www.trendmicro.com Open in urlscan Pro
23.206.209.41 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/PYC2citHVQ
Effective URL:
https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_so...
Submission: On September 23 via manual (September 23rd 2024, 5:26:31 pm UTC) from US — Scanned from DE

Summary HTTP 209 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 56 IPs in 6 countries across 46 domains to perform 209 HTTP transactions. The main IP is 23.206.209.41, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on June 10th 2024. Valid for: a year.

This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	67.199.248.12 67.199.248.12	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
49	23.206.209.41 23.206.209.41	16625 (AKAMAI-AS) (AKAMAI-AS)
8	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::6816:1c60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	2600:9000:235... 2600:9000:235a:a200:7:2bfb:7c00:93a1	16509 (AMAZON-02) (AMAZON-02)
9	2a02:26f0:470... 2a02:26f0:4700::210:238	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:c90::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	35.201.125.192 35.201.125.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.214.161.17 52.214.161.17	16509 (AMAZON-02) (AMAZON-02)
1	34.111.194.12 34.111.194.12	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a02:26f0:e30... 2a02:26f0:e300:186::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	52.17.201.122 52.17.201.122	16509 (AMAZON-02) (AMAZON-02)
1 1	34.252.69.234 34.252.69.234	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:470... 2a02:26f0:4700:29a::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
1	52.49.43.23 52.49.43.23	16509 (AMAZON-02) (AMAZON-02)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1 7	2400:52e0:1e0... 2400:52e0:1e00::1079:1	60068 (CDN77 _) (CDN77 _)
4	18.193.54.173 18.193.54.173	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:10:... 2606:4700:10::ac43:2794	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	52.222.214.66 52.222.214.66	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:10::210:a99	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
11	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.201.250.60 23.201.250.60	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700::68... 2606:4700::6812:1247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.172.103.101 18.172.103.101	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	37.252.171.53 37.252.171.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:206... 2600:9000:206f:aa00:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223c:400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700:10:... 2606:4700:10::6816:46c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	154.59.122.94 154.59.122.94	174 (COGENT-174) (COGENT-174)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
6	35.80.96.223 35.80.96.223	16509 (AMAZON-02) (AMAZON-02)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
4	18.215.47.1 18.215.47.1	14618 (AMAZON-AES) (AMAZON-AES)
209	56

1 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.199.248.12 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: cname.bitly.com

research.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 23.206.209.41 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-206-209-41.deploy.static.akamaitechnologies.com

www.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:1c60 (United States)

ASN13335 (CLOUDFLARENET, US)

customer.cludo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2600:9000:235a:a200:7:2bfb:7c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:4700::210:238 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

trendmicro.scene7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:c90::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.125.201.35.bc.googleusercontent.com

cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.214.161.17 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-161-17.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.194.12 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 12.194.111.34.bc.googleusercontent.com

ixfd2-api.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:e300:186::11a6 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
02179915.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.201.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-201-122.eu-west-1.compute.amazonaws.com

trendmicro.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.252.69.234 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-69-234.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:4700:29a::11a6 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.43.23 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-43-23.eu-west-1.compute.amazonaws.com

resources.xg4ken.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2400:52e0:1e00::1079:1 (Germany) 1 redirects

ASN60068 (CDN77 _, GB)

load.sumome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.193.54.173 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-54-173.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

resources.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::ac43:2794 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.214.66 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-66.fra56.r.cloudfront.net

widget.equally.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:10::210:a99 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.201.250.60 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-201-250-60.deploy.static.akamaitechnologies.com

origin.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1247 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.172.103.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-103-101.fra60.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.171.53 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:aa00:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:46c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.59.122.94 (Schiphol, Netherlands)

