzymSNwNA0a_hsEii7ZpLE9suZWrHRNLooDyTqtR22y4XnUCbRVqn04sERlg6deVoHWTKJyO0Ka5MnRF_USDmNpFdVLZyqceKjm0U7dnlXMBHUAIN9fzkIg0Qfe-5hPrn_akGL8P2gp9xf-A2GWlzpnusbbZBpq2hK02Cwmj-IEyINSrQ-CIGIiir_J08NZAUnixrSBtPbc1bVtidMLqwn5DCeq6N5xPuSU5IUffH3RAABz_EDcdTacmRysU7fJ46sVJ4MovJYZ1PmUDVSBxd4Eo&sai=AMfl-YQLDDkvr5angwGv3z158Lotzlv5u8nZ6pfjf1xC3dutfOM7VvD7S_eWDkVwd4X1BGRuf-cS7NGbGxirxuFuQoznXp7EXlHoLwcHAAYrkygkuKFDMNSTtOgdep9mKgfGOy3ho8P6ohBbNYybhJHzEwk&sig=Cg0ArKJSzF1UpSfnfBrWEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 56941E586F704F6E7082DF9794D1EF20
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 040AEC2E9FE870B5BD779F14DB622C80
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F1A32A55D140F56A74B38D3D7DE4AE1D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Spear-Phishing Campaign Distributes Nim-Based Malware

Detected technologies

TinyMCE (Rich Text Editors) Expand

Overall confidence: 100%
Detected patterns

/tiny_?mce(?:\.min)?\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

prettyPhoto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:<link [^>]*href="[^"]*prettyPhoto(?:\.min)?\.css|<a [^>]*rel="prettyPhoto)
jquery\.prettyPhoto\.js

Page Statistics

212
Requests

99 %
HTTPS

55 %
IPv6

27
Domains

52
Subdomains

40
IPs

4
Countries

11560 kB
Transfer

19214 kB
Size

31
Cookies

47 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cuinfosecurity.com/
Title: CUInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.govinfosecurity.com/
Title: GovInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.healthcareinfosecurity.com/
Title: HealthcareInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.inforisktoday.com/
Title: InfoRiskToday

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/
Title: CareersInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.databreachtoday.com/
Title: DataBreachToday

Search URL Search Domain Scan URL

URL: https://www.devicesecurity.io/
Title: DeviceSecurity

Search URL Search Domain Scan URL

URL: https://www.fraudtoday.io/
Title: FraudToday

Search URL Search Domain Scan URL

URL: https://www.paymentsecurity.io/
Title: PaymentSecurity

Search URL Search Domain Scan URL

URL: https://www.cio.inc/
Title: CIO

Search URL Search Domain Scan URL

URL: https://www.aitoday.io/
Title: AIToday

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.co.uk/
Title: UK

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.eu/
Title: Europe

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.in/
Title: India

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/
Title: Asia

Search URL Search Domain Scan URL

URL: https://ffiec.bankinfosecurity.com/
Title: FFIEC

Search URL Search Domain Scan URL

URL: https://omnibus.healthcareinfosecurity.com/
Title: HIPAA Omnibus

Search URL Search Domain Scan URL

URL: https://ddos.inforisktoday.com/
Title: DDoS

Search URL Search Domain Scan URL

URL: https://ransomware.databreachtoday.com/
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://gdpr.inforisktoday.com/
Title: GDPR

Search URL Search Domain Scan URL

URL: https://covid19.inforisktoday.com/
Title: COVID-19

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/fraud-security-risk-newyork-2024/

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/north-america-west-future-ai-2024/

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/midwest-cybersecurity-summit-2024/

Search URL Search Domain Scan URL

URL: https://ismg.events/summit/healthcare-2024/

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/jobs
Title: Jobs

Search URL Search Domain Scan URL

URL: https://www.careersinfosecurity.com/jobs/employer-center
Title: Post a Job

Search URL Search Domain Scan URL

URL: http://www.facebook.com/bankinfosec

Search URL Search Domain Scan URL

URL: http://twitter.com/BnkInfoSecurity

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/information-security-media-group-corp-ismg/?viewAsMember=true

Search URL Search Domain Scan URL

URL: https://www.surveymonkey.com/r/SecurityVisibilityAIM
Title: Gaining Security Visibility and Insights Throughout the Identity Ecosystem

Search URL Search Domain Scan URL

URL: https://www.twitter.com/@prajeetspeaks
Title: @prajeetspeaks

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware
Title: Proofpoint

Search URL Search Domain Scan URL

URL: https://twitter.com/@prajeetspeaks

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/how-one-university-beefing-up-cyber-defenses-programs-i-5333

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/top-considerations-for-complying-my-health-my-data-act-i-5309

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/how-merck-case-shapes-future-cyber-insurance-i-5345

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/xdr-benefits-managed-services-i-5346

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/large-language-models-moving-past-early-stage-i-5334

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/resilience-new-priority-for-your-security-model-i-5348

Search URL Search Domain Scan URL

URL: https://www.aitoday.io/interviews/how-clinicians-are-using-ai-to-communicate-patients-i-5332

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/how-novel-legal-maneuver-got-hospitals-stolen-data-back-i-5347

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/pushing-healthcare-sector-to-improve-cybersecurity-i-5351

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.asia/interviews/fighting-ai-fueled-attacks-ai-based-cyber-tools-i-5331

Search URL Search Domain Scan URL

URL: https://securityintelligence.inforisktoday.com/
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: https://ismg.io/
Title: Information Security Media Group, Corp.

Search URL Search Domain Scan URL

URL: https://ismg.io/about-us
Title: About ISMG

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 142

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1707235088506%26url%3Dhttps%253A%252F%252Fwww.bankinfosecurity.com%252Fspear-phishing-campaign-distributes-nim-based-malware-a-16176%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookiesTest=true&liSync=true&e_ipv6=AQJWKEstSgvu1gAAAY1_JBvnAtp9-N7TXTY5mrHRs7yTVGqlzplChtcsPfQNevtaCZN79fWlCyw4ez6LQuCtZnC_gnzy

Request Chain 195

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&RedC=c.clarity.ms&MXFR=068432869EC26FF920EE269B9AC26124 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&MUID=0CE97FC4E15E6BAE12696BD9E0356A62

212 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request spear-phishing-campaign-distributes-nim-based-malware-a-16176 Show response
www.bankinfosecurity.com/ 390 KB
54 KB 784ms
356ms Document
text/html 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

24b019a14e08c383ecdfbd56b8431bbae6c7f7e06f93259d8ccead0f29bc7055

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'none'
content-type: text/html; charset=UTF-8
date: Tue, 06 Feb 2024 15:56:48 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block

GET
H2 200 jquery-ui.min.css
www.bankinfosecurity.com/css-responsive/vendor/ 25 KB
5 KB 131ms
128ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/jquery-ui.min.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 mediaelementplayer-updated.css
www.bankinfosecurity.com/css-responsive/vendor/ 11 KB
3 KB 130ms
127ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/mediaelementplayer-updated.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 2729
x-xss-protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 55 KB
3 KB 45ms
22ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a4692a7234b95c9908d1a9068f1bc9191815a6b1d9e3b3b84ad12ee10caaaaee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 15:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 15:07:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 15:58:07 GMT

GET
H2 200 main.css
www.bankinfosecurity.com/css-responsive/ 232 KB
45 KB 243ms
240ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/main.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

91283916a6e9695687bb57ed913fe6fae10324ebfcfa06d31209357e56ebc004

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 prettyPhoto.css
www.bankinfosecurity.com/css-responsive/ 20 KB
3 KB 253ms
251ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/prettyPhoto.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

7d5e2f10ede290b4ad0d1bb2861dfacae9754453f352923e85e7d101a7686b00

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 2993
x-xss-protection: 1; mode=block

GET
H2 200 bis-hdr.desktop.r2.css
www.bankinfosecurity.com/css-responsive/vendor/ 8 KB
2 KB 242ms
240ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.desktop.r2.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

20b9ebf817b8dc640c06e993e5ae1127a6eb6b0c9fc6acbfb288f3b3a82405be

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 1997
x-xss-protection: 1; mode=block

GET
H2 200 bis-hdr.mobile.r2.css
www.bankinfosecurity.com/css-responsive/vendor/ 9 KB
2 KB 130ms
127ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/bis-hdr.mobile.r2.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

59400de556b42dee4aa3e6f7b73676a81e260d35481b6d8d77656ee45ae9484b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 2183
x-xss-protection: 1; mode=block

GET
H2 200 font-awesome.min.css
www.bankinfosecurity.com/css-responsive/vendor/ 22 KB
5 KB 244ms
241ms Stylesheet
text/css 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/css; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 jquery.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 91 KB
34 KB 241ms
239ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 35 KB
10 KB 242ms
240ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/bootstrap.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 jquery.validate.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 21 KB
7 KB 245ms
243ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 mediaelement-and-player-updated.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 154 KB
39 KB 365ms
363ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/mediaelement-and-player-updated.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 tinymce.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 295 KB
105 KB 366ms
365ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/tinymce.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 jquery.validate.bootstrap.popover.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 2 KB
988 B 367ms
365ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.validate.bootstrap.popover.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 952
x-xss-protection: 1; mode=block

GET
H2 200 jquery.placeholder.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 2 KB
972 B 364ms
363ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.placeholder.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 936
x-xss-protection: 1; mode=block

GET
H2 200 jquery-ui.min.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 222 KB
63 KB 364ms
363ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery-ui.min.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 crypt_des.js Show response
www.bankinfosecurity.com/javascripts-responsive/vendor/ 9 KB
3 KB 368ms
367ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/vendor/crypt_des.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

34f6a8e7792bc499cdcfcfae70d35a02766db4471551ec36844c3214357d6163

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 2829
x-xss-protection: 1; mode=block

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 206 KB
46 KB 38ms
7ms Script
text/javascript 13.32.27.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-61.fra56.r.cloudfront.net

Software

Resource Hash

cf9e92205faeb2fc9929f8aaf67ee6fb15084be8994babd310cfa01d62e29e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:57:31 GMT
content-encoding: gzip
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-C2
age: 37
etag: W/"3360d-7zvdaxLS2Lhi3Pty7QrCYymkuqI"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-cache: Hit from cloudfront
x-amz-cf-id: fbKvtoFyxPp-mZ3mlzkIqFZWNqovB3xXTkoTLSW5EqaUMNvL51Pbsw==

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/12567/ 28 KB
9 KB 90ms
14ms Script
application/javascript 2600:9000:2449:b000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:b000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 7b1f1149b35bdc7a4ad9e37242331df369538b19116d6f08656048728affc113

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 00:58:28 GMT
x-amz-version-id: wcpAQxtzZKGij2A3X0Ny8qS_0rxUarQG
content-encoding: br
via: 1.1 c88ca2a75ca16a71cee4beefb2f6e6b8.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P6
age: 8953180
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 26 Oct 2023 00:58:02 GMT
server: CloudFront
etag: W/"aa210dcce2ce9f8169171b4343ee6d29"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: gcQPsoYtY_bbOMq_Ob3ESF6i524iScLS6z7xaDx-pcXnmzyXES-AgA==

GET
H2 200 headerlogo-bis.png
www.bankinfosecurity.com/images-responsive/logos/ 2 KB
2 KB 367ms
366ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logos/headerlogo-bis.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
x-frame-options: deny
content-type: image/png
cache-control: max-age=86400, private, must-revalidate
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 1659
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK dozens-commercial-spyware-vendors-at-work-google-warns-showcase_image-7-a-24270.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 57 KB
58 KB 98ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/dozens-commercial-spyware-vendors-at-work-google-warns-showcase_image-7-a-24270.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24845b3525ef264122621c6f4b253a57ff5fa29fc0d0124a571a79309768cf84

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:07 GMT
Last-Modified: Mon, 05 Feb 2024 20:20:46 GMT
ETag: 3aeb6995b729de0b66300b9489082f6b
Content-Type: image/jpeg
X-Timestamp: 1707164445.06391
Cache-Control: public, max-age=65239
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 58490
X-Trans-Id: tx3fc71d4bc43649dfbbdd8-0065c20461dfw1
Expires: Wed, 07 Feb 2024 10:05:26 GMT

GET
H/1.1 200
OK are-federal-cybersecurity-performances-measures-realistic-showcase_image-3-a-24278.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 73 KB
73 KB 28ms
28ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/are-federal-cybersecurity-performances-measures-realistic-showcase_image-3-a-24278.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8ec5d3507fac6825a9fcc3a38795eac85328707722ad23076021ed774dafc05c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:07 GMT
Last-Modified: Mon, 05 Feb 2024 22:56:49 GMT
ETag: 0ff6812cbfd742db147a0bfd74f26ff9
Content-Type: image/jpeg
X-Timestamp: 1707173808.14574
Cache-Control: public, max-age=26932
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 74372
X-Trans-Id: tx17f31bc6735a446f90a6b-0065c16eaedfw1
Expires: Tue, 06 Feb 2024 23:26:59 GMT

GET
H/1.1 200
OK wiz-snags-zscaler-coo-dali-rajic-showcase_image-5-a-24280.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 21 KB
21 KB 9ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/wiz-snags-zscaler-coo-dali-rajic-showcase_image-5-a-24280.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: eed710ecb48e84959f1942bd51bc228c4c946f04f0580a938553e33bc197af2c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:07 GMT
Last-Modified: Mon, 05 Feb 2024 22:17:22 GMT
ETag: 3415a6776011bc35504dd7d7bcae047c
Content-Type: image/jpeg
X-Timestamp: 1707171441.74062
Cache-Control: public, max-age=24512
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21590
X-Trans-Id: txab755dad355448fbb08bc-0065c1654fdfw1
Expires: Tue, 06 Feb 2024 22:46:39 GMT

GET
H/1.1 200
OK systems-phones-still-offline-at-chicago-childrens-hospital-showcase_image-6-a-24274.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 101 KB
101 KB 12ms
12ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/systems-phones-still-offline-at-chicago-childrens-hospital-showcase_image-6-a-24274.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e2fd1fc6faac843a1901fa66c6f3e23a68407892b33609e5ee57d67a6c5c4b01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:07 GMT
Last-Modified: Mon, 05 Feb 2024 20:22:11 GMT
ETag: f5c74e9c7402b96131f25d9fe964d2eb
Content-Type: image/jpeg
X-Timestamp: 1707164530.18595
Cache-Control: public, max-age=19258
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103073
X-Trans-Id: tx12889fba7b4a489fa4fef-0065c150b0dfw1
Expires: Tue, 06 Feb 2024 21:19:05 GMT

GET
H/1.1 200
OK pushing-healthcare-sector-into-stronger-cybersecurity-showcase_image-7-i-5351.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 58 KB
58 KB 48ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/pushing-healthcare-sector-into-stronger-cybersecurity-showcase_image-7-i-5351.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ae891978abe1e901d58b28cf3786c68cac9f4661f4b984ff95f10e21afbf1161

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 31 Jan 2024 18:20:38 GMT
ETag: b048ed7878997bdb3039b571f7544a6a
Content-Type: image/jpeg
X-Timestamp: 1706725237.64327
Cache-Control: public, max-age=45778
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txa7c03ee828ab406595d3e-0065be2872dfw1
Content-Length: 59255
Expires: Wed, 07 Feb 2024 04:41:06 GMT

GET
H/1.1 200
OK how-to-add-resilience-to-todays-security-model-showcase_image-5-i-5348.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 88 KB
88 KB 47ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-to-add-resilience-to-todays-security-model-showcase_image-5-i-5348.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2a22629f693e5e719fb878d1f66253ada74073d14b34d989e1f3b757d07bc753

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 23 Jan 2024 19:20:39 GMT
ETag: 680dfacb6c9253467be5d719c91d6dd5
Content-Type: image/jpeg
X-Timestamp: 1706037638.10150
Cache-Control: public, max-age=72917
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx2884866496c047fe85380-0065bfc296dfw1
Content-Length: 90071
Expires: Wed, 07 Feb 2024 12:13:25 GMT

GET
H/1.1 200
OK how-novel-legal-maneuver-got-hospitals-stolen-data-back-showcase_image-1-i-5347.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 48 KB
48 KB 49ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-novel-legal-maneuver-got-hospitals-stolen-data-back-showcase_image-1-i-5347.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: dbc06b8f6a8ba1228029faa96f791edaaf1905a1dea7e6272dd9325d9bf1669e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 17 Jan 2024 18:17:34 GMT
ETag: bd1c87eb970b43aa7e831a6630e1ab5e
Content-Type: image/jpeg
X-Timestamp: 1705515453.67815
Cache-Control: public, max-age=85605
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx15f2cb04f521463e9735c-0065c25425dfw1
Content-Length: 48877
Expires: Wed, 07 Feb 2024 15:44:53 GMT

GET
H/1.1 200
OK xdr-benefits-managed-services-showcase_image-10-i-5346.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 55 KB
55 KB 50ms
10ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/xdr-benefits-managed-services-showcase_image-10-i-5346.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9e6a65223dc776b7830b0b553588901ae88c66bab32892139e65759b8073980d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 16 Jan 2024 18:09:16 GMT
ETag: 27056753fc36af177c0993627665a33c
Content-Type: image/jpeg
X-Timestamp: 1705428555.85624
Cache-Control: public, max-age=11376
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5f2b901ff91c4e1e877ad-0065acfe40dfw1
Content-Length: 55858
Expires: Tue, 06 Feb 2024 19:07:44 GMT

GET
H/1.1 200
OK more-ransomware-victims-declining-to-pay-extortionists-showcase_image-2-p-3559.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 86 KB
86 KB 56ms
11ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/more-ransomware-victims-declining-to-pay-extortionists-showcase_image-2-p-3559.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7f25f3e36fa11fa05c202cd2140507c5a89bcf43fd96b6848f2362ce9e35ea4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 02 Feb 2024 15:39:00 GMT
ETag: cadef24f0a125a0cb03ff7d660d7cdb1
Content-Type: image/jpeg
X-Timestamp: 1706888339.65608
Cache-Control: public, max-age=53592
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx747ee6ec7b3d4c3eb0e43-0065c0a751dfw1
Content-Length: 87708
Expires: Wed, 07 Feb 2024 06:51:20 GMT

GET
H/1.1 200
OK how-long-will-fbis-volt-tycoon-router-interdiction-stick-showcase_image-1-p-3558.jpeg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 44 KB
45 KB 54ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/how-long-will-fbis-volt-tycoon-router-interdiction-stick-showcase_image-1-p-3558.jpeg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b563caa10c1bce2d2d8554e559906a157bb36a6102cd59f32534dd75c6050dc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 01 Feb 2024 12:58:40 GMT
ETag: 8d09be77a93086e1148abf8dcf94e774
Content-Type: image/jpeg
X-Timestamp: 1706792319.94045
Cache-Control: public, max-age=43953
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx3675983796b84ab38dcf8-0065c1b156dfw1
Content-Length: 45364
Expires: Wed, 07 Feb 2024 04:10:41 GMT

GET
H/1.1 200
OK defending-against-corporate-social-media-account-takeovers-showcase_image-8-p-3557.jpeg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 31 KB
31 KB 57ms
11ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/defending-against-corporate-social-media-account-takeovers-showcase_image-8-p-3557.jpeg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9ed16a869e6dc635f5ff68dc633b32ce2ff4873c7f74beaca71991403270bc9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 31 Jan 2024 15:45:39 GMT
ETag: 35f5c875cb7b169a6f9447f159ec0e6e
Content-Type: image/jpeg
X-Timestamp: 1706715938.06998
Cache-Control: public, max-age=42038
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31367
X-Trans-Id: tx22ecd38cbf5743ada062a-0065ba852fdfw1
Expires: Wed, 07 Feb 2024 03:38:46 GMT

GET
H/1.1 200
OK weasel-words-rule-too-many-data-breach-notifications-showcase_image-2-p-3556.jpg
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/ 69 KB
70 KB 55ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com/weasel-words-rule-too-many-data-breach-notifications-showcase_image-2-p-3556.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3cc140fd4081da354be60f283433bf116f143735f1317cc5835f362c44829e8f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 25 Jan 2024 21:58:54 GMT
ETag: 777f84da3d7d254de2e7884385dad233
Content-Type: image/jpeg
X-Timestamp: 1706219933.34521
Cache-Control: public, max-age=85651
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx199dd88e234a41ce8054f-0065c25425dfw1
Content-Length: 70862
Expires: Wed, 07 Feb 2024 15:45:39 GMT

GET
H/1.1 200
OK ismg-editors-are-microsofts-systems-so-vulnerable-showcase_image-8-a-24263.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 202 KB
202 KB 20ms
16ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ismg-editors-are-microsofts-systems-so-vulnerable-showcase_image-8-a-24263.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a0f7f41a6e614d69e39bd0a870dea132a7859adf0e88c62dabe0bf3a90df8cc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 02 Feb 2024 22:52:55 GMT
ETag: e7ca304f55ad0617cac0b0daaf621bdf
Content-Type: image/jpeg
X-Timestamp: 1706914374.27655
Cache-Control: public, max-age=81125
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 206431
X-Trans-Id: tx340ec1ea83c64b50a3173-0065bd79e1dfw1
Expires: Wed, 07 Feb 2024 14:30:13 GMT

GET
H/1.1 200
OK cyber-fail-when-ransomware-gangs-get-careless-showcase_image-7-a-24264.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 295 KB
295 KB 8ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/cyber-fail-when-ransomware-gangs-get-careless-showcase_image-7-a-24264.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5593ddea78c0601873b3ca109f202cb261ffdc9b9d247438500c2c8c3b5a7f3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 02 Feb 2024 23:12:40 GMT
ETag: 6a746c0c1fc1aec2491dd034d49ffef9
Content-Type: image/jpeg
X-Timestamp: 1706915559.36335
Cache-Control: public, max-age=81127
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 301890
X-Trans-Id: tx80de9ed9423442208240b-0065bd7857dfw1
Expires: Wed, 07 Feb 2024 14:30:15 GMT

GET
H/1.1 200
OK proof-concept-how-do-we-ensure-ethical-ai-systems-showcase_image-6-a-24231.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 120 KB
120 KB 11ms
10ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/proof-concept-how-do-we-ensure-ethical-ai-systems-showcase_image-6-a-24231.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9a239336eaaec20b11b5821eedefa84951192522f883c8ee7abdd82f465e1490

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 31 Jan 2024 17:31:34 GMT
ETag: 5381f223ef2e4b65171e916500e15977
Content-Type: image/jpeg
X-Timestamp: 1706722293.27297
Cache-Control: public, max-age=43452
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122608
X-Trans-Id: txdbb4f6c6557f4f918527c-0065ba8bf9dfw1
Expires: Wed, 07 Feb 2024 04:02:20 GMT

GET
H/1.1 200
OK weaponized-lying-unraveling-ransomedvcs-business-strategy-showcase_image-8-a-24214.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 140 KB
140 KB 46ms
30ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/weaponized-lying-unraveling-ransomedvcs-business-strategy-showcase_image-8-a-24214.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 607c3280b75439b059201fb530324b36ed8eed8c3a5cd4e66ff374f5551d1d3b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 30 Jan 2024 16:46:26 GMT
ETag: 621cc14b6b7d1754849791b30a510472
Content-Type: image/jpeg
X-Timestamp: 1706633185.39703
Cache-Control: public, max-age=46965
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txabfbbadd409e4a9da5a44-0065c08d51dfw1
Content-Length: 142850
Expires: Wed, 07 Feb 2024 05:00:53 GMT

GET
H/1.1 200
OK live-webinar-utilizing-siem-mdr-for-maximum-protection-showcase_image-7-w-5404.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 67 KB
68 KB 48ms
10ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-utilizing-siem-mdr-for-maximum-protection-showcase_image-7-w-5404.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bfa019c7d05a2d35b831c4b843070397d763df4a965c59fa5ffaeae398ad0ade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 18:44:28 GMT
ETag: 7dd44ffc2735957441f5160204337d8d
Content-Type: image/jpeg
X-Timestamp: 1707158667.04616
Cache-Control: public, max-age=10281
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68866
X-Trans-Id: tx696c8fe004eb44698ed7a-0065c12e0bdfw1
Expires: Tue, 06 Feb 2024 18:49:29 GMT

GET
H/1.1 200
OK webinar-your-hybrid-cloud-under-attack-protect-zero-trust-showcase_image-5-w-5396.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 65 KB
65 KB 46ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/webinar-your-hybrid-cloud-under-attack-protect-zero-trust-showcase_image-5-w-5396.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 11fd13f8f29a24f1c6dbc2b11b911da664f3f10bebf0274994c4ea96e260b9a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 31 Jan 2024 19:51:38 GMT
ETag: 59d691b364b5b11e311a0c190f6f28c4
Content-Type: image/jpeg
X-Timestamp: 1706730697.54885
Cache-Control: public, max-age=60368
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 66498
X-Trans-Id: txc109ae6c99fa435db0657-0065bbfe32dfw1
Expires: Wed, 07 Feb 2024 08:44:16 GMT

GET
H/1.1 200
OK live-webinar-practical-approach-to-threat-detection-investigation-response-showcase_image-8-w-5212.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 23 KB
24 KB 39ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-practical-approach-to-threat-detection-investigation-response-showcase_image-8-w-5212.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: db09a654856e55907e1cd561c2181369e55465677c4f57f922b24f2121a35861

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 31 Jan 2024 01:03:43 GMT
ETag: d2c27357148d2a6d5a6250a5b716b520
Content-Type: image/jpeg
X-Timestamp: 1706663022.35572
Cache-Control: public, max-age=61678
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23797
X-Trans-Id: tx310df8ed8ab64c4bbbc40-0065b9a097dfw1
Expires: Wed, 07 Feb 2024 09:06:06 GMT

GET
H/1.1 200
OK securing-your-workforce-datto-rmm-automating-patching-hardening-backups-showcase_image-7-w-5385.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 60 KB
61 KB 45ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/securing-your-workforce-datto-rmm-automating-patching-hardening-backups-showcase_image-7-w-5385.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9b049901e9128b68e8d5e1003480f05af58204d3d3480d4511baa971f505c9b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 25 Jan 2024 23:32:44 GMT
ETag: 53475cd141e69d8f696849df0804916b
Content-Type: image/jpeg
X-Timestamp: 1706225563.40954
Cache-Control: public, max-age=33756
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx824bb93f40e04d5c9e53e-0065c1897ddfw1
Content-Length: 61638
Expires: Wed, 07 Feb 2024 01:20:44 GMT

GET
H/1.1 200
OK live-webinar-enterprise-passkey-implementations-key-considerations-tradeoffs-showcase_image-9-w-5326.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 71 KB
71 KB 20ms
19ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-enterprise-passkey-implementations-key-considerations-tradeoffs-showcase_image-9-w-5326.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7195d1e051d74dea55f4bc4081fe0d7b1bbfd397e0b182434cf1aa003624ff65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 20 Dec 2023 18:18:48 GMT
ETag: 5e1861d86e50324b9fc018d3b74a306a
Content-Type: image/jpeg
X-Timestamp: 1703096327.00469
Cache-Control: public, max-age=24857
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txd35f07a4f98f4bfe96311-0065bdadaadfw1
Content-Length: 72577
Expires: Tue, 06 Feb 2024 22:52:25 GMT

GET
H/1.1 200
OK live-webinar-supercharge-your-cmdb-realize-value-sooner-taniums-servicenow-itam-integration-in-spanish-showcase_image-6-w-5335.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 66 KB
66 KB 51ms
48ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-supercharge-your-cmdb-realize-value-sooner-taniums-servicenow-itam-integration-in-spanish-showcase_image-6-w-5335.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fa371650b1d90a4c94469bc10fddff54c01579cd5f2f30b6af280c3966e8a37f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 03 Jan 2024 17:49:06 GMT
ETag: 15d16ee6de0a33ead879d3e48833c8c4
Content-Type: image/jpeg
X-Timestamp: 1704304145.20064
Cache-Control: public, max-age=21115
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 67555
X-Trans-Id: txb33bf86158de4077b2e3b-006595c6efdfw1
Expires: Tue, 06 Feb 2024 21:50:03 GMT

GET
H/1.1 200
OK datto-presents-state-msp-showcase_image-4-w-5366.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 101 KB
101 KB 13ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/datto-presents-state-msp-showcase_image-4-w-5366.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b1a4ee7a5e63ba82563a6ba3a12281c6392ca5d81e29400926edb180042e9699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 16 Jan 2024 15:07:53 GMT
ETag: 20974657134d59a598ef1cfc8be306b8
Content-Type: image/jpeg
X-Timestamp: 1705417672.41196
Cache-Control: public, max-age=53158
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txb8cc1cbecc3f4a6aa0e78-0065af556fdfw1
Content-Length: 103200
Expires: Wed, 07 Feb 2024 06:44:06 GMT

GET
H/1.1 200
OK panel-discussion-protect-your-cloud-landscape-cost-effectively-deepwatch-splunk-aws-showcase_image-10-w-5353.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 67 KB
68 KB 12ms
11ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/panel-discussion-protect-your-cloud-landscape-cost-effectively-deepwatch-splunk-aws-showcase_image-10-w-5353.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bfa019c7d05a2d35b831c4b843070397d763df4a965c59fa5ffaeae398ad0ade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 11 Jan 2024 19:10:24 GMT
ETag: 7dd44ffc2735957441f5160204337d8d
Content-Type: image/jpeg
X-Timestamp: 1705000223.74971
Cache-Control: public, max-age=11466
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx7c3ca8720533486cbd135-0065beb9e1dfw1
Content-Length: 68866
Expires: Tue, 06 Feb 2024 19:09:14 GMT

GET
H/1.1 200
OK matthew-rosenquist-largeImage-9-a-1098.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 24 KB
25 KB 67ms
19ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/matthew-rosenquist-largeImage-9-a-1098.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ded6101d82578d3800f23d67c7a0b644f7083508800a9ecb69af2e84a5bff7a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 16 Mar 2016 19:21:21 GMT
ETag: 5875ad47812961bccb791d0fae3df9db
Content-Type: image/jpeg
X-Timestamp: 1458156080.51246
Cache-Control: public, max-age=78271
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx9a54c320a9924ad3a0086-0065be7ae0dfw1
Content-Length: 24809
Expires: Wed, 07 Feb 2024 13:42:39 GMT

GET
H/1.1 200
OK mark-gelhardt-largeImage-6-a-1850.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 58 KB
59 KB 222ms
176ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/mark-gelhardt-largeImage-6-a-1850.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7cf7d487e1d3f0a2787f1ee2aad15862dcfc7d5f6883e275680568e9e4989d9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 09 Oct 2017 16:11:13 GMT
ETag: fd5831082a5f9f78d49c9281240802b9
Content-Type: image/jpeg
X-Timestamp: 1507565472.80880
Cache-Control: public, max-age=66626
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txedd3b602f7ec43b8a8027-0065bf92b4dfw1
Content-Length: 59715
Expires: Wed, 07 Feb 2024 10:28:34 GMT

GET
H/1.1 200
OK mark-mao-largeImage-9-a-1582.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 46 KB
46 KB 116ms
67ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/mark-mao-largeImage-9-a-1582.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6cf69d813a1162f382adccdcb43ee508612a5eeb1124fcf8c0ea6a9b44dd3e20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 31 Mar 2016 15:03:26 GMT
ETag: 8aa30f9326b03050f4aeabac21f6c274
Content-Type: image/jpeg
X-Timestamp: 1459436605.90463
Cache-Control: public, max-age=68624
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx34d6920fe64a4c199a702-0065bb2e7cdfw1
Content-Length: 46835
Expires: Wed, 07 Feb 2024 11:01:52 GMT

GET
H/1.1 200
OK javvad-malik-largeImage-1-a-3979.png
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 181 KB
181 KB 53ms
11ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/javvad-malik-largeImage-1-a-3979.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 44e03ccf8839ff7356f104bb9965caeb9df84eeef9ff000da94d8bd3f3feafe8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 03 Feb 2023 14:57:27 GMT
ETag: 1f9ebabdf20ed15e8ec1abca02c60108
Content-Type: image/png
X-Timestamp: 1675436246.00352
Cache-Control: public, max-age=8898
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5b6770f870c6481db10aa-0065bb34eadfw1
Content-Length: 184904
Expires: Tue, 06 Feb 2024 18:26:26 GMT

GET
H/1.1 200
OK break-attack-chain-xdr-pdf-1-w-13340.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 205 KB
206 KB 33ms
11ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/break-attack-chain-xdr-pdf-1-w-13340.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6e59d89c803c7dd3d1b529f8539473c69112f1b5923e9e99d7e69d8ac34c25a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 07:56:26 GMT
ETag: fc8de71a7da9551f91d7e62d7abfcbcb
Content-Type: image/jpeg
X-Timestamp: 1707119785.79452
Cache-Control: public, max-age=73432
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 210385
X-Trans-Id: txc70f6c4b73074b5498b76-0065c22439dfw1
Expires: Wed, 07 Feb 2024 12:22:00 GMT

GET
H/1.1 200
OK -pdf-7-w-13337.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 163 KB
164 KB 32ms
12ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/-pdf-7-w-13337.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b4998e8eac6e6b71ba8a3b23146a3d6745d63ca54302217ba581cb4a36f4bc39

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 07:35:58 GMT
ETag: e4033559d4342763e714a596042ed8e3
Content-Type: image/jpeg
X-Timestamp: 1707118557.06639
Cache-Control: public, max-age=74298
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 167389
X-Trans-Id: txbb35c7c0d1494a4ba4225-0065c227badfw1
Expires: Wed, 07 Feb 2024 12:36:26 GMT

GET
H/1.1 200
OK essential-guide-to-mitre-attck-round-4-pdf-10-w-13339.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 93 KB
93 KB 16ms
15ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/essential-guide-to-mitre-attck-round-4-pdf-10-w-13339.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f62bc200208bf1449e4c1f8decc346e7d041cc89797d529f8dc3f61e91d0f01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 07:47:45 GMT
ETag: 41b9db83f5241df37dac5cb63fdbae57
Content-Type: image/jpeg
X-Timestamp: 1707119264.52716
Cache-Control: public, max-age=73324
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 95237
X-Trans-Id: tx782349b08dea4493be43f-0065c22439dfw1
Expires: Wed, 07 Feb 2024 12:20:12 GMT

GET
H/1.1 200
OK 2024-trending-tips-for-surviving-ransomware-pdf-10-w-13338.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 71 KB
71 KB 32ms
32ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/2024-trending-tips-for-surviving-ransomware-pdf-10-w-13338.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f9cef2361426c656474837992a2019b712582d95e55ccba23341ce9f2389ec2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 07:41:26 GMT
ETag: aa050c0bb6a01b6fd5e9423dc5db73fe
Content-Type: image/jpeg
X-Timestamp: 1707118885.46138
Cache-Control: public, max-age=74231
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 72726
X-Trans-Id: tx041f9f98ca98460fa7127-0065c227b9dfw1
Expires: Wed, 07 Feb 2024 12:35:19 GMT

GET
H/1.1 200
OK 2021-year-complexity-pdf-9-h-106.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 167 KB
168 KB 62ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/2021-year-complexity-pdf-9-h-106.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7feb9afd2b66cb0776368af51a4e74d22787d4cbe836e1d6490fc1badbd46d5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 14 Jan 2022 21:05:07 GMT
ETag: 9cea7f13e1a59b282e81257964303095
Content-Type: image/jpeg
X-Timestamp: 1642194306.07043
Cache-Control: public, max-age=64852
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx7a496591d9114417af14e-0065c202f3dfw1
Content-Length: 171288
Expires: Wed, 07 Feb 2024 09:59:00 GMT

GET
H/1.1 200
OK combatting-cybercrime-pdf-9-h-103.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 358 KB
358 KB 59ms
11ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/combatting-cybercrime-pdf-9-h-103.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7ff5b98c09ec9d2af43d4108160ea0455f91f415f83031cc79fbe24a3a765bb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 26 Nov 2019 19:37:47 GMT
ETag: 11a3adb400c0ff282a505428b1d7be73
Content-Type: image/jpeg
X-Timestamp: 1574797066.57975
Cache-Control: public, max-age=53073
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx123a18611a4c49d6aef9e-0065a41be7dfw1
Content-Length: 366322
Expires: Wed, 07 Feb 2024 06:42:41 GMT

GET
H/1.1 200
OK top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 76 KB
77 KB 61ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/top-canadian-cyber-threats-expected-in-2020-logo-9-h-102.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Unused62: 8096267
Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 28 Oct 2019 13:57:45 GMT
ETag: 69913c61181f1fc9d730d6c8298e55c4
Content-Type: image/jpeg
X-Timestamp: 1572271064.63410
Cache-Control: public, max-age=38864
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx4ff910275c2246148c1a7-0065b99be8dfw1
Content-Length: 78320
Expires: Wed, 07 Feb 2024 02:45:52 GMT

GET
H/1.1 200
OK leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/ 197 KB
198 KB 80ms
32ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com/leveraging-new-technologies-in-fraud-investigations-logo-7-h-101.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 15 Oct 2019 14:06:53 GMT
ETag: e3e068e355cdbfaa15e88b627d7ebc55
Content-Type: image/jpeg
X-Timestamp: 1571148412.42493
Cache-Control: public, max-age=10371
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx7146af2298204c909c525-0065aa8c3edfw1
Content-Length: 202154
Expires: Tue, 06 Feb 2024 18:50:59 GMT

GET
H/1.1 200
OK gaining-security-visibility-insights-throughout-identity-ecosystem-showcase_image-9-s-114.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 102 KB
103 KB 55ms
15ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/gaining-security-visibility-insights-throughout-identity-ecosystem-showcase_image-9-s-114.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a1cec7a73b7845d303d289011ccc629bad30dec4e599c12ffbd58be5175f4293

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 05 Jan 2024 20:26:00 GMT
ETag: 23a07d29a39e311ec8925dc8f8589c78
Content-Type: image/jpeg
X-Timestamp: 1704486359.17556
Cache-Control: public, max-age=68442
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5eb0da5e2e3b4c59bedae-0065a6b57edfw1
Content-Length: 104845
Expires: Wed, 07 Feb 2024 10:58:50 GMT

GET
H/1.1 200
OK key-security-challenges-tooling-approaches-for-2024-showcase_image-7-s-113.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 84 KB
85 KB 30ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/key-security-challenges-tooling-approaches-for-2024-showcase_image-7-s-113.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f785422f51f7229ba51f8b7478f504049de257e523b4de14da1781fb5c2b6c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 07 Dec 2023 16:21:54 GMT
ETag: 18751318357cfb3339c56e538475d50c
Content-Type: image/jpeg
X-Timestamp: 1701966113.48368
Cache-Control: public, max-age=62342
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx470d7782738b4afba7a99-0065b8779fdfw1
Content-Length: 86134
Expires: Wed, 07 Feb 2024 09:17:10 GMT

GET
H/1.1 200
OK fighting-fraud-financial-crime-showcase_image-4-s-112.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 202 KB
202 KB 30ms
10ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/fighting-fraud-financial-crime-showcase_image-4-s-112.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b157d1fbbb8573e80cb45c09d2ddf858dc72e751553f755c2b9d344406d77b97

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 23 Oct 2023 21:24:00 GMT
ETag: 946f745186684b1303be62398629bd08
Content-Type: image/jpeg
X-Timestamp: 1698096239.62063
Cache-Control: public, max-age=10388
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txac4d84f6af2a405db7d0a-0065ba07a0dfw1
Content-Length: 206925
Expires: Tue, 06 Feb 2024 18:51:16 GMT

GET
H/1.1 200
OK first-annual-generative-ai-study-business-rewards-vs-security-risks-showcase_image-9-s-109.jpg
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/ 130 KB
130 KB 31ms
12ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com/first-annual-generative-ai-study-business-rewards-vs-security-risks-showcase_image-9-s-109.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c2b12be678a6fa2f8518a327911d6d3f70379cc67f3853888cdee84d157071ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 06 Sep 2023 21:55:13 GMT
ETag: 09432bd6f30033b2de423cd8200f74c2
Content-Type: image/jpeg
X-Timestamp: 1694037312.59853
Cache-Control: public, max-age=83014
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txdc48a41c55284c17a2360-0065b4016fdfw1
Content-Length: 132740
Expires: Wed, 07 Feb 2024 15:01:42 GMT

GET
H/1.1 200
OK fraud-security-risk-management-summit-new-york-showcase_image-9-e-404.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 380 KB
381 KB 87ms
10ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/fraud-security-risk-management-summit-new-york-showcase_image-9-e-404.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 074c7a539b6831ab8e490eb77526c32385c0aedd230f7b58beab6f07e83b5cb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 08 Dec 2023 07:00:38 GMT
ETag: fa323995e0d19321ac4e7d57ed32bb2b
Content-Type: image/png
X-Timestamp: 1702018837.03653
Cache-Control: public, max-age=12504
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txe5995acd353c4683952f1-006579e8f5dfw1
Content-Length: 389504
Expires: Tue, 06 Feb 2024 19:26:32 GMT

GET
H/1.1 200
OK cybersecurity-implications-ai-summit-north-america-west-imageFileLarge-10-e-405.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 343 KB
344 KB 45ms
10ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/cybersecurity-implications-ai-summit-north-america-west-imageFileLarge-10-e-405.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 437860176a95945e3db394634a18e4915aef8a951a5c22300ee086d54ef754ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 07 Dec 2023 21:45:55 GMT
ETag: 3838f87849b1478a1a36bf8fa4dd368b
Content-Type: image/png
X-Timestamp: 1701985554.92681
Cache-Control: public, max-age=64867
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx3ced61c5d96c4eda8e9d3-0065c202f3dfw1
Content-Length: 351439
Expires: Wed, 07 Feb 2024 09:59:15 GMT

GET
H/1.1 200
OK cybersecurity-summit-north-america-midwest-imageFileLarge-10-e-406.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 331 KB
332 KB 48ms
23ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/cybersecurity-summit-north-america-midwest-imageFileLarge-10-e-406.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: dabc60c4db193b2b29dc19c11a766e26d7d8664b2db9817609f5d6b372dec654

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 07 Dec 2023 21:47:49 GMT
ETag: 29b8fc9ef9d788c5cab2f7a1a1a9b5d4
Content-Type: image/png
X-Timestamp: 1701985668.19250
Cache-Control: public, max-age=38524
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx72cf6d03be9a47308b07e-0065b93ed3dfw1
Content-Length: 339197
Expires: Wed, 07 Feb 2024 02:40:12 GMT