ASN174 (COGENT-174, US)

e.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

945-cxd-062.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.80.96.223 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-80-96-223.us-west-2.compute.amazonaws.com

sumome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.215.47.1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-47-1.compute-1.amazonaws.com

api.equally.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
51	trendmicro.com 1 redirects research.trendmicro.com www.trendmicro.com resources.trendmicro.com	5 MB
25	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1434	72 KB
13	sumome.com 1 redirects load.sumome.com — Cisco Umbrella Rank: 21809 sumome.com — Cisco Umbrella Rank: 19780	450 KB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 5604 c.6sc.co — Cisco Umbrella Rank: 6942 ipv6.6sc.co — Cisco Umbrella Rank: 5748 b.6sc.co — Cisco Umbrella Rank: 3490	21 KB
9	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	750 KB
9	scene7.com trendmicro.scene7.com	220 KB
8	equally.ai widget.equally.ai — Cisco Umbrella Rank: 110698 api.equally.ai — Cisco Umbrella Rank: 112187	331 KB
8	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 917 www.google-analytics.com — Cisco Umbrella Rank: 34 region1.google-analytics.com — Cisco Umbrella Rank: 3714	40 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 313	179 KB
4	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 330 px4.ads.linkedin.com — Cisco Umbrella Rank: 6838	2 KB
4	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 4344	29 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 2787	10 KB
3	doubleclick.net 5427711.fls.doubleclick.net Failed ad.doubleclick.net — Cisco Umbrella Rank: 151 9572106.fls.doubleclick.net Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 44	71 B
3	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 486	3 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 25899 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23656	2 KB
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 254 trendmicro.demdex.net	2 KB
3	youtube.com www.youtube.com — Cisco Umbrella Rank: 77	13 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 8529	725 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	3 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1506 insight.adsrvr.org — Cisco Umbrella Rank: 962	6 KB
2	bing.com bat.bing.com — Cisco Umbrella Rank: 349	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 187	73 KB
2	acuityplatform.com origin.acuityplatform.com — Cisco Umbrella Rank: 21039 e.acuityplatform.com — Cisco Umbrella Rank: 17197	3 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 92	22 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1485 pixel.quantserve.com — Cisco Umbrella Rank: 1050	10 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3635	7 KB
2	gstatic.com fonts.gstatic.com	96 KB
2	go-mpulse.net s.go-mpulse.net — Cisco Umbrella Rank: 1639 c.go-mpulse.net — Cisco Umbrella Rank: 771	41 KB
2	bc0a.com cdn.bc0a.com — Cisco Umbrella Rank: 13076 ixfd2-api.bc0a.com — Cisco Umbrella Rank: 16362	15 KB
2	cludo.com customer.cludo.com — Cisco Umbrella Rank: 15298	80 KB
1	akstat.io 02179915.akstat.io — Cisco Umbrella Rank: 100293	228 B
1	google.de www.google.de — Cisco Umbrella Rank: 11626	64 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3	24 B
1	mktoresp.com 945-cxd-062.mktoresp.com — Cisco Umbrella Rank: 810911	318 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1528	448 B
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 18243	279 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 16474	283 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 863	15 KB
1	bizographics.com sjs.bizographics.com — Cisco Umbrella Rank: 47072	17 KB
1	xg4ken.com resources.xg4ken.com — Cisco Umbrella Rank: 7241	4 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1454	490 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 487	312 B
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 442	72 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 32	2 KB
1	t.co t.co — Cisco Umbrella Rank: 844	801 B
0	twitter.com Failed analytics.twitter.com Failed
209	46