GET
H/1.1 200
OK healthcare-cybersecurity-summit-new-york-imageFileLarge-5-e-407.png
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/ 373 KB
374 KB 34ms
12ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com/healthcare-cybersecurity-summit-new-york-imageFileLarge-5-e-407.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7498bb5e0fd8361da37a2982405883bd697fb64d5467bf6bfa36aa833af4c265

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 07 Dec 2023 21:48:45 GMT
ETag: 6d8f674e15ee03826fb2fb759c7f6f70
Content-Type: image/png
X-Timestamp: 1701985724.62851
Cache-Control: public, max-age=62986
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx989ef680e4db449d905b1-0065aef8bddfw1
Content-Length: 382166
Expires: Wed, 07 Feb 2024 09:27:54 GMT

GET
H2 200 empty_menu_image.png
www.bankinfosecurity.com/images/navigation/generic/ 5 KB
5 KB 130ms
128ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images/navigation/generic/empty_menu_image.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
x-frame-options: deny
content-type: image/png
cache-control: max-age=86400, private, must-revalidate
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 5306
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK embargo-0802-301am-et-endor-labs-raises-70m-to-push-from-code-to-pipeline-defense-showcase_image-7-a-22724.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 72 KB
73 KB 20ms
20ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/embargo-0802-301am-et-endor-labs-raises-70m-to-push-from-code-to-pipeline-defense-showcase_image-7-a-22724.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 492ee0c3d23abc7bf7f07b6e3ec7022dc70ce54762569a42a2ffd845f28419a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 03 Aug 2023 00:36:33 GMT
ETag: 27bd41eb3a734927e7c3e2f5d1ed75b6
Content-Type: image/jpeg
X-Timestamp: 1691022992.39155
Cache-Control: public, max-age=74021
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx7b1837e93c914f12be519-0065bafedcdfw1
Content-Length: 73960
Expires: Wed, 07 Feb 2024 12:31:49 GMT

GET
H/1.1 200
OK rsa-conference-2023-compendium-160-interviews-more-showcase_image-8-a-22138.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 56 KB
56 KB 9ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/rsa-conference-2023-compendium-160-interviews-more-showcase_image-8-a-22138.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 441132f48c606bab601058cec5283d3268d69356c7124b04476d42207db99163

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 22 May 2023 21:09:03 GMT
ETag: f856606b199f038d193ccec767c10182
Content-Type: image/jpeg
X-Timestamp: 1684789742.23903
Cache-Control: public, max-age=66643
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txc8fa6e6b11ba47178aefd-00659b2adedfw1
Content-Length: 56844
Expires: Wed, 07 Feb 2024 10:28:51 GMT

GET
H/1.1 200
OK pulling-covers-off-secret-sprawl-to-reduce-risk-showcase_image-4-a-21921.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 128 KB
128 KB 76ms
63ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/pulling-covers-off-secret-sprawl-to-reduce-risk-showcase_image-4-a-21921.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7baaef85b1c6761ac939c7dc62d8cdd899f179113d7a1f55925dc82c15bba0b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 02 May 2023 11:25:08 GMT
ETag: 417dd3ccb914ec05ef9004d49802c9cf
Content-Type: image/jpeg
X-Timestamp: 1683026707.37529
Cache-Control: public, max-age=66654
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txc7d179af43654dd6bdc99-0065abc964dfw1
Content-Length: 130922
Expires: Wed, 07 Feb 2024 10:29:02 GMT

GET
H/1.1 200
OK detecting-mitigating-fraud-through-trust-building-showcase_image-2-a-21864.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 175 KB
176 KB 21ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/detecting-mitigating-fraud-through-trust-building-showcase_image-2-a-21864.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d8b70e292d312ceb95a91962382d246c54ef08ccb92adb4e0f7f96a426f6d922

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 27 Apr 2023 00:16:14 GMT
ETag: 4fb2741b4f24b46eea088fb6e2acee8b
Content-Type: image/jpeg
X-Timestamp: 1682554573.29034
Cache-Control: public, max-age=13402
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx40b7028cd9274656b95ba-0065a367cddfw1
Content-Length: 179702
Expires: Tue, 06 Feb 2024 19:41:30 GMT

GET
H/1.1 200
OK infosec-europe-2019-compendium-imageFile-2-a-12739.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 89 KB
89 KB 81ms
78ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/infosec-europe-2019-compendium-imageFile-2-a-12739.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4546d13ea9bae9935dcd23f61d215a528120a53479bf51e372de3420029ed535

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 05 Jul 2019 20:13:34 GMT
ETag: f9dab7917669551bb50361c2dcd43aa7
Content-Type: image/jpeg
X-Timestamp: 1562357613.59432
Cache-Control: public, max-age=64827
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx3d017d8e885d420aa6a95-0065badd1cdfw1
Content-Length: 91187
Expires: Wed, 07 Feb 2024 09:58:35 GMT

GET
H/1.1 200
OK improving-iot-risk-management-showcase_image-10-a-12689.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 60 KB
61 KB 26ms
24ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/improving-iot-risk-management-showcase_image-10-a-12689.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6ec9288103b5919c36e28909faf04364cdf19cf7687e234663d0d9daab65a3c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 28 Jun 2019 14:04:32 GMT
ETag: 7f5fdd9cf37f980ea13c12c231815e13
Content-Type: image/jpeg
X-Timestamp: 1561730671.53151
Cache-Control: public, max-age=36708
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txbcfa26686d6c42cb8ebf9-00656311dcdfw1
Content-Length: 61807
Expires: Wed, 07 Feb 2024 02:09:56 GMT

GET
H/1.1 200
OK gdpr-where-do-we-go-from-here-showcase_image-1-a-12681.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 62 KB
62 KB 19ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/gdpr-where-do-we-go-from-here-showcase_image-1-a-12681.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8bc7f122cae9e9efd75cd58076d06fb057d8f50abf07ffc1716e17d87682b9cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 25 Jun 2019 19:30:48 GMT
ETag: bba47bed092092a1c82b09a86a3a0e40
Content-Type: image/jpeg
X-Timestamp: 1561491047.60933
Cache-Control: public, max-age=67206
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txde53388f925e4281aba50-0065b03474dfw1
Content-Length: 63007
Expires: Wed, 07 Feb 2024 10:38:14 GMT

GET
H/1.1 200
OK reinventing-application-security-showcase_image-10-a-12671.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 53 KB
53 KB 10ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/reinventing-application-security-showcase_image-10-a-12671.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4179815331b1b050e45da1ccf1d1a8cb50904e1cbb92228b32d55d545d4aaf7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 25 Jun 2019 19:54:35 GMT
ETag: 89521d60b07d7e85acabbf0301821f45
Content-Type: image/jpeg
X-Timestamp: 1561492474.52472
Cache-Control: public, max-age=9402
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5841effac5f04d9095b4c-0065becaa1dfw1
Content-Length: 54026
Expires: Tue, 06 Feb 2024 18:34:50 GMT

GET
H/1.1 200
OK spear-phishing-campaign-distributes-nim-based-malware-showcase_image-1-a-16176.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 107 KB
107 KB 443ms
432ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/spear-phishing-campaign-distributes-nim-based-malware-showcase_image-1-a-16176.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ee84bb98f48cc5ad6dec84ddd7451861266d743a610be9c5d605c5dac95ddf5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 12 Mar 2021 20:37:23 GMT
ETag: f4a45bb54d2091bc72e50a0f480a8460
Content-Type: image/jpeg
X-Timestamp: 1615581442.05070
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 109215
X-Trans-Id: txe9d290ee3ef045ddb4aa9-0065c25710dfw1
Expires: Wed, 07 Feb 2024 15:58:08 GMT

GET
H/1.1 200
OK prajeet-nair-largeImage-5-a-3483.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 45 KB
45 KB 71ms
71ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/prajeet-nair-largeImage-5-a-3483.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5a2dcc98890f7760ad225371f7267d1320deb196ab8452535c4e0fd00c2f6a70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 02 Jul 2020 13:13:58 GMT
ETag: 59dd8613ef975203b55fd7f79768a252
Content-Type: image/jpeg
X-Timestamp: 1593695637.87942
Cache-Control: public, max-age=11072
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx0b3b119dd51c48c59709c-0065becc9edfw1
Content-Length: 45594
Expires: Tue, 06 Feb 2024 19:02:40 GMT

GET
H/1.1 200
OK understanding-human-behavior-tackling-ato-fraud-prevention-challenge-showcase_image-8-a-18818.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 73 KB
73 KB 31ms
31ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/understanding-human-behavior-tackling-ato-fraud-prevention-challenge-showcase_image-8-a-18818.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 78b999dc2ab7a8d2dd68affa1ec5e3ed00765db647013b8e673dd6f20e5e4b0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 30 Mar 2022 21:10:44 GMT
ETag: 154391267042322afa51f77dfd1981b4
Content-Type: image/jpeg
X-Timestamp: 1648674643.27164
Cache-Control: public, max-age=26823
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txb9e8f942215a402680529-0065a47884dfw1
Content-Length: 74807
Expires: Tue, 06 Feb 2024 23:25:11 GMT

GET
H/1.1 200
OK live-webinar-securing-business-growth-road-to-247-detection-response-showcase_image-1-w-3534.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 93 KB
93 KB 225ms
225ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-securing-business-growth-road-to-247-detection-response-showcase_image-1-w-3534.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 97fede359991df79883efa68e75db4c07d30dd92107a4b8c1e9147b4c159f2f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 04 Oct 2021 19:44:30 GMT
ETag: c49707df3c71b9069dd3b7c9464d7e42
Content-Type: image/jpeg
X-Timestamp: 1633376669.40466
Cache-Control: public, max-age=70053
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx2752c27163f44f79bd353-0065b4d9fcdfw1
Content-Length: 94991
Expires: Wed, 07 Feb 2024 11:25:41 GMT

GET
H/1.1 200
OK panel-discussion-preventing-identity-fraud-road-ahead-for-financial-services-showcase_image-5-w-3199.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 102 KB
103 KB 17ms
17ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/panel-discussion-preventing-identity-fraud-road-ahead-for-financial-services-showcase_image-5-w-3199.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 257f20a7e3386e3ac34f490d9e80a8ba92f1970673f68b6e59f3e462cb0f10bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 07 May 2021 17:05:11 GMT
ETag: 3eed666d8a8f6592b4089188bcf38a50
Content-Type: image/jpeg
X-Timestamp: 1620407110.96892
Cache-Control: public, max-age=39750
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txd1ef495e0fe6417d98acb-0065aef00bdfw1
Content-Length: 104928
Expires: Wed, 07 Feb 2024 03:00:38 GMT

GET
H/1.1 200
OK protect-brand-online-fraud-cryptocurrency-scams-showcase_image-1-i-4885.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 121 KB
122 KB 46ms
46ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/protect-brand-online-fraud-cryptocurrency-scams-showcase_image-1-i-4885.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ee4e31761269d7e3895fbd3d324c99b585a662dd95c69c9845c0732876024b50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 27 Apr 2021 18:16:51 GMT
ETag: 42587a6f9b109936cb2a7ad9c16d843d
Content-Type: image/jpeg
X-Timestamp: 1619547410.46285
Cache-Control: public, max-age=53514
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txccc6ccbc5e9b48a688947-0065bf6002dfw1
Content-Length: 124129
Expires: Wed, 07 Feb 2024 06:50:02 GMT

GET
H/1.1 200
OK delving-deeper-2023-fraud-insights-end-year-report-pdf-9-w-13089.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 216 KB
216 KB 18ms
18ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/delving-deeper-2023-fraud-insights-end-year-report-pdf-9-w-13089.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 06956375a31351710d06ae9985d2005d690e85f20ae2de378551a935a25c2807

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 21 Nov 2023 13:11:13 GMT
ETag: eed48465a504e071c7921a4002e7fa1b
Content-Type: image/jpeg
X-Timestamp: 1700572272.44282
Cache-Control: public, max-age=51583
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx574ccfd78d854e55ac1e9-0065bce81ddfw1
Content-Length: 221083
Expires: Wed, 07 Feb 2024 06:17:51 GMT

GET
H/1.1 200
OK scams-mule-defense-real-time-scam-prevention-advanced-money-mule-detection-pdf-10-w-12892.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 284 KB
284 KB 12ms
12ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/scams-mule-defense-real-time-scam-prevention-advanced-money-mule-detection-pdf-10-w-12892.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b3505df227de2cb4b76ceb42b3f7073b39487a9215f051d40420b7cb06e9174d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 27 Oct 2023 18:41:31 GMT
ETag: 4a9b2c343718dd9a9742120265721ecf
Content-Type: image/jpeg
X-Timestamp: 1698432090.54193
Cache-Control: public, max-age=25047
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx2bd21c98ad4140aaa8a76-0065ba0907dfw1
Content-Length: 290525
Expires: Tue, 06 Feb 2024 22:55:35 GMT

GET
H/1.1 200
OK buyers-guide-to-security-validation-pdf-7-w-13259.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 158 KB
159 KB 25ms
25ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/buyers-guide-to-security-validation-pdf-7-w-13259.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ad74f3a3150b7ab51dea8b012260d62049ab69cefe6e57c1d6a9523627e58962

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 24 Jan 2024 16:04:09 GMT
ETag: a5fe6f063213b449debbbaa97ceecc97
Content-Type: image/jpeg
X-Timestamp: 1706112248.89098
Cache-Control: public, max-age=66508
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 162063
X-Trans-Id: tx0535406ea00c40d7a4ce7-0065b158a3dfw1
Expires: Wed, 07 Feb 2024 10:26:36 GMT

GET
H/1.1 200
OK live-webinar-cyber-risk-graph-solving-data-problem-proactive-security-showcase_image-6-w-5368.png
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 326 KB
326 KB 9ms
9ms Image
image/png 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/live-webinar-cyber-risk-graph-solving-data-problem-proactive-security-showcase_image-6-w-5368.png
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0128a2b84715955d6423533d55f49ac694734e26e11c4cbac84b41b5e3dcf826

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 17 Jan 2024 21:54:23 GMT
ETag: 808dc7d38bc0c5759e016ece70d2a086
Content-Type: image/png
X-Timestamp: 1705528462.31343
Cache-Control: public, max-age=69383
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx7412ff84c8d6494a8f8bf-0065baefebdfw1
Content-Length: 333747
Expires: Wed, 07 Feb 2024 11:14:31 GMT

GET
H/1.1 200
OK looking-towards-2024-global-trends-in-aml-financial-crimes-compliance-pdf-10-w-12451.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 235 KB
235 KB 9ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/looking-towards-2024-global-trends-in-aml-financial-crimes-compliance-pdf-10-w-12451.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 70ce461c5a6d2ddc752ae244d38be0a4c760999306c7ffdec80206bd841d698a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 12 Sep 2023 04:26:22 GMT
ETag: 23bcc43e1cf109aea2da479f8346e571
Content-Type: image/jpeg
X-Timestamp: 1694492781.22669
Cache-Control: public, max-age=8527
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 240361
X-Trans-Id: txd9498b607ffa46f6bdfc6-0065adc27adfw1
Expires: Tue, 06 Feb 2024 18:20:15 GMT

GET
H/1.1 200
OK guess-who-no-more-how-to-unlock-power-identity-graphs-for-fraud-prevention-showcase_image-8-w-3776.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 217 KB
217 KB 58ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/guess-who-no-more-how-to-unlock-power-identity-graphs-for-fraud-prevention-showcase_image-8-w-3776.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 09bbed0d4841d1b1b5df95504ef8e54d487ec069ef30a3166888201e0477d82e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 08 Feb 2022 19:21:33 GMT
ETag: 7364ae801d83423bf9f10b04e2bc537b
Content-Type: image/jpeg
X-Timestamp: 1644348092.41709
Cache-Control: public, max-age=78897
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx386ed78c965441bab6aa0-0065bb0c3cdfw1
Content-Length: 221713
Expires: Wed, 07 Feb 2024 13:53:05 GMT

GET
H/1.1 200
OK app-api-protection-securing-your-sites-apps-apis-infrastructure-showcase_image-4-w-4323.jpg
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/ 146 KB
146 KB 76ms
26ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com/app-api-protection-securing-your-sites-apps-apis-infrastructure-showcase_image-4-w-4323.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 48f162f20cd96a323eb9b6d71a77d7223dd33f03422ebe8c9a938873b00a4977

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Wed, 07 Sep 2022 08:58:46 GMT
ETag: 9e44b6a39fcc1ae495a2c9d900c671df
Content-Type: image/jpeg
X-Timestamp: 1662541125.72633
Cache-Control: public, max-age=40664
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx04dae42cd3a24e0bb2953-00657dcb32dfw1
Content-Length: 149129
Expires: Wed, 07 Feb 2024 03:15:52 GMT

GET
H/1.1 200
OK fog-war-how-ukraine-conflict-transformed-cyber-threat-landscape-pdf-8-w-12183.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 185 KB
186 KB 62ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/fog-war-how-ukraine-conflict-transformed-cyber-threat-landscape-pdf-8-w-12183.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c5ba82a495ae1dd01b002d056b460cfbe0e6d39a3622b8297eb612f8326141ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Sun, 25 Jun 2023 14:26:32 GMT
ETag: d8fb89eddd6fec75b007bc67e689c2fd
Content-Type: image/jpeg
X-Timestamp: 1687703191.22357
Cache-Control: public, max-age=14392
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txc40614e1d8bb4764aa26d-0065bb3537dfw1
Content-Length: 189740
Expires: Tue, 06 Feb 2024 19:58:00 GMT

GET
H/1.1 200
OK ransomware-third-parties-comprehensive-guide-to-protecting-your-organization-from-this-growing-threat-pdf-2-w-8878.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 244 KB
245 KB 60ms
10ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ransomware-third-parties-comprehensive-guide-to-protecting-your-organization-from-this-growing-threat-pdf-2-w-8878.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0d89a31166d19c272c345350a29db0adf773a40ca80277d37d0c2c5001e5f458

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 21 Sep 2021 15:12:25 GMT
ETag: 65d1ce029f543a8e004acc9915cf2e2c
Content-Type: image/jpeg
X-Timestamp: 1632237144.26550
Cache-Control: public, max-age=11484
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx2ade683baef44f0095598-0065c001e1dfw1
Content-Length: 250235
Expires: Tue, 06 Feb 2024 19:09:32 GMT

GET
H/1.1 200
OK javascript-blockchain-technologies-you-cant-ignore-pdf-4-w-4323.jpg
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/ 242 KB
242 KB 64ms
15ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com/javascript-blockchain-technologies-you-cant-ignore-pdf-4-w-4323.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bbbd7bccd313fafa0275f24bb6c30268a0f26f668894cf2ac68a664d95a962f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 10 May 2018 20:39:34 GMT
ETag: a1abea62e815280443173bebee773666
Content-Type: image/jpeg
X-Timestamp: 1525984773.18562
Cache-Control: public, max-age=17027
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5985e81b19964a0cb82fd-0065b42135dfw1
Content-Length: 247335
Expires: Tue, 06 Feb 2024 20:41:55 GMT

GET
H/1.1 200
OK fraudsters-deepfake-entire-meeting-swindle-255m-showcase_image-9-a-24273.jpg
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/ 122 KB
122 KB 10ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/fraudsters-deepfake-entire-meeting-swindle-255m-showcase_image-9-a-24273.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7e31fb7e7c8fa01e6b89b3cfb109953e431aedc41c61b8d43429fade2af6b670

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 05 Feb 2024 19:47:54 GMT
ETag: b0e6450d89e77be74841368c9c7af701
Content-Type: image/jpeg
X-Timestamp: 1707162473.50666
Cache-Control: public, max-age=18869
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 124423
X-Trans-Id: txcdf84418342f47cba88ed-0065c14f67dfw1
Expires: Tue, 06 Feb 2024 21:12:37 GMT

GET
H/1.1 200
OK how-one-university-beefing-up-cyber-defenses-programs-steve-zuromski-showcase_image-6-i-5333.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 104 KB
105 KB 30ms
29ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-one-university-beefing-up-cyber-defenses-programs-steve-zuromski-showcase_image-6-i-5333.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2ec26a5eb530593b66ae9cec229283e264adf8da95f880438f44a05773a70d7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 18 Dec 2023 21:54:51 GMT
ETag: 55464154f6626ca8872c2c354f0e8464
Content-Type: image/jpeg
X-Timestamp: 1702936490.51072
Cache-Control: public, max-age=10326
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx5c48b68264c54582b499f-0065b6773adfw1
Content-Length: 106679
Expires: Tue, 06 Feb 2024 18:50:14 GMT

GET
H/1.1 200
OK my-health-my-data-act-compliance-top-considerations-showcase_image-5-i-5309.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 51 KB
51 KB 14ms
13ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/my-health-my-data-act-compliance-top-considerations-showcase_image-5-i-5309.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4c1d40bbc07ff06b281dd7b94d81c865fd19555a8722a2821adb24b4ba9ba632