	Domain	Requested by
49	www.trendmicro.com	t.co www.trendmicro.com
25	tags.tiqcdn.com	www.trendmicro.com
9	b.6sc.co	www.trendmicro.com
9	www.googletagmanager.com	tags.tiqcdn.com www.trendmicro.com www.googletagmanager.com www.google-analytics.com
9	trendmicro.scene7.com	www.trendmicro.com
8	cdn.cookielaw.org	www.trendmicro.com cdn.cookielaw.org
7	load.sumome.com	1 redirects www.trendmicro.com
6	sumome.com	load.sumome.com www.trendmicro.com
4	api.equally.ai	www.trendmicro.com
4	www.google-analytics.com	tags.tiqcdn.com www.google-analytics.com www.trendmicro.com
4	widget.equally.ai	tags.tiqcdn.com www.trendmicro.com widget.equally.ai
4	static.addtoany.com	tags.tiqcdn.com static.addtoany.com www.trendmicro.com
4	tags.srv.stackadapt.com	tags.tiqcdn.com www.trendmicro.com tags.srv.stackadapt.com
3	px.ads.linkedin.com	1 redirects www.trendmicro.com
3	secure.adnxs.com	2 redirects www.trendmicro.com
3	www.youtube.com	www.trendmicro.com tags.tiqcdn.com www.youtube.com
2	epsilon.6sense.com	www.trendmicro.com
2	www.facebook.com	www.trendmicro.com
2	ibc-flow.techtarget.com	www.trendmicro.com
2	ad.doubleclick.net	www.trendmicro.com
2	region1.google-analytics.com	www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.trendmicro.com
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	www.googleadservices.com	www.trendmicro.com
2	ssl.google-analytics.com	tags.tiqcdn.com www.trendmicro.com
2	munchkin.marketo.net	tags.tiqcdn.com munchkin.marketo.net
2	fonts.gstatic.com	fonts.googleapis.com
2	dpm.demdex.net	assets.adobedtm.com www.trendmicro.com
2	customer.cludo.com	www.trendmicro.com
1	02179915.akstat.io	s.go-mpulse.net
1	insight.adsrvr.org	www.trendmicro.com
1	www.google.de	www.trendmicro.com
1	www.google.com	1 redirects
1	googleads.g.doubleclick.net	1 redirects
1	945-cxd-062.mktoresp.com	munchkin.marketo.net
1	pixel.quantserve.com	www.trendmicro.com
1	ipv6.6sc.co	www.trendmicro.com
1	c.6sc.co	www.trendmicro.com
1	e.acuityplatform.com	www.trendmicro.com
1	px4.ads.linkedin.com	www.trendmicro.com
1	rules.quantcount.com	secure.quantserve.com
1	attr.ml-api.io	www.trendmicro.com
1	s.ml-attr.com	1 redirects
1	js.adsrvr.org	www.googletagmanager.com
1	trk.techtarget.com	tags.tiqcdn.com
1	origin.acuityplatform.com	tags.tiqcdn.com
1	j.6sc.co	tags.tiqcdn.com
1	static.ads-twitter.com	tags.tiqcdn.com
1	secure.quantserve.com	tags.tiqcdn.com
1	sjs.bizographics.com	tags.tiqcdn.com
1	resources.trendmicro.com	tags.tiqcdn.com
1	resources.xg4ken.com	www.trendmicro.com
1	c.go-mpulse.net	www.trendmicro.com
1	cm.everesttech.net	1 redirects
1	trendmicro.demdex.net	www.trendmicro.com
1	s.go-mpulse.net	www.trendmicro.com
1	ixfd2-api.bc0a.com	cdn.bc0a.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdn.bc0a.com	tags.tiqcdn.com
1	assets.adobedtm.com	tags.tiqcdn.com
1	fonts.googleapis.com	www.trendmicro.com
1	research.trendmicro.com	1 redirects
1	t.co	www.trendmicro.com
0	analytics.twitter.com Failed	www.trendmicro.com
0	9572106.fls.doubleclick.net Failed	www.googletagmanager.com
0	5427711.fls.doubleclick.net Failed	www.googletagmanager.com
209	66

This site contains links to these domains. Also see Links.

Domain
vicone.com
www.zerodayinitiative.com
community-trendmicro.force.com
trendmicro.my.site.com
newsroom.trendmicro.com
resources.trendmicro.com
success.trendmicro.com
signin.v1.trendmicro.com
cloudone.trendmicro.com
tm.login.trendmicro.com
signup.cj.com
www.addtoany.com
documents.trendmicro.com
www.linkedin.com
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
trendmicro.com
www.trendmicro.cz