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 17 Oct 2023 20:10:36 GMT
ETag: 911a34fbe25d7cdf5144fc3ea4a5e209
Content-Type: image/jpeg
X-Timestamp: 1697573435.45904
Cache-Control: public, max-age=13308
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx58f50b561087438aa2dec-0065bda202dfw1
Content-Length: 52144
Expires: Tue, 06 Feb 2024 19:39:56 GMT

GET
H/1.1 200
OK how-merck-case-shapes-future-cyber-insurance-showcase_image-1-i-5345.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 53 KB
53 KB 30ms
30ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-merck-case-shapes-future-cyber-insurance-showcase_image-1-i-5345.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8a09d82bb8de2c031e4d69743fb3c693add896cc4fff7d741ebb0d8aff0f3d20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Thu, 11 Jan 2024 18:43:09 GMT
ETag: 412be2a92b2c2658dd91957f378ef673
Content-Type: image/jpeg
X-Timestamp: 1704998588.62737
Cache-Control: public, max-age=47032
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx34ac5a3896b544e4931bb-0065bf5c24dfw1
Content-Length: 54258
Expires: Wed, 07 Feb 2024 05:02:00 GMT

GET
H/1.1 200
OK getting-smarter-about-ai-llms-showcase_image-6-i-5334.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 46 KB
46 KB 49ms
36ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/getting-smarter-about-ai-llms-showcase_image-6-i-5334.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 45bed7b536973adb285bd15e4fdb6d6fd9b316c0ca9bd070c1721616901e50e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Tue, 26 Dec 2023 20:59:45 GMT
ETag: cd33057f8edbb71ceb6f40358a348107
Content-Type: image/jpeg
X-Timestamp: 1703624384.32479
Cache-Control: public, max-age=60990
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx2fcaaf0033624cab8788d-0065b49529dfw1
Content-Length: 46786
Expires: Wed, 07 Feb 2024 08:54:38 GMT

GET
H/1.1 200
OK how-clinicians-are-using-ai-for-communicating-patients-george-gaddie-carlos-clark-showcase_image-7-i-5332.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 95 KB
95 KB 18ms
9ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/how-clinicians-are-using-ai-for-communicating-patients-george-gaddie-carlos-clark-showcase_image-7-i-5332.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f690e65670c87845e14e1a74c68e746ba0a479bb363a04fe4d0da2db5dccb10b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 18 Dec 2023 15:42:10 GMT
ETag: 515412f619d4fff985e212d88493d363
Content-Type: image/jpeg
X-Timestamp: 1702914129.83461
Cache-Control: public, max-age=69074
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txe8e5344ce4734383944e3-0065c21362dfw1
Content-Length: 97226
Expires: Wed, 07 Feb 2024 11:09:22 GMT

GET
H/1.1 200
OK fighting-ai-fueled-attacks-ai-based-cyber-tools-troy-hawes-showcase_image-5-i-5331.jpg
0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/ 67 KB
68 KB 47ms
44ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/fighting-ai-fueled-attacks-ai-based-cyber-tools-troy-hawes-showcase_image-5-i-5331.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2de02d03fe17f1ba92947096633b6b947125174fa92b2ee4ce83f40026ba72e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Mon, 18 Dec 2023 17:26:45 GMT
ETag: cd5c785632e1110235c67b9e2c0b2c75
Content-Type: image/jpeg
X-Timestamp: 1702920404.06411
Cache-Control: public, max-age=67865
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx8fca9d855ed743ec92355-0065c20ed1dfw1
Content-Length: 68922
Expires: Wed, 07 Feb 2024 10:49:13 GMT

GET
H2 200 logo-ismg-with-text.png
www.bankinfosecurity.com/images-responsive/ 4 KB
4 KB 129ms
128ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logo-ismg-with-text.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
x-frame-options: deny
content-type: image/png
cache-control: max-age=86400, private, must-revalidate
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 4419
x-xss-protection: 1; mode=block

GET
H2 200 logo-ismg-print.png
www.bankinfosecurity.com/images-responsive/ 5 KB
5 KB 133ms
132ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images-responsive/logo-ismg-print.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
x-frame-options: deny
content-type: image/png
cache-control: max-age=86400, private, must-revalidate
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 5575
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK ondemand-preview-w-255.jpg
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ 56 KB
57 KB 59ms
8ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3059f92e36a564c5cbcedc195f764e3c55c8cf919c84129c5f202870e7026b61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 05 Jul 2013 12:55:26 GMT
ETag: 7aece0902995efedc289b7c24037434b
Content-Type: image/jpeg
X-Timestamp: 1373028925.94439
Cache-Control: public, max-age=118
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx611ebf259ec249c187cab-0065c22e5bdfw1
Content-Length: 57633
Expires: Tue, 06 Feb 2024 16:00:06 GMT

GET
H/1.1 200
OK ron-ross-smallImage-a-558.jpg
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ 10 KB
11 KB 27ms
27ms Image
image/jpeg 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com/ron-ross-smallImage-a-558.jpg
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9c8bb391a723e088d163b560afa73f709c42a69df5647c4fefce9d16e4226895

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 01 Nov 2013 13:09:25 GMT
ETag: fac8c56390d084c4f1dfaa9b24a58c33
Content-Type: image/jpeg
X-Timestamp: 1383311364.81114
Cache-Control: public, max-age=20360
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: tx97cf7f053d994b1ebe9df-0065aae6ccdfw1
Content-Length: 10640
Expires: Tue, 06 Feb 2024 21:37:28 GMT

GET
H2 200 main.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 42 KB
10 KB 325ms
325ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/main.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

8949f4df9776d1bd31694cc9f2c38ea0c5d8d3ecac95380a5afc08adc2ff96bb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 media-transcript-navigation.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 26 KB
7 KB 129ms
128ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/media-transcript-navigation.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 bis-hdr.r1.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 1 KB
485 B 128ms
127ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.r1.js?s=1707235007.9954

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

9a13fb5949ace41b41f2baafd0749b4a9e3b98a86082246980d785c0f0e2f494

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 449
x-xss-protection: 1; mode=block

GET
H2 200 jquery.browser.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 2 KB
1 KB 137ms
132ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/jquery.browser.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

0037005ca3e7cad32331724064278a8cfc3915a31eab50eb1e074f97fe9902a6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 1026
x-xss-protection: 1; mode=block

GET
H2 200 jquery.prettyPhoto.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 23 KB
6 KB 139ms
134ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/jquery.prettyPhoto.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

c4309cf270cbc7d300e797f598b5c2f504d2b59ea5894bd7b9fad38528b2f8ab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:48 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
x-xss-protection: 1; mode=block

POST
H2 200 ismg-user-ip Show response
worker.ismgcorp.com/ 12 B
305 B 561ms
145ms XHR
text/html 104.130.251.6
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://worker.ismgcorp.com/ismg-user-ip

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1707235007.9954

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.130.251.6 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

d7299f53c4e3975280f5d8e9245bb5404f203f29b5313288e32f50e1f2a05ceb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:54:17 GMT
referrer-policy: no-referrer-when-downgrade
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, private
content-length: 12
x-xss-protection: 1; mode=block

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 96 KB
29 KB 68ms
48ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3dd4aead24e892b4fdcc7d50da8ef64ee5f6444327ac476ab85172577649cef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29388
x-xss-protection: 0
server: cafe
etag: 640 / 19759 / m202402010101 / config-hash: 6685536330055691378
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 42ms
9ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1707235007.9954
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 204 KB
68 KB 49ms
27ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c637139f15a428e7535c715251f673a5ca6066d26e302ea7e17f5b4732ee8c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69788
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 115 KB
45 KB 38ms
19ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T8C2JFW

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bb5dbe79a895b0ffc0bc472eb3a337b2e645a738fc13fa539829d477574e1363

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45188
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 35ms
15ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bankinfosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:59:51 GMT
x-content-type-options: nosniff
age: 593897
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:59:51 GMT

GET
H2 200 fontawesome-webfont.woff
www.bankinfosecurity.com/css-responsive/fonts/ 43 KB
43 KB 130ms
130ms Font
font/woff 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/css-responsive/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1707235007.9954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bankinfosecurity.com/css-responsive/vendor/font-awesome.min.css?s=1707235007.9954
Origin: https://www.bankinfosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Tue, 06 Feb 2024 12:23:16 GMT
date: Tue, 06 Feb 2024 15:56:48 GMT
etag: "s8fp2sya8"
x-frame-options: deny
content-type: font/woff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 44432
x-xss-protection: 1; mode=block

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/12567/ 302 B
634 B 75ms
75ms Script
text/javascript 2600:9000:2449:b000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/12567/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/12567/code/&publishedOn=Thu%20Oct%2026%2000:57:53%20GMT%202023&ClientID=923&PageID=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2449:b000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: a817a6678bf83733f484e02dd5dcc010b15d56b160f04724045de22644858557

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
via: 1.1 c88ca2a75ca16a71cee4beefb2f6e6b8.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS58-P6
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
content-length: 302
x-amz-cf-id: PkR5jj49SNbJxg3KULZrTRJ0clwbMgoMjNsV1JITvChXIIecx2sCtw==
expires: Tue, 06 Feb 2024 15:58:07 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
50 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.bankinfosecurity.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 16:03:55 GMT
x-content-type-options: nosniff
age: 604453
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50296
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 16:03:55 GMT

GET ondemand-preview-w-255.mp4
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ 0
0

GET
H2 200 64270ee65d783b00125f1b83.js Show response
buttons-config.sharethis.com/js/ 521 B
965 B 433ms
358ms Script
text/javascript 2600:9000:26bf:2c00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/64270ee65d783b00125f1b83.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:26bf:2c00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:09 GMT
via: 1.1 1cc3fb840bf0d635b4ec2fb2c19ca094.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 31 Mar 2023 17:48:50 GMT
server: AmazonS3
x-amz-cf-pop: LHR5-P1
x-amz-server-side-encryption: AES256
etag: "b1b92dd067a349c8db8fab212b24e99e"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 521
x-amz-cf-id: 1XGjDGcl-siR7dbwPRvGOw2Zo7R3N606KNmbCQNf_xWNOLbaK-xlZw==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
411 B 49ms
13ms XHR
text/plain 3.70.37.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=www.bankinfosecurity.com&location=%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&product=inline-share-buttons&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&cms=unknown&publisher=64270ee65d783b00125f1b83&sop=true&version=st_sop.js&lang=en&description=An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help&ua=&ua_mobile=false&ua_full_version_list=&uuid=a9002a06-9489-4a2c-8bb2-7e2e205e76c7

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.70.37.50 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-70-37-50.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3 200 d3d14424fac71699bdbff068d9b1184b.js Show response
nexus.ensighten.com/choozle/12567/code/ 2 KB
803 B 14ms
14ms Script
application/javascript 2600:9000:2449:b000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/12567/code/d3d14424fac71699bdbff068d9b1184b.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/12567/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:2449:b000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 23:08:39 GMT
x-amz-version-id: ACrGVhvD9Z.vDoBABfgFbXyniOSHFx8V
content-encoding: br
via: 1.1 9dba3ae645587c3cf23f9d232c9cb4e8.cloudfront.net (CloudFront)
age: 4639770
x-amz-cf-pop: AMS58-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 26 Oct 2023 00:58:08 GMT
server: CloudFront
etag: W/"e8e93310d35a9462151b8fdab5b436ce"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: cpXxF1E8vd8n2VvM7u07eNTdfPAP7uM_8JoEk0UkNo35IkxK1o33jQ==

GET
H/1.1 200
OK embed.js Show response
bankinfosecurity.disqus.com/ 79 KB
26 KB 52ms
8ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://bankinfosecurity.disqus.com/embed.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

6a04372ebed54f17b93d9ae4c22427985129d4c1781b319a5fadfc07fb6bd60c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 81
Vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 26119

GET
H2 200 tag.aspx Show response
ml314.com/ 31 KB
10 KB 41ms
7ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?612024
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b2fe03efc1e879c2c5bd27bf86f71ad3790b0d6765498480f4c8071fa7f59051

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:24:38 GMT
via: 1.1 google
content-encoding: br
age: 2010
x-guploader-uploadid: ABPtcPoGQ2N40oa82tSEnoibjCn_QIJLlP3m7kl9ouv5DBDqcNtr7IYLJWJRhCKhN5g2RvDQ2_NKqWmOGA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10218
last-modified: Mon, 18 Dec 2023 20:13:43 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-hash: crc32c=P2fgBQ==, md5=IwpC9BBrIFbFRmT73giztw==
x-goog-generation: 1702930423872068
content-language: en
content-type: application/javascript
cache-control: public,max-age=3600
x-cache-hit: hit
x-goog-stored-content-length: 32241
accept-ranges: bytes
cache-id: FRA-fa985ced

GET
H2 200 insight.min.js Show response
sjs.bizographics.com/ 43 KB
16 KB 308ms
13ms Script
application/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs.bizographics.com/insight.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jan 2024 14:42:29 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=38957
accept-ranges: bytes
content-length: 15732

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 43 KB
16 KB 80ms
31ms Script
application/javascript 2a02:26f0:480:f::213:7edd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jan 2024 14:42:29 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=26403
accept-ranges: bytes
content-length: 15732

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 39ms
8ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H/1.1 200
OK 2682.js Show response
dnn506yrbagrg.cloudfront.net/pages/scripts/0021/ 309 B
822 B 48ms
13ms Script
application/x-javascript 13.32.23.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?474231
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-57.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Mon, 15 May 2023 01:12:40 GMT
Via: 1.1 6c7a5d26be7fb35284e54d321f16b6f6.cloudfront.net (CloudFront)
Last-Modified: Tue, 03 Mar 2020 19:14:28 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-C2
Age: 23121928
ETag: "53b0291ca3900aca920ad48e9790c1b7"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 309
X-Amz-Cf-Id: gYxoMM8I2ql2y7fVDz9t6LYiGaoJAsIl0QJ7XjZT5Gyi9Y2yj4XP4w==

GET
H/1.1 206
Partial Content ondemand-preview-w-255.mp4
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ 4 MB
0 19ms
19ms Media
video/mp4 23.36.233.236
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.mp4
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.36.233.236 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-36-233-236.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://www.bankinfosecurity.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Last-Modified: Fri, 05 Jul 2013 12:56:36 GMT
ETag: e5d65b36cc2f1ee7de6cc53cd6609280
Content-Type: video/mp4
Content-Range: bytes 0-10621769/10621770
X-Timestamp: 1373028995.98411
Cache-Control: public, max-age=711
Connection: keep-alive
Accept-Ranges: bytes
X-Trans-Id: txdd9a068b6c7e4f37b2d81-0065b11597dfw1
Content-Length: 10621770
Expires: Tue, 06 Feb 2024 16:09:59 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 52ms
51ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Thu, 16 May 2024 15:58:08 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/ 436 KB
137 KB 40ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b00ed7ac792010cdeddcb5d6c719ff7e719e5046dedac2053b3caf64fceb579a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 14:48:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4170
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139580
x-xss-protection: 0
server: cafe
etag: 9278201123426970819
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 05 Feb 2025 14:48:38 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 69 B
590 B 76ms
44ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bankinfosecurity.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74f6149451e9771ff198839c50988e2edb5f7e191eea16c7ed01fa0120f7c50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48
x-xss-protection: 0
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 244 KB
84 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9a79f5111b6cf3429bd269120dd56499ef9e94f11d008e0c98c29dedd1b7a81d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86399
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
80 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6KM3T

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

da00e3e9fa1fb6356a9997d4794f010da2ce6072a9555abc3e2d219856425ae5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82182
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 i5wta0dq65 Show response
www.clarity.ms/tag/ 650 B
1014 B 204ms
149ms Script
application/x-javascript 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/i5wta0dq65
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ff193e26084aece1f313a6a6c20794fa4e549b57b849b528224e0ecefff7fd1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: -1
date: Tue, 06 Feb 2024 15:58:08 GMT
x-azure-ref: 20240206T155808Z-9mzbc703f52nx9uq0042gsgzh000000006eg00000001ceeb
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 650
request-context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H2 200 utsync.ashx Show response
ml314.com/ 62 B
254 B 49ms
48ms Script
application/javascript 34.117.77.79
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=57819&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pv=1707235088466_xlt5iha6g&bl=en-us&cb=1492962&return=&ht=&d=&dc=&si=1707235088466_xlt5iha6g&cid=&s=1600x1200&rp=&v=2.5.5.72
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?612024
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 79.77.117.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/javascript
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 34 B
496 B 499ms
162ms Script
application/javascript 52.3.3.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=612024&v=2.5.5.72
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?612024
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.3.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-3-203.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b05b9ee987ebc7a1401b1f8d13f08664eaaddbff5f5abf456d4171ce63175cf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public
Connection: keep-alive
Content-Length: 152
Expires: Wed, 07 Feb 2024 15:58:08 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
200 B 19ms
10ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 35 B
340 B 54ms
9ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d7c0ed829f0d3b7b030b784ea0cbdd00bba9b9d9e1081586ebc9d4a563df3ea7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.bankinfosecurity.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:20:3a00:1011:5aa:abb8:3818
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707235088516_34901612_90399509_33_825_6_15_219";dur=1
content-length: 35
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 209ms
207ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 208ms
208ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%228cde4267f2ac828e1ae5d1fbcd5ef992%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%227207ef3e32cb3a527876a3e90b6bf51dbd9d9339%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
200 B 17ms
11ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 35 B
339 B 50ms
9ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d7c0ed829f0d3b7b030b784ea0cbdd00bba9b9d9e1081586ebc9d4a563df3ea7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.bankinfosecurity.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:20:3a00:1011:5aa:abb8:3818
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707235088500_34901612_90399508_35_822_6_0_219";dur=1
content-length: 35
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 2682.js Show response
script.crazyegg.com/pages/scripts/0021/ 6 KB
2 KB 83ms
49ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0021/2682.js
Requested by: Host: dnn506yrbagrg.cloudfront.net
URL: https://dnn506yrbagrg.cloudfront.net/pages/scripts/0021/2682.js?474231
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0796855a346bff8e4ade9180ebacd3068499671f45d1ec770eee18c51ef161ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 334714
cf-polished: origSize=6112
ce-version: 11.5.181
cf-bgj: minify
last-modified: Fri, 02 Feb 2024 18:59:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 851497c738681994-FRA

POST
H/1.1 200
OK visitWebPage
051-zxi-237.mktoresp.com/webevents/ 2 B
318 B 1021ms
157ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1707235088505&_mchCn=&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-1707235088504-40159&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchRu=%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 12983121-c06b-45ad-a565-d76fc33fca4f

POST
H/1.1 200
OK visitWebPage
051-zxi-237.mktoresp.com/webevents/ 2 B
318 B 842ms
155ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://051-zxi-237.mktoresp.com/webevents/visitWebPage?_mchNc=1707235088505&_mchRu=%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&_mchQp=cat%3D400%26cat%3D416%26cat%3D409%26cat%3D410%26cat%3D467%26cat%3D476%26assetID%3D16176%26assetType%3Darticle%26key%3Dnimzaloader%26key%3Dphishing%26key%3Dta800%26key%3Dproofpoint%26key%3Demail%26key%3D&_mchId=051-ZXI-237&_mchTk=_mch-bankinfosecurity.com-1707235088504-40159&_mchHo=www.bankinfosecurity.com&_mchPo=&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchRe=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 0d00ec2d-a9c1-4a8f-9c4a-8babf7cf3c54

GET
H/1.1

200
OK

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookie...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D749%252C2330930%26time%3D1707235088506%26url%3Dhttps%253A%252F%252Fwww.bankinfose...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookie...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cooki...

0
277 B

300ms
101ms

Image
application/javascript

108.174.10.24
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookiesTest=true&liSync=true&e_ipv6=AQJWKEstSgvu1gAAAY1_JBvnAtp9-N7TXTY5mrHRs7yTVGqlzplChtcsPfQNevtaCZN79fWlCyw4ez6LQuCtZnC_gnzy
Requested by: Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
Protocol: HTTP/1.1
Server: 108.174.10.24 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-24.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Server: Play
X-Li-Pop: prod-lva1-x
LinkedIn-Action: 1
X-Li-Fabric: prod-lva1
Content-Type: application/javascript
X-LI-Proto: http/1.1
Connection: keep-alive
content-length: 0
X-LI-UUID: AAYQuKURd57tEyESiUoQxw==

Redirect headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Server: Play
X-Li-Pop: prod-lva1-x
LinkedIn-Action: 1
X-Li-Fabric: prod-lva1
Location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=749%2C2330930&time=1707235088506&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&cookiesTest=true&liSync=true&e_ipv6=AQJWKEstSgvu1gAAAY1_JBvnAtp9-N7TXTY5mrHRs7yTVGqlzplChtcsPfQNevtaCZN79fWlCyw4ez6LQuCtZnC_gnzy
X-LI-Proto: http/1.1
Connection: keep-alive
content-length: 0
X-LI-UUID: AAYQuKUM302rpdMhj8JKXg==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
252 B 34ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2RK1HGW2E4&gtm=45je41v0v9122981174z86625173za200&_p=1707235088011&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1183514441.1707235089&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1707235088&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&dt=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1820
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2RK1HGW2E4&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bankinfosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 20ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-XJ8Q4QGGRH&gtm=45je41v0v886765778z86625173za200&_p=1707235088011&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1183514441.1707235089&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1707235088&sct=1&seg=0&dl=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&dt=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&en=page_view&_fv=1&_ss=1&ep.asset_type=article16176&ep.asset_categories=400%2C416%2C409%2C410%2C467%2C476&ep.asset_keywords_1=NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email&ep.asset_keywords_2=&ep.asset_keywords_3=&ep.asset_keywords_4=&ep.asset_keywords_5=&ep.asset_keywords_6=&ep.asset_keywords_7=&ep.asset_keywords_8=&ep.asset_keywords_9=&ep.asset_keywords_10=&tfd=1836
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XJ8Q4QGGRH&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bankinfosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 187ms
186ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1011%3A5aa%3Aabb8%3A3818%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame EEF7 7 KB
4 KB 197ms
156ms Document
text/html 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default

Requested by

Host: bankinfosecurity.disqus.com
URL: https://bankinfosecurity.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1673eae10c03e27b6afd689c3b071339409173dd39bf1957e4992359d4365ce1

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2828
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 06 Feb 2024 15:58:08 GMT
ETag: W/"lounge:view:8434733620.84f36f0e02fcf3e44e11853534394754.2"
Last-Modified: Sun, 07 Jan 2024 23:42:43 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 65 KB
24 KB 32ms
11ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b290618c6a5c2dd4b007f08778431d033d20fd379b4e9dc4f173e11e2a965116

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:36:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1295
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24657
x-xss-protection: 0
server: cafe
etag: 1770201614985610734
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 16:36:33 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 79 KB
24 KB 108ms
107ms Fetch
text/plain 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1416420255425724&correlator=1151486555563901&eid=95323524%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202402010101&ptt=17&impl=fifs&iu_parts=4444691%2CBIS_TOP_728x90%2CBIS_MID_RB_300x250%2CBIS_MID_RB_2_300x250%2CBIS_MID_RB_3_300x250%2CBIS_MID_RB_300x600%2CBIS_MID_L_180x150%2CBIS_MID_R_180x150%2CBIS_MID2_L_180x150%2CBIS_MID2_R_180x150%2CBIS_TEXT_1%2CBIS_TEXT_2%2CBIS_BOTTOM_728x90%2CBIS_MID_728x90%2CBIS_Interstitial%2CBIS_TOP_320x50%2CBIS_BOTTOM_320x50%2CBIS_MID_320x50%2CBIS_CAT_LOGO&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11%2C%2F0%2F12%2C%2F0%2F13%2C%2F0%2F14%2C%2F0%2F15%2C%2F0%2F16%2C%2F0%2F17%2C%2F0%2F18&prev_iu_szs=728x90%2C300x250%2C300x250%2C300x250%2C300x600%2C180x150%2C180x150%2C180x150%2C180x150%2C280x70%2C280x70%2C728x90%2C728x90%2C640x480%2C320x50%2C320x50%2C320x50%2C216x54&ifi=1&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1707235088579&lmt=1707235088&adxs=615%2C1025%2C1025%2C-9%2C1010%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C15%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&adys=71%2C584%2C1868%2C-9%2C1803%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C3869%2C-9%2C-12245933%2C-12245933%2C-12245933%2C-9%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C1%7C-1%7C2%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C3%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&rumc=1416420255425724&rume=1&vis=1&psz=800x1%7C360x0%7C360x0%7C0x-1%7C390x0%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1600x1%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C780x3510&msz=770x0%7C360x1%7C360x1%7C0x-1%7C390x1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1570x0%7C0x-1%7C0x-1%7C0x0%7C0x0%7C0x-1%7C236x36&fws=0%2C0%2C0%2C2%2C0%2C2%2C2%2C2%2C2%2C2%2C2%2C0%2C2%2C644%2C128%2C128%2C2%2C128&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C1600%2C0%2C0%2C0%2C0&ga_vid=1183514441.1707235089&ga_sid=1707235089&ga_hid=624179407&ga_fc=true&dlt=1707235087493&idt=1060&cust_params=category%3D%255B400%252C416%252C409%252C410%252C467%252C476%255D%26gated%3Dn&adks=606436291%2C592806581%2C4037182823%2C700692632%2C585369811%2C2214922354%2C1142555781%2C3687202745%2C1536889060%2C1397140349%2C824892936%2C1158310571%2C1554130010%2C3082656849%2C1657167512%2C3519266287%2C3120678580%2C3463778582&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e084f5c9b083ce4c468b6b2799912dcea492c531331999a8bd9dd082994fd4ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24531
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,6520385953,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,138463483136,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bankinfosecurity.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 66A3 6 KB
3 KB 79ms
15ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 15:58:08 GMT
expires: Wed, 05 Feb 2025 15:58:08 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 ajax.php Show response
www.bankinfosecurity.com/ 5 B
85 B 169ms
169ms XHR
text/html 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/ajax.php?json=notificationCookies&action=getNotifications

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/javascripts-responsive/vendor/jquery.min.js?s=1707235007.9954

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:49 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 25
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 www.bankinfosecurity.com.json Show response
script.crazyegg.com/pages/data-scripts/0021/2682/site/ 961 B
715 B 64ms
20ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0021/2682/site/www.bankinfosecurity.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0021/2682.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d4205b1f3bdda5c966c87b69975ed9bb6230c03b037a2f67de5cf3c2723259c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 334740
ce-version: 11.5.181
content-length: 442
last-modified: Fri, 02 Feb 2024 18:59:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 851497c82fd31d88-FRA

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 745 B
726 B 26ms
12ms XHR
application/json 18.158.171.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.171.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-171-174.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 11c1f744dbd4b584d8c0cfb6aa4daaafb436bb603fd98c8c40312c3818074dde

Request headers

Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 7207ef3e32cb3a527876a3e90b6bf51dbd9d9339
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
X-6s-CustomID: WebTag1.0 8cde4267f2ac828e1ae5d1fbcd5ef992

Response headers

x-trace-id: 6701113349114837656
date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 399

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 252ms
10ms Preflight 18.158.171.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.171.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-171-174.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.bankinfosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.bankinfosecurity.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Tue, 06 Feb 2024 15:58:08 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 5451965118261655984

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.20/ 60 KB
25 KB 16ms
16ms Script
application/javascript 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.20/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/i5wta0dq65
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: cbcfb303a1e7d1f9da8965565b535f4122f2de2f1f3ed9f61f3f9e2dad3dcf9d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
content-encoding: br
last-modified: Wed, 24 Jan 2024 14:33:55 GMT
etag: W/"0x8DC1CE97EB406F9"
vary: Accept-Encoding
x-azure-ref: 20240206T155808Z-9mzbc703f52nx9uq0042gsgzh000000006eg00000001cef7
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 53bd29fa-901e-0009-7069-576b08000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28
x-fd-int-roxy-purgeid: 51562430

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5694 0
0 42ms
41ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvCPFhVe3vMMh5qp8-I-kRv0clbNFzpdR-5F9H8qcGAkDHV6ju1sm5-aGnRSI7AxzPrggz4NsWLPz35hsi6kRjNzymSNwNA0a_hsEii7ZpLE9suZWrHRNLooDyTqtR22y4XnUCbRVqn04sERlg6deVoHWTKJyO0Ka5MnRF_USDmNpFdVLZyqceKjm0U7dnlXMBHUAIN9fzkIg0Qfe-5hPrn_akGL8P2gp9xf-A2GWlzpnusbbZBpq2hK02Cwmj-IEyINSrQ-CIGIiir_J08NZAUnixrSBtPbc1bVtidMLqwn5DCeq6N5xPuSU5IUffH3RAABz_EDcdTacmRysU7fJ46sVJ4MovJYZ1PmUDVSBxd4Eo&sai=AMfl-YQLDDkvr5angwGv3z158Lotzlv5u8nZ6pfjf1xC3dutfOM7VvD7S_eWDkVwd4X1BGRuf-cS7NGbGxirxuFuQoznXp7EXlHoLwcHAAYrkygkuKFDMNSTtOgdep9mKgfGOy3ho8P6ohBbNYybhJHzEwk&sig=Cg0ArKJSzF1UpSfnfBrWEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/ Frame 5694 23 KB
9 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:50:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 3610546441309021303
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Feb 2024 12:50:14 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/ Frame 5694 3 KB
2 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240201/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:35:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Feb 2024 15:35:11 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5694 205 KB
62 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:46:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63267
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 16:46:40 GMT

GET
H2 200 6428613957972335824
tpc.googlesyndication.com/simgad/ Frame 5694 52 KB
52 KB 30ms
9ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6428613957972335824

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7cca33fae5bd6a929262d4e76e4ab14457109e7194f60b13bc86ece4ce585eed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: Sun, 02 Feb 2025 06:13:15 GMT
date: Sat, 03 Feb 2024 06:13:15 GMT
x-content-type-options: nosniff
age: 294293
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52892
x-xss-protection: 0
last-modified: Fri, 02 Feb 2024 19:11:21 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

POST
H/1.1 204
No Content / Show response
px.ads.linkedin.com/wa/ 0
1 KB 149ms
107ms XHR
text/plain 2620:109:c002::6cae:a14
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2620:109:c002::6cae:a14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
NEL: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
Server: Play
X-Li-Pop: prod-lva1-x
LinkedIn-Action: 1
Vary: Origin
Report-To: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
X-Li-Fabric: prod-lva1
Access-Control-Allow-Origin: https://www.bankinfosecurity.com
X-LI-Proto: http/1.1
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-LI-UUID: AAYQuKUE6yebjoZz1LZczw==

GET
H2 200 lounge.load.c4e1dc4f430a090ef93e41a385ff8ef2.js Show response
c.disquscdn.com/next/embed/ Frame EEF7 1 KB
1 KB 79ms
13ms Script
application/javascript 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.c4e1dc4f430a090ef93e41a385ff8ef2.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ffda8418fcc29c206c4dfec14d4dda5c2771ae0aecb332374ba88a22d13e8fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 30 Jan 2024 18:41:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 16397fa9e7894d6fa7dfb0bf81a0d05a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P4
age: 595010
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 629
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 30 Jan 2024 16:48:51 GMT
server: nginx
etag: "65b92873-275"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: TzmmDHI1ymFTfXGataydAcnxxmHv2L6iwu0UdtoeLitOffDt9u53nQ==
expires: Wed, 29 Jan 2025 18:41:18 GMT

POST
H2 411 csi
csi.gstatic.com/ 0
0 923ms
300ms Ping
text/html 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lsajoxa8&c=1416420255425724&e=95323524%2C31061691%2C31061693&ctx=1&met.9=1.1ca~13.1f2~2.1fc~9.0~3_1.1gg~7_1.0~7_2.0~7_3.0~7_4.0~7_5.0~7_6.0~7_7.0~7_8.0~7_9.0~7_10.0~7_11.0~7_12.0~7_13.0~7_14.0~7_15.0~7_16.0~7_17.0~7_18.0~4_1.1ka~5_1.1kh~5_2.1kh~5_3.1kh~5_4.1kh~5_5.1kh~5_6.1kh~5_7.1kh~5_8.1kh~5_9.1kh~5_10.1kh~5_11.1kh~5_12.1kh~5_13.1kh~5_15.1kj~5_16.1kj~5_17.1kj~5_18.1kj~5_14.1km~6_14.1kn&met.3=74.1fh_2~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~947.1fk~1.1fk~947.1fl~1.1fl~947.1fl~6.1fl~91.1fl~947.1fl~86.1fl~95.1fl_1~95.1fm~95.1fm~95.1fn~95.1fn~95.1fn~95.1fn~95.1fn~95.1fn~77.1fh_7~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~894.1ft~894.1ft~1132.1fz_h~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~646.1ka_1~646.1ka~646.1ka~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kc~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~647.1ke~965.1kg~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kk~801.1kk~825.1kk~355.1kk~825.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~774.1kn~653.1ko_a~801.1ky~801.1ky~844.1ky~844.1ky~844.1ky~825.1ky~355.1ky~825.1ky~598.1kz~708.1kz~680.1l3~824.1l3~824.1l3~112.1l9_1~1121.1lc~783.1lc&met.10=1_14.CAAQABiAmHUg5w4oAA~1_18.CAAQABiAmHUg5w4oAA~1_16.CAAQABiAmHUg5w4oAA~1_3.COgCEAAYgJh1IOcOKAA~1_5.CIYDEAAYgJh1IOcOKAA~1_15.CAAQABiAmHUg5w4oAA~1_2.COgCEOgCGICYdSDnDigB~1_12.CAAQABiAmHUg5w4oAA~1_1.CAAQABiAmHUg5w4oAQ&met.7=CBsQCMAB7oOk1AE~CBsQByCVBjjzAcABwoSDtAg~CBIQBxgBIJYGKJYGMMQGOC5AmQZImQZQmQZYrQZgnwZorQZwwwZ49xOAAcsRiAGztgOqAVEKT09wZW4rU2FuczozMDBpdGFsaWMsNDAwaXRhbGljLDYwMGl0YWxpYyw3MDBpdGFsaWMsODAwaXRhbGljLDQwMCwzMDAsNjAwLDcwMCw4MDCwAQG4AQPAAdbHu8gK~CBsQByCWBjj2AcABj_qT_QQ~CBsQByCWBjjxAsABuqX8xQs~CBsQByCWBjj_AcABjcHOwQY~CBsQByCWBjj0AcABkKnczgc~CBsQByCWBjj2AcABipXD1Q4~CBsQByCWBjj2AcABw7PF6QM~CBsQCiCWBjj4AcABmMSenw0~CBsQCiCWBjjtAsAB3tOQ0gk~CBsQCiCWBjj4AcABvpuK5QE~CBsQCiCWBjj1AsABwuDxjg8~CBsQCiCWBjjwAsABoO2rogM~CBsQCiCWBjjxAsAB2e7c7Qw~CBsQCiCWBjjsA8ABt4O6sAI~CBsQCiCWBjjyAsABzo2epAc~CBsQCiCWBjjoA8ABjNig_Ag~CBsQCiCWBjhdwAHu4LLsBA~CBsQCiCWBjisBMABxJ-RxQ8~CBsQBiCWBjhswAG5kP-oDQ~CBsQBiCWBjjyAsABrobBjg8~CBsQBiCWBjiMAcABuM_ayA4~CBsQBiCWBjiWAcABvaPf5A8~CBsQBiCWBjinAcAB2PSUiQU~CBsQBiCWBji7BMABqo_noAw~CBsQBiCXBji7BMABkdmzpQ4~CBsQBiCXBji-BMABktOtgAE~CBsQBiCXBjicBMABnajSzAk~CBsQBiCXBjipBMAB4Obq6AQ~CBsQBiCXBji0BMABwpXb3gk~CBsQBiCXBjjEBMAB3aih4AY~CBsQBiCXBjjFBMABtdPfrQQ~CBsQBiCXBji_BMAB3a6hqgw~CBsQBiCXBji7BMAB96nK-wQ~CBsQBiCXBji_BMABpqXs-gw~CBsQBiCXBjj0BMABqPzjwQo~CBsQBiCXBjjsBMABwaio3A8~CBsQBiCXBjj1BMABrqbjgQI~CBsQBiCXBjjrBMAB6J_D4Aw~CBsQBiCXBjjzBMABnO3Xsg4~CBsQBiCXBjiMBcABpNfy2wk~CBsQBiCXBjiqBcAB2N2T4Qo~CBsQBiCXBjiHBcABr43gzA8~CBsQBiCXBjiLBcABxei3yQI~CBsQBiCXBjiNBcAB4rik7ww~CBsQBiCXBjimBsABnJz88g0~CBsQBiCXBjj_BMABuZ_c2QE~CBsQBiCXBjiPBcABk8jS4wQ~CBsQBiCXBjiNBcAB9cOi1QE~CBsQBiCXBji6BcABrdW6kwo~CBsQBiCXBjiiBcAB_ZiohQk~CBsQBiCXBjioBcAB8_3uggM~CBsQBiCXBjjXBcAB_8PS-Ao~CBsQBiCXBjjeBcABvbqS6QI~CBsQBiCXBjjnBcABuoin0gQ~CBsQBiCXBjjyBcABs6LNkQs~CBsQBiCXBjjOBcAB-cqKywM~CBsQBiCXBjjaBcABgMSatQo~CBsQBiCXBjjcBcAB2YO-iQ8~CBsQBiCXBjjcBcAB3J3piAg~CBsQBiCXBjitBsAB67D7zQg~CBsQBiCYBjiFBcABieesrAU~CBsQBiCYBjiUBsABv6XBwAU~CBsQBiCYBjiWBsAB1PGj1w0~CBsQBiCYBjiiBsABnsrdjAY~CBsQBiCYBjjvBcAB2fLU8QM~CBsQBiCYBjjyBcABn-rI6gk~CBsQBiCYBjiSBsABpOjx0As~CBsQBiCYBji-BsABuO-54Q8~CBsQBiCYBjjCBsAB5su38wE~CBsQBiCNBzicBcAB-prw2A4~CBsQBiCNBzigBcABl9zEngo~CBsQBiCNBzioBcABkpD39AM~CBsQBiCNBzjmBcAB5MuGpg8~CBsQBiCNBziaCMABpf289wc~CBsQBiCOBzi4BcABroyFyQ4~CBsQBiCOBzjEBcAB-MaNmQQ~CBsQBiCOBzjcBcAB99SG5gc~CBsQBiCOBziFB8ABur6n9gY~CBsQBiCOBzjDBcABovn98QY~CBsQBiCOBzjIBcABj4HM5Qs~CBsQBiCOBzjJBcAB4LDM0Q0~CBsQBiCOBzjSBcABqsGBzwY~CBsQBiCOBzjUBcAB95vW2Qw~CBsQBiCPBziJBMABz4325Qg~CBsQBiCPBziUBMAB_-u9qAo~CBsQBiCPBziHBMABzdqGtgc~CBsQBiCPBziJBMAB3uLRlQE~CBsQBiCPBziMBMABs9nT_Qk~CBsQBiCPBzjTBcAB0dGH3wc~CBsQBiCPBzjYBcABjqjF5Qc~CBsQBiCPBzjsBcABlqGEigc~CBsQBiCPBziOBMABytPJywQ~CBsQBiCPBziSBMABucjO9ww~CBsQBiCPBzjoBcAB1baCxgE~CBsQBiCPBzjxBcAB7Zfz1Ao~CBsQBiCPBzj9BcAB3MXS1QE~CBsQBiCPBziIBsAB9YWUvAg~CBsQCiCPBzj0AsAB5qSx-go~CBsQCiCPBzj9AsAB3PvSmwc~CBsQCiCPBzj8A8AB_JzmwwM~CBsQBiCPBzjvBcABpOHSywM~CBsQDiCPBziWBsABqMv6xwY~CBsQCiCPBziRBMAB6uf5ZA~CBsQCiCPBziTBMABps3ulwU~CBsQDSCVCjiyBMABmJy70AM~CA0QChgBIJYKKJYKMLMNOJ4DQOoMSOoMUOoMWP4MYO8MaP4McK0NePjnAYABzOUBiAGCgAawAQG4AQPAAeHb5t0L~CBsQCiCWCjiIA8ABppfwuQ0~CBsQChgBIJgKKJgKMK8NOJcDwAHVntOmDA~CBsQChgBIJkKKJkKMKkNOJADwAHVntOmDA~CBsQAiCbCjiFAcABmvLQhgI~CBsQCiCgCjhMwAGs0ZcB~CBsQDiDGCjimAcABmLT6xwY~CBsQDSDECzgywAG7qK7kDw~CBsQCiDHCzgPwAGQs9mvCg~CBsQCiDHCzjuAcABpeiwkQI~CBsQCiDICzjvAcAB34OR-gE~CBsQCiDICziFBMABuKHn2w4~CBsQCiDICzinAsAB0eKixAg~CBsQCiDICziKAsABnvymtg0~CBsQCiDqCzjxAcABiN6rsQM~CBsQCiC2DTg2wAGz_rGUDg~CEMQChgBIMsNKMsNMIsOOEFQyw1Y6w1g2Q1o7A1w8w146MQIgAG8wgiIAZ6hG7ABAbgBA8ABlejMzQE~CDwQDRgBIMwNKMwNMJkOOE5QzA1Y6w1g2Q1o7A1wmA543AKAATCIAUWwAQG4AQPAAejUr80J~CBsQChgBINwNKNwNMIoOOC7AAYzV2OsE~CBsQChgBIN0NKN0NMIoOOC3AAYzV2OsE~CBsQCiDeDTjNAcAB54OQmgY~CBsQCiDhDTgywAG_uOuBCg~CBsQDSDpDTgUwAHUvYfjBw~CBsQDSDpDTg2wAHHrrytDw~CBsQBiDqDTjSAcABwuuhkQg~CBsQBiDqDTjTAcABwuuhkQg~CBsQDSDsDTgSwAHUvYfjBw~CBsQDSDsDTgywAHHrrytDw~CBsQCiDxDThVwAG4h82xDw~CBsQBiCvDjjUAcABwuuhkQg~CBkQChgBIMUOKMUOMNEPOI0BQKwPSKwPUKwPWMAPYLIPaMEPcMsPeP3CAYAB0cABiAHNhQSwAQG4AQPAAZTdwNgF~CA8QBBgBIOAOKOAOMNAPOHBo4Q5wzQ94_8EBgAHTvwGIAfz6BLABAbgBA8ABv96a6wY~CBsQBRgBIOMOKOMOMLQPOFFQhA9Yow9gkA9opA9wsw94iReAAd0UiAGSMLABAbgBA8ABnK-4mQk~CBsQDSD_DjhBwAH9gJeuCA~CBsQCiCtDzgXwAHs7OSGCQ&qqid.1=CNOHhqiKl4QDFQc9VQgdJO8G9A&qqid.2=CNSHhqiKl4QDFQc9VQgdJO8G9A&qqid.3=CNWHhqiKl4QDFQc9VQgdJO8G9A&qqid.4=CNaHhqiKl4QDFQc9VQgdJO8G9A&qqid.5=CNeHhqiKl4QDFQc9VQgdJO8G9A&qqid.6=CNiHhqiKl4QDFQc9VQgdJO8G9A&qqid.7=CNmHhqiKl4QDFQc9VQgdJO8G9A&qqid.8=CNqHhqiKl4QDFQc9VQgdJO8G9A&qqid.9=CNuHhqiKl4QDFQc9VQgdJO8G9A&qqid.10=CNyHhqiKl4QDFQc9VQgdJO8G9A&qqid.11=CN2HhqiKl4QDFQc9VQgdJO8G9A&qqid.12=CN6HhqiKl4QDFQc9VQgdJO8G9A&qqid.13=CN-HhqiKl4QDFQc9VQgdJO8G9A&qqid.14=COCHhqiKl4QDFQc9VQgdJO8G9A&qqid.15=COGHhqiKl4QDFQc9VQgdJO8G9A&qqid.16=COKHhqiKl4QDFQc9VQgdJO8G9A&qqid.17=COOHhqiKl4QDFQc9VQgdJO8G9A&qqid.18=COSHhqiKl4QDFQc9VQgdJO8G9A
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4003:c05::5e Singapore, Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
304 B 608ms
225ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Tue, 06 Feb 2024 15:58:09 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5694 0
0 42ms
41ms Fetch
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstilbOx8qiY-SsxdJZMtDmpodSYK3uAwCd-i5BI2U65MWI63GMPQVRP02SEMMR2eyqONCiKuvHJ2mIZOUd1q_Tx1hrtHGgkeZVMistIEjNJP3xElCLJysAYeegnUvlbkdIqV51y8Yo6NxS6cvtMSRHbl4WRx9mAGY2oAc60kmTYfS_QNLHc3dKIM7DSRTN6ROFmtu_cSVpsKzCuBpZndvY9PmzFJdpI1L5uJ6fjl5MDUMxHJ4-vW8qYhcwd0FNDKdEHtTrmR825a7NOzWMlQfKEg9Y1Ae8VL-pZCAvAQcKxpqYi7tPoCGpkAGKvZDNa8qSTzi_naOFecLK0RHzN-6XD6XLVGqQhCc-0hXATBbx5rsIZww&sai=AMfl-YQF3i4BPX2g5yyVVRoY16VQC8RwW-RrRnXNMOvuh9mYGIW4OM13W-Kfw0FJOs0iFWVXfG_np1dCfpWIQ2TBR1HE6HGgDDzzwe8OQKO-Hvh80KUkG_w_FBI_lu8LRA0NKnII70-WvdcK0lczX3g3HFI&sig=Cg0ArKJSzHB5kVCPoGBcEAE&uach_m=%5BUACH%5D&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 06 Feb 2024 15:58:08 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 5694 65 KB
24 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b290618c6a5c2dd4b007f08778431d033d20fd379b4e9dc4f173e11e2a965116