Subject Issuer	Validity	Valid
t.co E6	`2024-07-31` - `2024-10-29`	3 months	crt.sh
www.trendmicro.com Entrust Certification Authority - L1M	`2024-06-10` - `2025-07-09`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
customer.cludo.com WE1	`2024-08-26` - `2024-11-24`	3 months	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M02	`2024-03-19` - `2025-04-17`	a year	crt.sh
*.scene7.com DigiCert TLS RSA SHA256 2020 CA1	`2023-11-26` - `2024-11-26`	a year	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
cdn.bc0a.com WR3	`2024-09-06` - `2024-12-05`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
ixfd-api.bc0a.com WR3	`2024-08-19` - `2024-11-17`	3 months	crt.sh
akstat.io DigiCert TLS RSA SHA256 2020 CA1	`2024-07-31` - `2025-07-31`	a year	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.xg4ken.com Go Daddy Secure Certificate Authority - G2	`2023-10-29` - `2024-11-29`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2024-08-09` - `2025-09-07`	a year	crt.sh
resources.trendmicro.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
static.addtoany.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
equally.ai Amazon RSA 2048 M03	`2024-04-05` - `2025-05-03`	a year	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2024-07-12` - `2025-07-11`	a year	crt.sh
quantserve.com R11	`2024-08-23` - `2024-11-21`	3 months	crt.sh
*.googleadservices.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
*.acuityplatform.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-04` - `2024-12-04`	a year	crt.sh
trk.techtarget.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-02` - `2024-09-30`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
load.sumome.com R11	`2024-09-12` - `2024-12-11`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
ibc-flow.techtarget.com WR3	`2024-08-28` - `2024-11-26`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.sumome.com Amazon RSA 2048 M03	`2024-01-18` - `2025-02-15`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Frame ID: 35D15CFC27795490558CCEA81763C45B
Requests: 196 HTTP requests in this frame

Frame: https://trendmicro.demdex.net/dest5.html?d_nsid=0
Frame ID: 20E988E9202F8CDB325ED9005DB00298
Requests: 1 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=2355371282007;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=1037108164;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9188098692z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio
Frame ID: FA40379501DB924693C20800555B2B57
Requests: 1 HTTP requests in this frame

Frame: https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=5872169385511;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=499455593;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9190653197z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio
Frame ID: 8B1EC1F0FAC5A54BCD6BBA9D37EE79C1
Requests: 1 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 1C135A797005A7D7148D46F74789BD48
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&upid=803df29&upv=1.1.0&paapi=1
Frame ID: 5B53558FFF7B17C9963984432C02A642
Requests: 1 HTTP requests in this frame

Frame: https://widget.equally.ai/equallyai-widget.css
Frame ID: 57F98F0BC7939E5E977361FBDDFC7F49
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banking Trojans Mekotio Looks to Expand Targets, BBTok Abuses Utility Command | Trend Micro (US)

Page URL History Show full URLs

https://t.co/PYC2citHVQ Page URL
https://research.trendmicro.com/3XqhYP4 HTTP 301
https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-a... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

SumoMe (Widgets) Expand

Overall confidence: 100%
Detected patterns

load\.sumome\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

209
Requests

94 %
HTTPS

52 %
IPv6

46
Domains

66
Subdomains

56
IPs

6
Countries

8152 kB
Transfer

16106 kB
Size

60
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://vicone.com/en
Title: Automotive

Search URL Search Domain Scan URL

URL: https://www.zerodayinitiative.com/about/
Title: Zero Day Initiatives (ZDI)

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Gpartner/s/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://newsroom.trendmicro.com/
Title: Connect With Us

Search URL Search Domain Scan URL

URL: https://resources.trendmicro.com/GLB-Under-Attack-Form.html
Title: Under Attack?

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/en-US/
Title: Business Support Portal

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/en-US/contactus/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://signin.v1.trendmicro.com/
Title: Vision One

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Gpartner/s/login/?language=en_US&ec=302&startURL=%2FGpartner%2Fs%2F
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://cloudone.trendmicro.com/
Title: Cloud One

Search URL Search Domain Scan URL

URL: https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php
Title: Product Activation and Management

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t
Title: Referral Affiliate

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&title=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/images/TEx/Mekotio-and-BBTok-IOCsktvYaQ0.txt
Title: here

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/TrendMicro/

Search URL Search Domain Scan URL

URL: https://twitter.com/trendmicro

Search URL Search Domain Scan URL

URL: https://www.instagram.com/trendmicro/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/TrendMicroInc

Search URL Search Domain Scan URL

URL: https://trendmicro.com/newsroom
Title: Newsroom

Search URL Search Domain Scan URL

URL: http://www.trendmicro.cz/
Title: Česká Republika

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/PYC2citHVQ Page URL
https://research.trendmicro.com/3XqhYP4 HTTP 301
https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://cm.everesttech.net/cm/dd?d_uuid=50693505083781453493726642188009331867 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGkvwAAAE8YDAOV