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 14:58:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3598
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24657
x-xss-protection: 0
server: cafe
etag: 1770201614985610734
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Feb 2024 15:58:10 GMT

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
744 B 69ms
9ms Image
image/svg+xml 2600:9000:2156:8e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/facebook.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:8e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 01:42:29 GMT
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA50-C1
age: 310540
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 301
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
etag: "c6e9be45643e197ce1db1d7e24a99adc"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
x-amz-cf-id: UiqLcLMRZfNSTIIMfYt_TRp7MMN_W8-OVWBIK_69p3x_jIVgUnbn4g==

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 368 B
779 B 67ms
7ms Image
image/svg+xml 2600:9000:2156:8e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/twitter.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:8e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:55:17 GMT
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Fri, 15 Sep 2023 16:58:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 172
x-amz-server-side-encryption: AES256
etag: "2deb3d5121d475d195577a70b0a91a0c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 368
x-amz-cf-id: Z2-ByymlNPFFKlyl_yty0zthtJh8q9Dg4S_-2Q9xXqucdutL2ZxJfw==

GET
H2 200 linkedin.svg
platform-cdn.sharethis.com/img/ 456 B
881 B 68ms
8ms Image
image/svg+xml 2600:9000:2156:8e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/linkedin.svg

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:8e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 08:41:56 GMT
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 1984280
x-amz-server-side-encryption: AES256
etag: "fa43b4ede18498b114fc7185993f6da7"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 456
x-amz-cf-id: kBtbVtRKuN_yy-NQd6WTSt-ohCnhoJGw9YrT5Bp7KKH9fFBlB5n0iQ==

GET
H2 200 common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js Show response
c.disquscdn.com/next/embed/ Frame EEF7 280 KB
93 KB 41ms
14ms Script
application/javascript 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.c4e1dc4f430a090ef93e41a385ff8ef2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c54fe3fc930f69b6f20a97d122260ca5d1f34b1441d0e186ebc86b86c3c0bea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 30 Jan 2024 18:41:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P4
age: 595010
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 94184
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Tue, 30 Jan 2024 16:48:51 GMT
server: nginx
etag: "65b92873-16fe8"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: ETkflXVHulwjaIAM0IMD3w4G6bkn8-aMVMBGRA2HWp3JkPQb7oFlrQ==
expires: Wed, 29 Jan 2025 18:41:18 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5694 0
173 B 817ms
301ms Ping
image/gif 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lsajoxdc&chm=1&c=1416420255425724&ctx=2&qqid=COCHhqiKl4QDFQc9VQgdJO8G9A&met.4=fb.5~lb.a~ol.1u~idt.ot~dt.-4n&met.1=1.lsajox9m~14.0~15.0~16.0~17.0~18.0~19.0~20.0~21.0&met.7=CBsQCDgB~CCIQBBgBIAkoCTA0OCtoCXAzeKwCsAEBuAED~CAkQChgBIAooCjApOB9oIHAoeJNLgAHnSIgB-boBsAEBuAED~CB4QChgBIAooCjAoOB5QClgfYBBoIHAneIAMgAHUCYgBgRWwAQG4AQM~CBwQChgBIAsoCzAYOA1oC3AReM_wA4ABo-4DiAGY6QywAQG4AQM~CBcQBhgBIAsoCzAxOCZoIHApeMifA4ABnJ0DiAGcnQOwAQG4AQM~CCIQBBgBID4oPjBoOCpoPnBneKwCsAEBuAED~CCgQChgBIEIoQjBLOAloQnBJeP3CAYAB0cABiAHNhQSwAQG4AQM&met.3=113.3r_2~112.3q_3
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4003:c05::5e Singapore, Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.d7d8c4bd634b6e898594ea68da82b27b.css
c.disquscdn.com/next/embed/styles/ Frame EEF7 233 KB
33 KB 14ms
14ms Stylesheet
text/css 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cbf752138ffa9b2b63a3f2ae784179dcc379bd68aad03e2166efacccd3f1a956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 30 Jan 2024 18:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P4
age: 595009
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 33296
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Tue, 30 Jan 2024 16:48:51 GMT
server: nginx
etag: "65b92873-8210"
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: mDXA79_Gjn1QFOqvpGfa_jxEKX_ZaiwZPb2TY9ZAMQPwoONVEyd_Zg==
expires: Wed, 29 Jan 2025 18:41:19 GMT

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
304 B 866ms
483ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Tue, 06 Feb 2024 15:58:09 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 lounge.bundle.b8ffa6bd1c2f2a6dada8c484d2ac96ae.js Show response
c.disquscdn.com/next/embed/ Frame EEF7 513 KB
129 KB 14ms
14ms Script
application/javascript 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.b8ffa6bd1c2f2a6dada8c484d2ac96ae.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b8d3e4ca0f232cefde35437af4ec2c3b305c672f65816b7101a230ee9e5a3ed4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 30 Jan 2024 18:41:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P4
age: 595009
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 131065
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 30 Jan 2024 16:48:51 GMT
server: nginx
etag: "65b92873-1fff9"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
timing-allow-origin: *
x-amz-cf-id: 5ETssi_jbdyDdZm5PnvwxZChh528Hi4TR3AY7vzK0231UxFJ3yuWGg==
expires: Wed, 29 Jan 2025 18:41:19 GMT

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame EEF7 19 KB
19 KB 7ms
7ms Script
application/javascript 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7e1a48181248769e8ecd2cb2524e8aabd3667028fbcf699ff993acb5be8af410

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:08 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 55
X-Frame-Options: SAMEORIGIN
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 19330
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame EEF7 3 KB
4 KB 11ms
10ms XHR
application/json 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=bankinfosecurity&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

49837165e103d2da44980334e07d1470d4267541ccfbee2263575dab948004ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 82
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 3158
X-XSS-Protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ Frame EEF7 11 KB
970 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 06 Feb 2024 15:58:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 14:46:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Feb 2024 15:58:09 GMT

GET
H/1.1 200
OK threadDetails.json Show response
disqus.com/api/3.0/embed/ Frame EEF7 36 B
463 B 108ms
107ms XHR
application/json 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/embed/threadDetails.json?thread=8434733620&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.51fc142c2629cf6c7d5a051ab2606a1e.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

89f4889eebc36f4ad79abb20ba84c4e8b0dac9bce1c0dfbe779ac8d5022572bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
X-Requested-With: XMLHttpRequest
X-Disqus-Publisher-API-Key: kgLGW0evKY3stsTyDzF6Uv5Etlrt7MzZ7AWQESkvyZPev49GJCrbtByseVYlfQj6
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
X-Disqus-Remote-Auth: W10= 4089782e7e06a217914795a56182e399017b86fc 1707235007

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Vary: Origin, Cookie
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/json
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 36
X-XSS-Protection: 1; mode=block

GET
H2 200 disqus-sso-login.png
www.bankinfosecurity.com/images/ Frame EEF7 4 KB
4 KB 127ms
127ms Image
image/png 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bankinfosecurity.com/images/disqus-sso-login.png

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

c15d7c72b50d4cad5e7a1fcbd75c78ded4c75eaf3ec382783a1903f88e6db1cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:49 GMT
x-frame-options: deny
content-type: image/png
cache-control: max-age=86400, private, must-revalidate
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 4222
x-xss-protection: 1; mode=block

GET
H2 200 svg-sprite.6d7ccb1c98b314b20422a2c2f0497a7f.svg
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 13 KB
14 KB 14ms
13ms Image
image/svg+xml 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.6d7ccb1c98b314b20422a2c2f0497a7f.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

973329cbeaebf60b87a29ec5651af3302c3cdc4c3dd610bf18b6ff346087428a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 30 Jan 2024 18:41:19 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 595010
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 13540
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 30 Jan 2024 16:48:51 GMT
server: nginx
etag: "65b92873-34e4"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: a2vo-qU6L_ubU2Ee-amIku2_2Y8Q_dhqllIulTTMELRPtmiGwKe1YQ==
expires: Wed, 29 Jan 2025 18:41:19 GMT

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 3 KB
3 KB 14ms
13ms Image
image/gif 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Sun, 20 Aug 2023 12:05:10 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 14701979
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 02 Aug 2023 23:18:56 GMT
server: nginx
etag: "64cae460-b9b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: fPtc4irWmgbr9M8n2rU_pQYo_Q-2dtJK6lrJBfRcWlWEK2eFI_Hu9Q==
expires: Mon, 19 Aug 2024 12:05:10 GMT

GET
H2 200 email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 840 B
1 KB 15ms
14ms Image
image/svg+xml 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 18 Jul 2023 06:46:45 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 17572284
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 840
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 12 Jul 2023 14:04:56 GMT
server: nginx
etag: "64aeb308-348"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: a1nRuttz5PwfUZTnQ4bRAObtizqDbHp6AgCUuBu8vDq8LRDCrnVfVQ==
expires: Wed, 17 Jul 2024 06:46:45 GMT

GET
H2 200 privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 891 B
1 KB 15ms
15ms Image
image/svg+xml 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/privacy.8c96be6b50de1c3fab838c5f050e0be5.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 26 Jul 2023 18:48:11 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 16837798
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 891
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 26 Jul 2023 16:31:55 GMT
server: nginx
etag: "64c14a7b-37b"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 8-pwN-h0KE2mWRG2-OBAnfKRoWN9yxBc-G4AbDiS1YLD-RkPHtlzEg==
expires: Thu, 25 Jul 2024 18:48:11 GMT

GET
H2 200 warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 605 B
1 KB 16ms
15ms Image
image/svg+xml 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/warning.3bc0b4bff6c268a4ceaf404014b9be42.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Sat, 19 Aug 2023 03:55:20 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 14817769
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 605
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 02 Aug 2023 23:18:56 GMT
server: nginx
etag: "64cae460-25d"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 04lAzwB9ZeEg6_V0BdcH7Mb4VsY8sRxClk9FbkjDFtZe3MkS1iGN_g==
expires: Sun, 18 Aug 2024 03:55:20 GMT

GET
H2 200 sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame EEF7 2 KB
2 KB 16ms
16ms Image
image/png 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 24 Jul 2023 12:53:27 GMT
via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 17031882
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1763
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 12 Jul 2023 14:04:56 GMT
server: nginx
etag: "64aeb308-6e3"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: NmyGLs5FNVqqVNMF5EhV1g_6eqFGxlDlvhaydswAlGwBpXTQXt_wbQ==
expires: Tue, 23 Jul 2024 12:53:27 GMT

GET
H2 200 icons.79e576f9489bae308388e5b8e250aa86.woff2
c.disquscdn.com/next/embed/assets/font/ Frame EEF7 8 KB
9 KB 16ms
16ms Font
application/octet-stream 2600:9000:20b4:3800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.79e576f9489bae308388e5b8e250aa86.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20b4:3800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8dc675da542f629aca965669b35900a5ed0685f4d87dce9eac4660baf4493687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.d7d8c4bd634b6e898594ea68da82b27b.css
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 06 Dec 2023 19:49:42 GMT
via: 1.1 16397fa9e7894d6fa7dfb0bf81a0d05a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: AMS58-P4
age: 5342907
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 8216
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 06 Dec 2023 19:40:12 GMT
server: nginx
etag: "6570ce1c-2018"
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: _eRMvdGvGuKtXJoOhC9h_1Q0sYLRPw4-RkgIYn6MoHv2SjrVULpfEw==
expires: Thu, 05 Dec 2024 19:49:42 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEF7 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:50:29 GMT
x-content-type-options: nosniff
age: 594460
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:50:29 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEF7 15 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:51:53 GMT
x-content-type-options: nosniff
age: 594376
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:51:53 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEF7 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 09:10:14 GMT
x-content-type-options: nosniff
age: 24475
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 09:10:14 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEF7 17 KB
17 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 12:16:48 GMT
x-content-type-options: nosniff
age: 99681
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17368
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Feb 2025 12:16:48 GMT

GET
H2 200 KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
fonts.gstatic.com/s/roboto/v30/ Frame EEF7 17 KB
17 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,600;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://disqus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 22:44:15 GMT
x-content-type-options: nosniff
age: 234834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17032
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 02 Feb 2025 22:44:15 GMT

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame EEF7 43 B
339 B 116ms
100ms Image
image/gif 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=276&event=init_embed&thread=8434733620&forum=bankinfosecurity&forum_id=1538940&imp=6m64lin3jbfc1d&thread_slug=spear_phishing_campaign_distributes_nim_based_malware&user_type=anon&referrer=https%3A%2F%2Fwww.bankinfosecurity.com%2F&theme=next&dnt=0&tracking_enabled=0&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=bankinfosecurity&t_u=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&t_d=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&t_t=Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 15:58:09 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
content-type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
x-xss-protection: 1; mode=block

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 189ms
189ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A08%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:09 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 bis-hdr.desktop.r2.js Show response
www.bankinfosecurity.com/javascripts-responsive/ 2 KB
652 B 127ms
127ms Script
text/javascript 50.56.167.254
RMH-14

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bankinfosecurity.com/javascripts-responsive/bis-hdr.desktop.r2.js

Requested by

Host: www.bankinfosecurity.com
URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

50.56.167.254 , United States, ASN33070 (RMH-14, US),

Reverse DNS

Software

Resource Hash

56d67bff3c0d11af3f7b09d825eca83408c0017d7c34a03678f0f9433a97819d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 15:56:50 GMT
vary: Accept-Encoding
x-frame-options: deny
content-type: text/javascript; charset=utf-8
cache-control: max-age=86400, private, must-revalidate
alt-svc: h3=":443"; ma=2592000
content-length: 593
x-xss-protection: 1; mode=block

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 69ms
55ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402010101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b27d3e9bcba0946c12ab6ddb165142863f8f0942738ac8ba44219a1eb6df56ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12440
x-xss-protection: 0

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&RedC=c.clarity.ms&MXFR=068432869EC26FF920EE269B9AC26124
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&MUID=0CE97FC4E15E6BAE12696BD9E0356A62

42 B
442 B

31ms
31ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&MUID=0CE97FC4E15E6BAE12696BD9E0356A62
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:09 GMT
last-modified: Wed, 10 Jan 2024 21:11:32 GMT
server: Microsoft-IIS/10.0
etag: "d765ee95944da1:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:09 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 25772B63D43343C1879A2859F68B9C2D Ref B: FRAEDGE1507 Ref C: 2024-02-06T15:58:09Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F6D8965CEA4340F7827541EEB8CED59C&MUID=0CE97FC4E15E6BAE12696BD9E0356A62
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
DATA 200
OK truncated
/ Frame 5694 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bf9758e9c8a24a861409c8ae5e74d96ff346ba4cd8590de37e21224d0610f98