Request Chain 111

https://load.sumome.com/ HTTP 301
https://load.sumome.com/sumome.js

Request Chain 134

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=7730593977051895126

Request Chain 146

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&e_ipv6=AQKum5cVDta5ggAAAZIf65I3UJDOXqzagZyOd1Qpm6jAeHpU-acPFvqvGFvOLlHm159SXaf-mWmbIli9Qzccxr1gQUJ0

Request Chain 176

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECShV0cmlnZ2VyLCBldmVudC1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI-fDHgcvZiAMVRKGDBx0jSDK4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8 HTTP 302
https://www.google.com/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECShV0cmlnZ2VyLCBldmVudC1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI-fDHgcvZiAMVRKGDBx0jSDK4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8&is_vtc=1&cid=CAQSKQDpaXnfULjlLSFs_QI3qhbyp3J2bPmzR5BHFcQzryZItomgKueNFTGp&random=2104025035&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECShV0cmlnZ2VyLCBldmVudC1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI-fDHgcvZiAMVRKGDBx0jSDK4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8&is_vtc=1&cid=CAQSKQDpaXnfULjlLSFs_QI3qhbyp3J2bPmzR5BHFcQzryZItomgKueNFTGp&random=2104025035&resp=GooglemKTybQhCsO&ipr=y

209 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 PYC2citHVQ
t.co/ 272 B
801 B 219ms
166ms Document
text/html 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/PYC2citHVQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=300
cf-cache-status: DYNAMIC
cf-ray: 8c7c3d40bd476609-AMS
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 23 Sep 2024 17:26:21 GMT
expires: Mon, 23 Sep 2024 17:31:21 GMT
perf: 7402827104
server: cloudflare tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 43370ca2fd8d285a48baaae2b596ae3f421c6de9c2b1797a65fc36800f60c867
x-response-time: 116
x-transaction-id: 86e96f99a3833169
x-xss-protection: 0

GET
H2

200

Primary Request banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html Show response
www.trendmicro.com/en_us/research/24/i/
Redirect Chain

https://research.trendmicro.com/3XqhYP4
https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

157 KB
27 KB

950ms
697ms

Document
text/html

23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Requested by

Host: t.co
URL: https://t.co/PYC2citHVQ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9b6167b65b17e5f70e7f42429ef885790d8923fa69dd61bc9cbdff75686579d2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://t.co/PYC2citHVQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 26606
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
content-type: text/html;charset=utf-8
date: Mon, 23 Sep 2024 17:26:22 GMT
server: nginx
server-timing: cdn-cache; desc=REVALIDATE edge; dur=52 origin; dur=604 ak_p; desc="1727112382045_399431126_460523594_65619_11919_13_218_255";dur=1
vary: Accept-Encoding
x-akamai-transformed: 9 24405 0 pmb=mRUM,2
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-prod-n-01: Yes
x-xss-protection: 1;mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=90
content-length: 284
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Mon, 23 Sep 2024 17:26:21 GMT
location: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
referrer-policy: unsafe-url
server: nginx
strict-transport-security: max-age=1209600
via: 1.1 google

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 206 KB
28 KB 76ms
44ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e7cc1a7169e40913fdcd4d2eec26a80f8372f9c0a99e52bac80cdbb1a5779c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: U7NUa1W/N4jY5L/F5g2HLw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCC78EE5BE0A9B
age: 82561
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 24 Sep 2024 17:26:23 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Wed, 28 Aug 2024 18:26:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 4eec89f4-a01e-00e4-1d77-f98080000000
cf-ray: 8c7c3d49ad6068fd-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27826
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 70ms
39ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: jwlUUXc1HMPClYXMpY+NPQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCD8E0A0C68C67
x-ms-lease-status: unlocked
age: 34973
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Tue, 24 Sep 2024 07:43:30 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 19:24:06 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 272231be-201e-00d7-738d-0bd9ad000000
cf-ray: 8c7c3d49ad6168fd-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6881
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 jquery.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 111 KB
34 KB 91ms
88ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383008_399431126_460525755_434_9838_16_0_219";dur=1
content-length: 34015
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 11 Jul 2024 01:35:32 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 utils.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 100ms
97ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383008_399431126_460525756_434_9791_16_0_219";dur=1
content-length: 3224
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 27 Aug 2024 23:12:06 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 css
fonts.googleapis.com/ 27 KB
2 KB 48ms
18ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