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=www.bankinfosecurity.com&doc=complete&pg_h=5540&pg_w=1600&pg_hs=5540&c=1&aa_c=0&av_h=480&av_w=1200&av_a=576000&b=4892&all_b=4892&d=0.087&all_d=0.087&ard=0.065&all_ard=0.065&dt=d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 99ms
99ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Feb 2024 15:58:09 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 040A 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1377
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 15:35:12 GMT
expires: Wed, 05 Feb 2025 15:35:12 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F1A3 829 B
1 KB 37ms
17ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2d1af98c639de191d78628c8fef70adf8d3471a5348c046cbb6118df3f92dc5c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-c5iL-D6n1ymq8_FO7IS6UQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bankinfosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-c5iL-D6n1ymq8_FO7IS6UQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 15:58:09 GMT
expires: Tue, 06 Feb 2024 15:58:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 040A 39 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:32:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12313
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Feb 2025 12:32:56 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F1A3 0
0 37ms
37ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202402010101&jk=1416420255425724&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 040A 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?_h-efA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 189ms
189ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A09%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:10 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 40ms
40ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402010101&jk=1416420255425724&bg=!l5SllNvNAAa8BdJLnAU7ADQBe5WfOM4w-ICDAzNpusGIxY6smIJHiCxUThGNXd775RCfJRuRyjUTa-FZNXz4qygDixxaAgAAADVSAAAAAWgBB5kCwpKk2ESsUAAFD44jPBClpDBosaoCzpoXWsogybRBL2m0oI64jVCOGmoPdr5fGY71unrQXaWabBnjaXNjo_7V8a7cJRAUz_wgxxCTaWQU2-jBcoceSsg8oNnTNF43OeGdnwVmz2FtXfbqWPJpAnvMk0JmQ-nA-5GmzmyoSzFDnTokTYbSotlnPY2SjvuWKUiMoybNe1Dxk0YfL0Ksqg2WrccfkMv3ICBpOKtp-KfdwZBWefY9P-OJ5riQ8cpANOCmlddUhwi8sMMG2rNAfPa-ylcY3lUA61sQpk4PD24AEAR4-9vHots2EEQR38rMPvsFUjYdo99G0gDccmqOIl-vih8i_4P8dAeb9YOeRmA8GICKIMokzbxF7VYWqsZqTF5VThBidbwXRJMKksn_VnncFuo51vO6ElGBKT9ar4CYrg8aFldmA2oPIlEuryRxWgwKv5zRkQSraWFTfTntwEx9vijP8uHScwnZlxx9WT8SMR33B3OHyRejfVPjwYXn8ydqpfoAQ9-tfvbikNHDqTvR_8A_EO45CA_RINyIfd76XmVIDxW9-roTMVr-C8-9Sm3nWr0Q2EPYUjVKNT2qj1TiFYao5NLb6HVHW4u0iR2CGPAvA9zR6uNzLViEM8k25iQOU57-yyaHXGu9PI-JRf9OU_Cu4KccKnrgIbX93vczkcjVs5jxVuIIQW5D6ocWRJiZxXOU1yU9SkQM25lQtmYzWfghMEOXVH_yKx7IHnLI_731F9al7h75jylQGPliPKs5kYsvBuXOWMKsorNbw9gNW-UCa35kuEwsJoM3cxLjYf_R37RiVFSyHGqypH6T6t_d473aIZspkmJxEEoMljaAI8ZWxiPnGC28q3P6ynZVSbscsxf7d2jHSyJAI5OqJy-TrLizWbjJUPm-NwcpySMER78vgMfLKBKdaJCIl7BRhS4DraY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5694 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssWIUv-jR-JVok1lX0Y1IzquRbbilt8ZWZm6aTZmjEucNgO6QNkcJXmUB_H-xeEdfvrP0qT_gJ_GfNfxH_Rp9UbVHDx3J62U14zvWp7KhHn2bNxqdMaAiisLpKEsx8cHDpNLjLssoSxAj65JqY62yqAdiuS2qfnfbA&sig=Cg0ArKJSzIEsqSJOXJ4PEAE&id=lidar2&mcvt=1000&p=0,0,480,640&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240201&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3082656849&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=316788800&rst=1707235088746&rpt=59&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ 0
54 B 300ms
300ms Ping
image/gif 2404:6800:4003:c05::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=2~lsajoxag&c=1416420255425724&e=95323524%2C31061691%2C31061693&ctx=1&met.7=CBsQBSC0DjjHAcAB246noA0~CBsQDSDqDjirAcABio7Ztgo~CBsQCiCvCziABcABqbzm5wU~CBsQDSCCDziXAsAB2pT8qwo~CBsQDSCMEDiWAcABte2UugE~CBsQBiD5EDhGwAGa0IquDg~CBsQBiD5EDhEwAHKjMfqDA~CBsQBiD5EDhFwAHAw7XqBw~CBsQCiDhDTj0A8ABqKrikQQ~CBsQDSCyEDjgBMABibe5swQ~~~CBsQBiDRFTi-AcABwuuhkQg~CBsQARgBIJUQKJUQMLIXOJwHwAGkoPylBw~CBsQBiCHDjjMCcABqZW7hQg~CBsQCDjZF8AB7oOk1AE~CBwQBhgBIOEXKOEXMIkYOCho4hdwiBh4rAKwAQG4AQPAAZSE4rUO~CCcQDRgBINkXKNkXMJ8YOEZQ2RdY5xdg2Rdo5xdwnhh4xGOAAZhhiAHmgAGwAQG4AQPAAfPyy64L~CBsQDSDYETjjBsABibe5swQ~CBsQCiDWFziAAcABt_fM6A0~CCcQChgBIKAYKKAYMIQZOGXAAeLBm9oF~CCcQBRgBIIYZKIYZMJkZOBPAAZmVn6AL~CBsQBiDZFzjaAcAByLSjqQc~CBsQBRgBIIkZKIkZMLgZODDAAc_G2uIB~CBwQBhgBINYdKNYdMP4dOCnAAaHZ1rIJ~CBsQBiC6HTi-AcABwuuhkQg&met.3=680.1me~824.1me~824.1me~680.1sv~680.1to~680.1tp~680.1tq~680.1ts~680.1uk~680.1w9~94.2c9~947.2ce~573.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~598.2ce~113.2cd_4~1121.2cj~783.2cj~680.2ig&met.1=1.lsajovoy~6.1~7.4v~8.4v~9.4v~10.bx~11.8b~12.bx~13.lt~14.p9~15.lv~16.15m~17.15m~18.161~19.2c5~20.2c6~21.2ca~22.10j~23.10j&met.10=1_14.CICUIxCAlCMYgJh1INwXKAE
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4003:c05::5e Singapore, Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 15:58:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content collect Show response
p.clarity.ms/ 0
304 B 288ms
288ms XHR
text/plain 20.122.63.128
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://p.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.20/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.122.63.128 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.bankinfosecurity.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bankinfosecurity.com
Date: Tue, 06 Feb 2024 15:58:11 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 190ms
190ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A10%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:11 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 182ms
181ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:12 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 240ms
240ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=8cde4267f2ac828e1ae5d1fbcd5ef992&svisitor=null&visitor=8bb6862f-4b40-4487-8719-0a0a30b04b1a&session=9961d114-d8df-4371-861d-01429bcce527&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2006%20Feb%202024%2015%3A58%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22An%20ongoing%20spear-phishing%20campaign%20by%20the%20threat%20group%20TA800%20is%20distributing%20a%20new%20malware%20loader%20based%20on%20the%20Nim%20programming%20language%20that%27s%20designed%20to%20help%22%2C%22keywords%22%3A%22NimzaLoader%2C%20Phishing%2C%20TA800%2C%20Proofpoint%2C%20email%22%2C%22title%22%3A%22Spear-Phishing%20Campaign%20Distributes%20Nim-Based%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.bankinfosecurity.com%2Fspear-phishing-campaign-distributes-nim-based-malware-a-16176&pageViewId=159a62bd-70b2-4ebf-856d-c0c627bf5ea7&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.bankinfosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 15:58:13 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
URL: https://f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com/ondemand-preview-w-255.mp4

Verdicts & Comments Add Verdict or Comment

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bankinfosecurity.com/	1970-01-20 18:14:09	Name: PHPSESSID Value: 8h6nmvqhkjgpomapqkq5e1r4ev
www.bankinfosecurity.com/	1970-01-20 18:15:21	Name: _advert Value: false
www.bankinfosecurity.com/	1970-01-21 03:49:55	Name: _gd_visitor Value: 8bb6862f-4b40-4487-8719-0a0a30b04b1a
www.bankinfosecurity.com/	1970-01-20 18:14:09	Name: _gd_session Value: 9961d114-d8df-4371-861d-01429bcce527
.bankinfosecurity.com/	1970-01-21 03:49:55	Name: _mkto_trk Value: id:051-ZXI-237&token:_mch-bankinfosecurity.com-1707235088504-40159
.bankinfosecurity.com/	1970-01-21 03:49:55	Name: _ga_2RK1HGW2E4 Value: GS1.1.1707235088.1.0.1707235088.0.0.0
.bankinfosecurity.com/	1970-01-21 03:49:55	Name: _ga Value: GA1.1.1183514441.1707235089
www.bankinfosecurity.com/	1970-01-20 18:13:58	Name: visitorip Value: 10.187.187.9
www.clarity.ms/	1970-01-21 02:59:31	Name: CLID Value: 3c32d6d76b0e4d41bfa09f8ae28987ea.20240206.20250205
.bankinfosecurity.com/	1970-01-21 02:59:31	Name: _clck Value: wur5rc%7C2%7Cfj1%7C0%7C1497
.bankinfosecurity.com/	1970-01-21 03:35:31	Name: __gads Value: ID=2617da1f98bde3cc:T=1707235088:RT=1707235088:S=ALNI_MZaW0UWj0NqfNR4zUlkHBRo1L4Y_A
.bankinfosecurity.com/	1970-01-21 03:35:31	Name: __gpi Value: UID=00000d5222679f78:T=1707235088:RT=1707235088:S=ALNI_MZk4BCL1FXMsdyV8pGRkek6KRMPcg
.bankinfosecurity.com/	1970-01-20 22:33:07	Name: __eoi Value: ID=41b146f8f0ec3f47:T=1707235088:RT=1707235088:S=AA-AfjbpCPVWqNtTDoN39lP3dcsO
.6sc.co/	1970-01-21 03:49:55	Name: 6suuid Value: b4641102bc6601001057c265ef0200000ffe5d01
.doubleclick.net/	1970-01-21 03:35:31	Name: IDE Value: AHWqTUlCQuBc-KxonK50cntK42n5yPxKYJCvQWGtmCfyBcQJq58auXTovBaBG1TH0mI
.linkedin.com/	1970-01-20 20:23:31	Name: li_sugr Value: 26a1b8db-d400-49da-9f3b-80828a418da2
.linkedin.com/	1970-01-20 18:15:21	Name: lidc Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2789:u=1:x=1:i=1707235088:t=1707321488:v=2:sig=AQH0q9bjKtltUxb3uthinb1rW6BqwqfB"
.bankinfosecurity.com/	1970-01-21 03:49:55	Name: _ga_XJ8Q4QGGRH Value: GS1.1.1707235088.1.0.1707235088.0.0.0
.linkedin.com/	1970-01-20 18:57:07	Name: UserMatchHistory Value: AQIw3m9IxWD9UAAAAY1_JBpHA38VA7EKwOy16fuVY7-sQvBdOOhgvwEVL-303SfR0dbfeUNKvY7Bxw
.linkedin.com/	1970-01-20 18:57:07	Name: AnalyticsSyncHistory Value: AQIhhmfBoJXwXgAAAY1_JBpIJbGr4aXFHkd-d-iIi4pRfYRq7ROOIQteYPXW73A6hBdyRJej9c_KZLMk7ZANQQ
.linkedin.com/	1970-01-21 02:59:31	Name: bcookie Value: "v=2&3a0e6114-e1ec-49f2-8e41-c21dde64789f"
.www.linkedin.com/	1970-01-21 02:59:31	Name: bscookie Value: "v=1&20240206155809c2c3157e-a40e-4519-858c-2fb6ee4333dfAQEejtsQIOxKGJc-itKyoTMveg_CoOcd"
.linkedin.com/	1970-01-20 22:33:07	Name: li_gc Value: MTswOzE3MDcyMzUwODk7MjswMjFetTK4VzIWmoR4Yr1ghDU9WTwe/0bK6bIqGAtoG3iJPw==
.bankinfosecurity.com/	1970-01-20 18:15:21	Name: _clsk Value: z4qkx0%7C1707235089413%7C1%7C1%7Cp.clarity.ms%2Fcollect
.bing.com/	1970-01-21 03:35:31	Name: MUID Value: 0CE97FC4E15E6BAE12696BD9E0356A62
.c.bing.com/	1970-01-20 18:23:59	Name: MR Value: 0
.c.bing.com/	1970-01-21 03:35:31	Name: SRM_B Value: 0CE97FC4E15E6BAE12696BD9E0356A62
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 03:35:31	Name: MUID Value: 0CE97FC4E15E6BAE12696BD9E0356A62
.c.clarity.ms/	1970-01-20 18:23:59	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 18:13:55	Name: ANONCHK Value: 0