90b024f2bb6ac5bf0a8a77160406044bc6e6549fbf7717a88af8e82023d9fa62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:22 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 23 Sep 2024 17:26:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 cludo-search.min.css
customer.cludo.com/css/296/1798/ 16 KB
3 KB 69ms
28ms Stylesheet
text/css 2606:4700:10::6816:1c60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:1c60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=300
content-encoding: br
cf-cache-status: HIT
etag: W/"0238c4e6e55d81:0"
age: 18786
cf-ray: 8c7c3d49bafabba1-FRA
access-control-allow-origin: *
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/css
last-modified: Thu, 21 Apr 2022 10:55:26 GMT
vary: Accept-Encoding
server: cloudflare
x-lb: 4

GET
H2 200 clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 445 KB
41 KB 81ms
79ms Stylesheet
text/css 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

fccc0c93601e70e152b4337e6448f90fe3771495da1c42c703a8181347b479b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=5, ak_p; desc="1727112383008_399431126_460525753_842_9837_16_0_255";dur=1
content-length: 41746
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/css;charset=utf-8
last-modified: Thu, 12 Sep 2024 18:20:41 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 header-footer.min.css
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 71 KB
7 KB 88ms
86ms Stylesheet
text/css 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

89e7238488e96cffd68668c16693da4ad4588d0a1a9a170e2eff33c3ad4b16c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383009_399431126_460525754_455_9568_16_0_255";dur=1
content-length: 6383
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/css;charset=utf-8
last-modified: Thu, 15 Aug 2024 16:03:08 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 42ms
10ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27fd123f23c19c3fdd7e51b404b96425bc94b91d5c489815cda40a7cd537db0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=300
content-encoding: br
etag: W/"a042e32231316446dceb63961c2e0f47"
x-amz-version-id: r.5geybhCyiqWc8OCMGBdiPnnBysH0fh
age: 250
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: M04z6TNcQDkFjxHrChlRklvyWfIPbP-EEPDhxi8rltGX9S8gCcfEyg==
date: Mon, 23 Sep 2024 17:26:22 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:21 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 tm-logo-red-white-t.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/ 5 KB
3 KB 100ms
99ms Image
image/svg+xml 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: gzip
etag: W/"154e-614185e7e51af"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:28:12 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383014_399431126_460525757_998_12647_16_0_182";dur=1
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Wed, 20 Mar 2024 14:25:57 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: max-age=109
accept-ranges: bytes
content-length: 2173
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 trend-vision-one-laptop-console-nav.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/ 529 KB
381 KB 100ms
99ms Image
image/svg+xml 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: gzip
etag: "8428e-6141a0fa05c46"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:28:12 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383009_399431126_460525758_450_9860_16_0_182";dur=1
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Wed, 20 Mar 2024 16:27:04 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: max-age=109
accept-ranges: bytes
content-length: 389784
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 asrm-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 14 KB
15 KB 177ms
41ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "1ac209128f661abb8a982d1bdb20d08e"
x-adobe-smart-imaging: 0
expires: Mon, 23 Sep 2024 20:36:18 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:26 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains
-x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWXWqKgQAAAGTgAACgAouZ5wAIAAih6jTRg1ChppgAZYQojzNFvCnA3RgB2Kn4u5IpwoSDrVFQIA=
-x-adobe-assetlist: [trendmicro/asrm-console-shot]
access-control-allow-origin: *
content-length: 14534
akamai-grn: 0.34021002.1727112383.beae86a
server: Unknown
x-akamai-cache: Hit

GET
H2 200 xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 18 KB
18 KB 111ms
42ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "b3ffdce154f5ac33f90bafd0b8f52ddf"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWSzIeOkAAAITgAACgAoOZ95AIAAxTJiZBkYUGTQMGpD6ZCPsuEfgkoW50OJVGIEuNhB8XckU4UJAsyHjpA==
expires: Mon, 23 Sep 2024 22:50:08 GMT
access-control-allow-origin: *
content-length: 18350
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.34021002.1727112383.beae86d