88 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lsajoxa8&c=1416420255425724&e=95323524%2C31061691%2C31061693&ctx=1&met.9=1.1ca~13.1f2~2.1fc~9.0~3_1.1gg~7_1.0~7_2.0~7_3.0~7_4.0~7_5.0~7_6.0~7_7.0~7_8.0~7_9.0~7_10.0~7_11.0~7_12.0~7_13.0~7_14.0~7_15.0~7_16.0~7_17.0~7_18.0~4_1.1ka~5_1.1kh~5_2.1kh~5_3.1kh~5_4.1kh~5_5.1kh~5_6.1kh~5_7.1kh~5_8.1kh~5_9.1kh~5_10.1kh~5_11.1kh~5_12.1kh~5_13.1kh~5_15.1kj~5_16.1kj~5_17.1kj~5_18.1kj~5_14.1km~6_14.1kn&met.3=74.1fh_2~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fj~43.1fj~74.1fj~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~74.1fk~947.1fk~43.1fk~947.1fk~1.1fk~947.1fl~1.1fl~947.1fl~6.1fl~91.1fl~947.1fl~86.1fl~95.1fl_1~95.1fm~95.1fm~95.1fn~95.1fn~95.1fn~95.1fn~95.1fn~95.1fn~77.1fh_7~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fp~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~724.1fq~894.1ft~894.1ft~1132.1fz_h~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~808.1gh~646.1ka_1~646.1ka~646.1ka~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kb~646.1kc~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1kd~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~800.1ke~647.1ke~965.1kg~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kj~801.1kj~825.1kj~355.1kj~825.1kj~801.1kk~801.1kk~825.1kk~355.1kk~825.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~598.1kk~708.1kk~774.1kn~653.1ko_a~801.1ky~801.1ky~844.1ky~844.1ky~844.1ky~825.1ky~355.1ky~825.1ky~598.1kz~708.1kz~680.1l3~824.1l3~824.1l3~112.1l9_1~1121.1lc~783.1lc&met.10=1_14.CAAQABiAmHUg5w4oAA~1_18.CAAQABiAmHUg5w4oAA~1_16.CAAQABiAmHUg5w4oAA~1_3.COgCEAAYgJh1IOcOKAA~1_5.CIYDEAAYgJh1IOcOKAA~1_15.CAAQABiAmHUg5w4oAA~1_2.COgCEOgCGICYdSDnDigB~1_12.CAAQABiAmHUg5w4oAA~1_1.CAAQABiAmHUg5w4oAQ&met.7=CBsQCMAB7oOk1AE~CBsQByCVBjjzAcABwoSDtAg~CBIQBxgBIJYGKJYGMMQGOC5AmQZImQZQmQZYrQZgnwZorQZwwwZ49xOAAcsRiAGztgOqAVEKT09wZW4rU2FuczozMDBpdGFsaWMsNDAwaXRhbGljLDYwMGl0YWxpYyw3MDBpdGFsaWMsODAwaXRhbGljLDQwMCwzMDAsNjAwLDcwMCw4MDCwAQG4AQPAAdbHu8gK~CBsQByCWBjj2AcABj_qT_QQ~CBsQByCWBjjxAsABuqX8xQs~CBsQByCWBjj_AcABjcHOwQY~CBsQByCWBjj0AcABkKnczgc~CBsQByCWBjj2AcABipXD1Q4~CBsQByCWBjj2AcABw7PF6QM~CBsQCiCWBjj4AcABmMSenw0~CBsQCiCWBjjtAsAB3tOQ0gk~CBsQCiCWBjj4AcABvpuK5QE~CBsQCiCWBjj1AsABwuDxjg8~CBsQCiCWBjjwAsABoO2rogM~CBsQCiCWBjjxAsAB2e7c7Qw~CBsQCiCWBjjsA8ABt4O6sAI~CBsQCiCWBjjyAsABzo2epAc~CBsQCiCWBjjoA8ABjNig_Ag~CBsQCiCWBjhdwAHu4LLsBA~CBsQCiCWBjisBMABxJ-RxQ8~CBsQBiCWBjhswAG5kP-oDQ~CBsQBiCWBjjyAsABrobBjg8~CBsQBiCWBjiMAcABuM_ayA4~CBsQBiCWBjiWAcABvaPf5A8~CBsQBiCWBjinAcAB2PSUiQU~CBsQBiCWBji7BMABqo_noAw~CBsQBiCXBji7BMABkdmzpQ4~CBsQBiCXBji-BMABktOtgAE~CBsQBiCXBjicBMABnajSzAk~CBsQBiCXBjipBMAB4Obq6AQ~CBsQBiCXBji0BMABwpXb3gk~CBsQBiCXBjjEBMAB3aih4AY~CBsQBiCXBjjFBMABtdPfrQQ~CBsQBiCXBji_BMAB3a6hqgw~CBsQBiCXBji7BMAB96nK-wQ~CBsQBiCXBji_BMABpqXs-gw~CBsQBiCXBjj0BMABqPzjwQo~CBsQBiCXBjjsBMABwaio3A8~CBsQBiCXBjj1BMABrqbjgQI~CBsQBiCXBjjrBMAB6J_D4Aw~CBsQBiCXBjjzBMABnO3Xsg4~CBsQBiCXBjiMBcABpNfy2wk~CBsQBiCXBjiqBcAB2N2T4Qo~CBsQBiCXBjiHBcABr43gzA8~CBsQBiCXBjiLBcABxei3yQI~CBsQBiCXBjiNBcAB4rik7ww~CBsQBiCXBjimBsABnJz88g0~CBsQBiCXBjj_BMABuZ_c2QE~CBsQBiCXBjiPBcABk8jS4wQ~CBsQBiCXBjiNBcAB9cOi1QE~CBsQBiCXBji6BcABrdW6kwo~CBsQBiCXBjiiBcAB_ZiohQk~CBsQBiCXBjioBcAB8_3uggM~CBsQBiCXBjjXBcAB_8PS-Ao~CBsQBiCXBjjeBcABvbqS6QI~CBsQBiCXBjjnBcABuoin0gQ~CBsQBiCXBjjyBcABs6LNkQs~CBsQBiCXBjjOBcAB-cqKywM~CBsQBiCXBjjaBcABgMSatQo~CBsQBiCXBjjcBcAB2YO-iQ8~CBsQBiCXBjjcBcAB3J3piAg~CBsQBiCXBjitBsAB67D7zQg~CBsQBiCYBjiFBcABieesrAU~CBsQBiCYBjiUBsABv6XBwAU~CBsQBiCYBjiWBsAB1PGj1w0~CBsQBiCYBjiiBsABnsrdjAY~CBsQBiCYBjjvBcAB2fLU8QM~CBsQBiCYBjjyBcABn-rI6gk~CBsQBiCYBjiSBsABpOjx0As~CBsQBiCYBji-BsABuO-54Q8~CBsQBiCYBjjCBsAB5su38wE~CBsQBiCNBzicBcAB-prw2A4~CBsQBiCNBzigBcABl9zEngo~CBsQBiCNBzioBcABkpD39AM~CBsQBiCNBzjmBcAB5MuGpg8~CBsQBiCNBziaCMABpf289wc~CBsQBiCOBzi4BcABroyFyQ4~CBsQBiCOBzjEBcAB-MaNmQQ~CBsQBiCOBzjcBcAB99SG5gc~CBsQBiCOBziFB8ABur6n9gY~CBsQBiCOBzjDBcABovn98QY~CBsQBiCOBzjIBcABj4HM5Qs~CBsQBiCOBzjJBcAB4LDM0Q0~CBsQBiCOBzjSBcABqsGBzwY~CBsQBiCOBzjUBcAB95vW2Qw~CBsQBiCPBziJBMABz4325Qg~CBsQBiCPBziUBMAB_-u9qAo~CBsQBiCPBziHBMABzdqGtgc~CBsQBiCPBziJBMAB3uLRlQE~CBsQBiCPBziMBMABs9nT_Qk~CBsQBiCPBzjTBcAB0dGH3wc~CBsQBiCPBzjYBcABjqjF5Qc~CBsQBiCPBzjsBcABlqGEigc~CBsQBiCPBziOBMABytPJywQ~CBsQBiCPBziSBMABucjO9ww~CBsQBiCPBzjoBcAB1baCxgE~CBsQBiCPBzjxBcAB7Zfz1Ao~CBsQBiCPBzj9BcAB3MXS1QE~CBsQBiCPBziIBsAB9YWUvAg~CBsQCiCPBzj0AsAB5qSx-go~CBsQCiCPBzj9AsAB3PvSmwc~CBsQCiCPBzj8A8AB_JzmwwM~CBsQBiCPBzjvBcABpOHSywM~CBsQDiCPBziWBsABqMv6xwY~CBsQCiCPBziRBMAB6uf5ZA~CBsQCiCPBziTBMABps3ulwU~CBsQDSCVCjiyBMABmJy70AM~CA0QChgBIJYKKJYKMLMNOJ4DQOoMSOoMUOoMWP4MYO8MaP4McK0NePjnAYABzOUBiAGCgAawAQG4AQPAAeHb5t0L~CBsQCiCWCjiIA8ABppfwuQ0~CBsQChgBIJgKKJgKMK8NOJcDwAHVntOmDA~CBsQChgBIJkKKJkKMKkNOJADwAHVntOmDA~CBsQAiCbCjiFAcABmvLQhgI~CBsQCiCgCjhMwAGs0ZcB~CBsQDiDGCjimAcABmLT6xwY~CBsQDSDECzgywAG7qK7kDw~CBsQCiDHCzgPwAGQs9mvCg~CBsQCiDHCzjuAcABpeiwkQI~CBsQCiDICzjvAcAB34OR-gE~CBsQCiDICziFBMABuKHn2w4~CBsQCiDICzinAsAB0eKixAg~CBsQCiDICziKAsABnvymtg0~CBsQCiDqCzjxAcABiN6rsQM~CBsQCiC2DTg2wAGz_rGUDg~CEMQChgBIMsNKMsNMIsOOEFQyw1Y6w1g2Q1o7A1w8w146MQIgAG8wgiIAZ6hG7ABAbgBA8ABlejMzQE~CDwQDRgBIMwNKMwNMJkOOE5QzA1Y6w1g2Q1o7A1wmA543AKAATCIAUWwAQG4AQPAAejUr80J~CBsQChgBINwNKNwNMIoOOC7AAYzV2OsE~CBsQChgBIN0NKN0NMIoOOC3AAYzV2OsE~CBsQCiDeDTjNAcAB54OQmgY~CBsQCiDhDTgywAG_uOuBCg~CBsQDSDpDTgUwAHUvYfjBw~CBsQDSDpDTg2wAHHrrytDw~CBsQBiDqDTjSAcABwuuhkQg~CBsQBiDqDTjTAcABwuuhkQg~CBsQDSDsDTgSwAHUvYfjBw~CBsQDSDsDTgywAHHrrytDw~CBsQCiDxDThVwAG4h82xDw~CBsQBiCvDjjUAcABwuuhkQg~CBkQChgBIMUOKMUOMNEPOI0BQKwPSKwPUKwPWMAPYLIPaMEPcMsPeP3CAYAB0cABiAHNhQSwAQG4AQPAAZTdwNgF~CA8QBBgBIOAOKOAOMNAPOHBo4Q5wzQ94_8EBgAHTvwGIAfz6BLABAbgBA8ABv96a6wY~CBsQBRgBIOMOKOMOMLQPOFFQhA9Yow9gkA9opA9wsw94iReAAd0UiAGSMLABAbgBA8ABnK-4mQk~CBsQDSD_DjhBwAH9gJeuCA~CBsQCiCtDzgXwAHs7OSGCQ&qqid.1=CNOHhqiKl4QDFQc9VQgdJO8G9A&qqid.2=CNSHhqiKl4QDFQc9VQgdJO8G9A&qqid.3=CNWHhqiKl4QDFQc9VQgdJO8G9A&qqid.4=CNaHhqiKl4QDFQc9VQgdJO8G9A&qqid.5=CNeHhqiKl4QDFQc9VQgdJO8G9A&qqid.6=CNiHhqiKl4QDFQc9VQgdJO8G9A&qqid.7=CNmHhqiKl4QDFQc9VQgdJO8G9A&qqid.8=CNqHhqiKl4QDFQc9VQgdJO8G9A&qqid.9=CNuHhqiKl4QDFQc9VQgdJO8G9A&qqid.10=CNyHhqiKl4QDFQc9VQgdJO8G9A&qqid.11=CN2HhqiKl4QDFQc9VQgdJO8G9A&qqid.12=CN6HhqiKl4QDFQc9VQgdJO8G9A&qqid.13=CN-HhqiKl4QDFQc9VQgdJO8G9A&qqid.14=COCHhqiKl4QDFQc9VQgdJO8G9A&qqid.15=COGHhqiKl4QDFQc9VQgdJO8G9A&qqid.16=COKHhqiKl4QDFQc9VQgdJO8G9A&qqid.17=COOHhqiKl4QDFQc9VQgdJO8G9A&qqid.18=COSHhqiKl4QDFQc9VQgdJO8G9A Message: Failed to load resource: the server responded with a status of 411 ()
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.bankinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com
051-zxi-237.mktoresp.com
130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com
21aaef15263171502b5a-3fc6a64a094676b060fa7dc8c4490be9.ssl.cf1.rackcdn.com
4a7efb2d53317100f611-1d7064c4f7b6de25658a4199efb34975.ssl.cf1.rackcdn.com
6d63d49ccb7c52435540-5070aa97eaa2b8df4eb5a91600e69901.ssl.cf1.rackcdn.com
752b069ec945bee67d86-1021436e05aad7b2347bf3096cc7e309.ssl.cf1.rackcdn.com
75d03c5f1bfbbbb9cc13-369a671ebb934b49b239e372822005c5.ssl.cf1.rackcdn.com
b.6sc.co
bankinfosecurity.disqus.com
buttons-config.sharethis.com
c.6sc.co
c.bing.com
c.clarity.ms
c.disquscdn.com
csi.gstatic.com
d47e506614d4c78acf26c9a455c56075.safeframe.googlesyndication.com
dbac8a2e962120c65098-4d6abce208e5e17c2085b466b98c2083.ssl.cf1.rackcdn.com
disqus.com
dnn506yrbagrg.cloudfront.net
epsilon.6sense.com
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
fa94d5c47256403c613d-7164cafcaac68bfd3318486ab257f999.ssl.cf1.rackcdn.com
fonts.googleapis.com
fonts.gstatic.com
in.ml314.com
ipv6.6sc.co
j.6sc.co
l.sharethis.com
ml314.com
munchkin.marketo.net
nexus.ensighten.com
p.clarity.ms
pagead2.googlesyndication.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
referrer.disqus.com
region1.google-analytics.com
script.crazyegg.com
securepubads.g.doubleclick.net
sjs.bizographics.com
snap.licdn.com
tpc.googlesyndication.com
worker.ismgcorp.com
www.bankinfosecurity.com
www.clarity.ms
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
f5bd7c2823d8d0533dcb-62d55445ed2ff88556926faa498f48fa.ssl.cf1.rackcdn.com
104.130.251.6
108.174.10.24
13.32.23.57
13.32.27.61
151.101.64.134
18.158.171.174
192.28.147.68
199.232.192.134
199.232.196.134
2.17.100.184
20.122.63.128
2001:4860:4802:32::36
23.36.233.236
2404:6800:4003:c05::5e
2600:9000:20b4:3800:6:8656:f5c0:93a1
2600:9000:2156:8e00:1d:85c3:6640:93a1
2600:9000:2449:b000:2:8f43:5780:93a1
2600:9000:26bf:2c00:c:abe:f440:93a1
2606:4700::6813:9308
2620:109:c002::6cae:a14
2620:1ec:46::45
2620:1ec:c11::200
2a00:1450:4001:806::2002
2a00:1450:4001:808::200a
2a00:1450:4001:80e::2001
2a00:1450:4001:811::2008
2a00:1450:4001:828::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a02:26f0:480:f::213:7ec6
2a02:26f0:480:f::213:7edd
2a02:26f0:ab00::214:8e70
3.70.37.50
34.117.77.79
50.56.167.254
52.3.3.203
68.219.88.97
88.221.60.75
0037005ca3e7cad32331724064278a8cfc3915a31eab50eb1e074f97fe9902a6
0128a2b84715955d6423533d55f49ac694734e26e11c4cbac84b41b5e3dcf826
04d304d7ee49ac157f146382a46f02a666279bd7f29074f50e863b88f2affae9
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
06956375a31351710d06ae9985d2005d690e85f20ae2de378551a935a25c2807
074c7a539b6831ab8e490eb77526c32385c0aedd230f7b58beab6f07e83b5cb5
0796855a346bff8e4ade9180ebacd3068499671f45d1ec770eee18c51ef161ec
09bbed0d4841d1b1b5df95504ef8e54d487ec069ef30a3166888201e0477d82e
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0d89a31166d19c272c345350a29db0adf773a40ca80277d37d0c2c5001e5f458
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
11c1f744dbd4b584d8c0cfb6aa4daaafb436bb603fd98c8c40312c3818074dde
11fd13f8f29a24f1c6dbc2b11b911da664f3f10bebf0274994c4ea96e260b9a1
1673eae10c03e27b6afd689c3b071339409173dd39bf1957e4992359d4365ce1
1a0bbdba57f90a60fef89419fc940d8eae55c5b0d12ecbadde2beaef32ab2d90
2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e
20b9ebf817b8dc640c06e993e5ae1127a6eb6b0c9fc6acbfb288f3b3a82405be
247d04c4d14c60a79c16245a74a792a662f9e7adf784d68edd4520a35ec90251
24845b3525ef264122621c6f4b253a57ff5fa29fc0d0124a571a79309768cf84
24b019a14e08c383ecdfbd56b8431bbae6c7f7e06f93259d8ccead0f29bc7055
256a489beea4a14eca458f6e5436758f1fcb8dd34034d3c36dd21b22a5841f3b
257f20a7e3386e3ac34f490d9e80a8ba92f1970673f68b6e59f3e462cb0f10bf
2a22629f693e5e719fb878d1f66253ada74073d14b34d989e1f3b757d07bc753
2d1af98c639de191d78628c8fef70adf8d3471a5348c046cbb6118df3f92dc5c
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
2de02d03fe17f1ba92947096633b6b947125174fa92b2ee4ce83f40026ba72e8
2ec26a5eb530593b66ae9cec229283e264adf8da95f880438f44a05773a70d7f
3059f92e36a564c5cbcedc195f764e3c55c8cf919c84129c5f202870e7026b61
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
34f6a8e7792bc499cdcfcfae70d35a02766db4471551ec36844c3214357d6163
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3cc140fd4081da354be60f283433bf116f143735f1317cc5835f362c44829e8f
3fede2d0c0a8c93b0c5d0ab0c38289a5743bb88720255b8298c520d2e3d90939
4179815331b1b050e45da1ccf1d1a8cb50904e1cbb92228b32d55d545d4aaf7c
437860176a95945e3db394634a18e4915aef8a951a5c22300ee086d54ef754ec
441132f48c606bab601058cec5283d3268d69356c7124b04476d42207db99163
44e03ccf8839ff7356f104bb9965caeb9df84eeef9ff000da94d8bd3f3feafe8
4546d13ea9bae9935dcd23f61d215a528120a53479bf51e372de3420029ed535
45bed7b536973adb285bd15e4fdb6d6fd9b316c0ca9bd070c1721616901e50e9
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
48f162f20cd96a323eb9b6d71a77d7223dd33f03422ebe8c9a938873b00a4977
492ee0c3d23abc7bf7f07b6e3ec7022dc70ce54762569a42a2ffd845f28419a7
49837165e103d2da44980334e07d1470d4267541ccfbee2263575dab948004ea
4bf9758e9c8a24a861409c8ae5e74d96ff346ba4cd8590de37e21224d0610f98
4c1d40bbc07ff06b281dd7b94d81c865fd19555a8722a2821adb24b4ba9ba632
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4c54fe3fc930f69b6f20a97d122260ca5d1f34b1441d0e186ebc86b86c3c0bea
4dbc45bd7ed8caf2aeeae8de34e519d874987d5285c79b5b4a93a1d670a929c4
4e2db1bef009e01901b4083a153f1607301428277a76f508e659dc2849cefa04
4e7304371ef9bcaea396e8928a9647f8306c296b9195c8763848d70c7f6f1390
4f62bc200208bf1449e4c1f8decc346e7d041cc89797d529f8dc3f61e91d0f01
4f785422f51f7229ba51f8b7478f504049de257e523b4de14da1781fb5c2b6c3
5133e2e1a213ca44a8adb1f42f103a2d2e495849dfa4d42bf67c04fcc962e577
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5593ddea78c0601873b3ca109f202cb261ffdc9b9d247438500c2c8c3b5a7f3f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56d67bff3c0d11af3f7b09d825eca83408c0017d7c34a03678f0f9433a97819d
59400de556b42dee4aa3e6f7b73676a81e260d35481b6d8d77656ee45ae9484b
5983be7036fc26270495fd1a318795ac3538b9e8e8a34dff25685a3e4fbe3858
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a2dcc98890f7760ad225371f7267d1320deb196ab8452535c4e0fd00c2f6a70
607c3280b75439b059201fb530324b36ed8eed8c3a5cd4e66ff374f5551d1d3b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
69278fe35261286939e10f3832f461f9bf6addf267ffe0134e26be3d313dbd7d
6a04372ebed54f17b93d9ae4c22427985129d4c1781b319a5fadfc07fb6bd60c
6be97ca17228a69c406231d89c003194c3dfba7401eaa9fe9e9ed0ef1c18dc38
6caf904d3dfc096ae3b4e40aed43181686bdf1bac4722b3dd2a775ab6d2a9992
6cf69d813a1162f382adccdcb43ee508612a5eeb1124fcf8c0ea6a9b44dd3e20
6e59d89c803c7dd3d1b529f8539473c69112f1b5923e9e99d7e69d8ac34c25a4
6ec9288103b5919c36e28909faf04364cdf19cf7687e234663d0d9daab65a3c0
70ce461c5a6d2ddc752ae244d38be0a4c760999306c7ffdec80206bd841d698a
7195d1e051d74dea55f4bc4081fe0d7b1bbfd397e0b182434cf1aa003624ff65
7498bb5e0fd8361da37a2982405883bd697fb64d5467bf6bfa36aa833af4c265
74f6149451e9771ff198839c50988e2edb5f7e191eea16c7ed01fa0120f7c50a
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
78b999dc2ab7a8d2dd68affa1ec5e3ed00765db647013b8e673dd6f20e5e4b0f
78cf63898c91ce3b95e37bc53e07adba5c2ee705ff28c2dd1dd784173c264ad1
7b1f1149b35bdc7a4ad9e37242331df369538b19116d6f08656048728affc113
7baaef85b1c6761ac939c7dc62d8cdd899f179113d7a1f55925dc82c15bba0b7
7cca33fae5bd6a929262d4e76e4ab14457109e7194f60b13bc86ece4ce585eed
7cf7d487e1d3f0a2787f1ee2aad15862dcfc7d5f6883e275680568e9e4989d9f
7d4205b1f3bdda5c966c87b69975ed9bb6230c03b037a2f67de5cf3c2723259c
7d5e2f10ede290b4ad0d1bb2861dfacae9754453f352923e85e7d101a7686b00
7e1a48181248769e8ecd2cb2524e8aabd3667028fbcf699ff993acb5be8af410
7e31fb7e7c8fa01e6b89b3cfb109953e431aedc41c61b8d43429fade2af6b670
7f25f3e36fa11fa05c202cd2140507c5a89bcf43fd96b6848f2362ce9e35ea4a
7f83ea973e4739eb4a3d39bf8bac90016fa95d0167c45d3b883d34f39868e132
7feb9afd2b66cb0776368af51a4e74d22787d4cbe836e1d6490fc1badbd46d5e
7ff5b98c09ec9d2af43d4108160ea0455f91f415f83031cc79fbe24a3a765bb8
84af93c376277b2fb1c7962b45ce84e1e0a31202815ceb873bd980df4378f62b
8949f4df9776d1bd31694cc9f2c38ea0c5d8d3ecac95380a5afc08adc2ff96bb
89f4889eebc36f4ad79abb20ba84c4e8b0dac9bce1c0dfbe779ac8d5022572bd
8a09d82bb8de2c031e4d69743fb3c693add896cc4fff7d741ebb0d8aff0f3d20
8bc7f122cae9e9efd75cd58076d06fb057d8f50abf07ffc1716e17d87682b9cf
8dc675da542f629aca965669b35900a5ed0685f4d87dce9eac4660baf4493687
8ec5d3507fac6825a9fcc3a38795eac85328707722ad23076021ed774dafc05c
91283916a6e9695687bb57ed913fe6fae10324ebfcfa06d31209357e56ebc004
93f466f6b1a81c848140e51c839a5372034ab22182601e86dd86947ad3a7fe94
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
973329cbeaebf60b87a29ec5651af3302c3cdc4c3dd610bf18b6ff346087428a
97fede359991df79883efa68e75db4c07d30dd92107a4b8c1e9147b4c159f2f4
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a13fb5949ace41b41f2baafd0749b4a9e3b98a86082246980d785c0f0e2f494
9a239336eaaec20b11b5821eedefa84951192522f883c8ee7abdd82f465e1490
9a79f5111b6cf3429bd269120dd56499ef9e94f11d008e0c98c29dedd1b7a81d
9b049901e9128b68e8d5e1003480f05af58204d3d3480d4511baa971f505c9b9
9c8bb391a723e088d163b560afa73f709c42a69df5647c4fefce9d16e4226895
9e6a65223dc776b7830b0b553588901ae88c66bab32892139e65759b8073980d
9ed16a869e6dc635f5ff68dc633b32ce2ff4873c7f74beaca71991403270bc9e
a0f7f41a6e614d69e39bd0a870dea132a7859adf0e88c62dabe0bf3a90df8cc7
a1cec7a73b7845d303d289011ccc629bad30dec4e599c12ffbd58be5175f4293
a4692a7234b95c9908d1a9068f1bc9191815a6b1d9e3b3b84ad12ee10caaaaee
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
a817a6678bf83733f484e02dd5dcc010b15d56b160f04724045de22644858557
ad74f3a3150b7ab51dea8b012260d62049ab69cefe6e57c1d6a9523627e58962
ae3c472ff47a96820c1acdf9574b231a88f62a006b84d320eb313af40f32f2db
ae891978abe1e901d58b28cf3786c68cac9f4661f4b984ff95f10e21afbf1161
b00ed7ac792010cdeddcb5d6c719ff7e719e5046dedac2053b3caf64fceb579a
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b05b9ee987ebc7a1401b1f8d13f08664eaaddbff5f5abf456d4171ce63175cf5
b157d1fbbb8573e80cb45c09d2ddf858dc72e751553f755c2b9d344406d77b97
b1a4ee7a5e63ba82563a6ba3a12281c6392ca5d81e29400926edb180042e9699
b27d3e9bcba0946c12ab6ddb165142863f8f0942738ac8ba44219a1eb6df56ec
b290618c6a5c2dd4b007f08778431d033d20fd379b4e9dc4f173e11e2a965116
b2fe03efc1e879c2c5bd27bf86f71ad3790b0d6765498480f4c8071fa7f59051
b3505df227de2cb4b76ceb42b3f7073b39487a9215f051d40420b7cb06e9174d
b4998e8eac6e6b71ba8a3b23146a3d6745d63ca54302217ba581cb4a36f4bc39
b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0
b563caa10c1bce2d2d8554e559906a157bb36a6102cd59f32534dd75c6050dc6
b8d3e4ca0f232cefde35437af4ec2c3b305c672f65816b7101a230ee9e5a3ed4
bb5dbe79a895b0ffc0bc472eb3a337b2e645a738fc13fa539829d477574e1363
bbbd7bccd313fafa0275f24bb6c30268a0f26f668894cf2ac68a664d95a962f6
bfa019c7d05a2d35b831c4b843070397d763df4a965c59fa5ffaeae398ad0ade
c15d7c72b50d4cad5e7a1fcbd75c78ded4c75eaf3ec382783a1903f88e6db1cf
c2b12be678a6fa2f8518a327911d6d3f70379cc67f3853888cdee84d157071ff
c4309cf270cbc7d300e797f598b5c2f504d2b59ea5894bd7b9fad38528b2f8ab
c5ba82a495ae1dd01b002d056b460cfbe0e6d39a3622b8297eb612f8326141ef
c637139f15a428e7535c715251f673a5ca6066d26e302ea7e17f5b4732ee8c11
c70242480ad0a0ecc7c305d659f1fdb3a9cb1eb480927b46f8bd62d33ed0f8b2
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
cbcfb303a1e7d1f9da8965565b535f4122f2de2f1f3ed9f61f3f9e2dad3dcf9d
cbf752138ffa9b2b63a3f2ae784179dcc379bd68aad03e2166efacccd3f1a956
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf9e92205faeb2fc9929f8aaf67ee6fb15084be8994babd310cfa01d62e29e5c
d3dd4aead24e892b4fdcc7d50da8ef64ee5f6444327ac476ab85172577649cef
d7299f53c4e3975280f5d8e9245bb5404f203f29b5313288e32f50e1f2a05ceb
d7c0ed829f0d3b7b030b784ea0cbdd00bba9b9d9e1081586ebc9d4a563df3ea7
d8b70e292d312ceb95a91962382d246c54ef08ccb92adb4e0f7f96a426f6d922
da00e3e9fa1fb6356a9997d4794f010da2ce6072a9555abc3e2d219856425ae5
dabc60c4db193b2b29dc19c11a766e26d7d8664b2db9817609f5d6b372dec654
db0424fb67fb52e7e538490240cc7fb9c05aa076333a4968f3dee30b825dabf9
db09a654856e55907e1cd561c2181369e55465677c4f57f922b24f2121a35861
dbc06b8f6a8ba1228029faa96f791edaaf1905a1dea7e6272dd9325d9bf1669e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ded6101d82578d3800f23d67c7a0b644f7083508800a9ecb69af2e84a5bff7a5
e084f5c9b083ce4c468b6b2799912dcea492c531331999a8bd9dd082994fd4ea
e2fd1fc6faac843a1901fa66c6f3e23a68407892b33609e5ee57d67a6c5c4b01
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51831d751ef667b1f703a47bb05802b681e6a30816f5cce0d56c3552a4eaa31
e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2
ea3325c2094d82033ce9583d4180194fb82729dfae65b62925831a88a6838d7c
eb9ec684a7198fded61e248eaff2d28d0c9f8a15dfee8d9afff66aa6ff200461
eccabf5cc7613433c3ddc71ff34391ae850d304d3aceb5666868c4947134f3b5
ee4e31761269d7e3895fbd3d324c99b585a662dd95c69c9845c0732876024b50
ee84bb98f48cc5ad6dec84ddd7451861266d743a610be9c5d605c5dac95ddf5f
eed710ecb48e84959f1942bd51bc228c4c946f04f0580a938553e33bc197af2c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f690e65670c87845e14e1a74c68e746ba0a479bb363a04fe4d0da2db5dccb10b
f9cef2361426c656474837992a2019b712582d95e55ccba23341ce9f2389ec2a
fa371650b1d90a4c94469bc10fddff54c01579cd5f2f30b6af280c3966e8a37f
fc54c09a7a71615ec35a22ed20afa4034588986ed88c3fc184b2c0bc637c33fb
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff193e26084aece1f313a6a6c20794fa4e549b57b849b528224e0ecefff7fd1e
ffda8418fcc29c206c4dfec14d4dda5c2771ae0aecb332374ba88a22d13e8fcf

www.bankinfosecurity.com Open in urlscan Pro 50.56.167.254 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

212 Requests

99 %HTTPS

55 %IPv6

27 Domains

52 Subdomains

40 IPs

4 Countries

11560 kBTransfer

19214 kBSize

31 Cookies

47 Outgoing links

Redirected requests

212 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bankinfosecurity.com Open in urlscan Pro
50.56.167.254 Public Scan

Screenshot
Live screenshot

Full Image

212
Requests

99 %
HTTPS

55 %
IPv6

27
Domains

52
Subdomains

40
IPs

4
Countries

11560 kB
Transfer

19214 kB
Size

31
Cookies

212 HTTP transactions
1 data transactions