GET
H2 200 cloud-one-workload-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 20 KB
21 KB 37ms
30ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "fd80448de919134c924f18226b59ecd2"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWVD58OwAAAMTgAACgAoub56gIABIaptRnqJ6hmnpQoGmhkZMSSLjJ2xPlk8aolRMHW9P0K4v6ZmsZxYj7mYYAH4u5IpwoSCh8+HY
expires: Mon, 23 Sep 2024 19:05:01 GMT
access-control-allow-origin: *
content-length: 20734
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.34021002.1727112383.beae87f

GET
H2 200 cloud-one-container-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 22 KB
23 KB 39ms
32ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "0bd7f96f29e779fac6dc954866b8de36"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWc9xaQ0AAAKTgAACgAouZ54AIAAxTTIxMTEGqekZkm0empyIbj0HcSqB1ZIzRPumGYlwpg/X3llbou5IpwoSGe4tIaA=
expires: Mon, 23 Sep 2024 18:49:11 GMT
access-control-allow-origin: *
content-length: 22816
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:25 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.34021002.1727112383.beae880

GET
H2 200 cloud-one-file-storage-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 10 KB
11 KB 42ms
35ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "81b7f638d5ac80cfde194124da99cc5e"
x-adobe-smart-imaging: 0
expires: Mon, 23 Sep 2024 23:49:59 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains
-x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWaHvYKkAAAMTgAACgAov554AIAAiJpPU9qjRtGahTCaaA0xAgVNPUgQa0soHgmo+qZZMeYfZyOm7hWBvwXckU4UJCh72CpA=
-x-adobe-assetlist: [trendmicro/cloud-one-file-storage-console-shot]
access-control-allow-origin: *
content-length: 10478
akamai-grn: 0.34021002.1727112383.beae881
server: Unknown
x-akamai-cache: Hit

GET
H2 200 sps-mobile-security-enterprise-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 20 KB
20 KB 43ms
36ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "183303c0127c38a2849f7046d6cccef2"
x-adobe-smart-imaging: 0
expires: Mon, 23 Sep 2024 22:55:08 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains
-x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWXsmWcsAAAMTgAACgAoeZ94gIABUUwmmgNMQinpphTajYQvKwELeE/OVgBtGKtmHupZyE1aayT3xGL5wi+DNlz8XckU4UJB7JlnL
-x-adobe-assetlist: [trendmicro/sps-mobile-security-enterprise-console-shot]
access-control-allow-origin: *
content-length: 19998
akamai-grn: 0.34021002.1727112383.beae882
server: Unknown
x-akamai-cache: Hit

GET
H2 200 zero-trust-access-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 24 KB
24 KB 64ms
58ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "54553bd846274282dee4b07c8fd3198b"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWRRgqYoAAAKTgAACgAouZ54QIAAxTJiZBkYRGmI0aaYkQvgyR6UW88UjS0OOQNJdMCXWOiWk3XxdyRThQkBRgqYo
expires: Mon, 23 Sep 2024 22:29:58 GMT
access-control-allow-origin: *
content-length: 24410
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.34021002.1727112383.beae883

GET
H2 200 email-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 24 KB
25 KB 65ms
59ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "adeabd4b80e2b5f6ab0d131473fa84c3"
x-adobe-smart-imaging: 0
expires: Mon, 23 Sep 2024 23:31:06 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains
-x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWRAIvj0AAAITgAACgAouZ54gIAAxTJiZBkYUNDIaegk92DgGNMkdi6AkXb2vg3gSTUZJXJ/F3JFOFCQEAi+PQA==
-x-adobe-assetlist: [trendmicro/email-security-console-shot]
access-control-allow-origin: *
content-length: 24906
akamai-grn: 0.34021002.1727112383.beae884
server: Unknown
x-akamai-cache: Hit

GET
H2 200 all-products-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 64 KB
64 KB 69ms
63ms Image
image/webp 2a02:26f0:4700::210:238
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:4700::210:238 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Unknown /

Resource Hash

293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "891ae1c6af5064a7f40d8b2f96a4ea68"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWQAjRP8AAAITgAACgAouZ94AIAAxTJiZBkYUND1NNMmI6GwgBZcHKQWGdiFA8L4puS7nSfF3JFOFCQACNE/w
expires: Tue, 24 Sep 2024 00:22:44 GMT
access-control-allow-origin: *
content-length: 65306
date: Mon, 23 Sep 2024 17:26:23 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Mon, 27 Mar 2023 00:57:09 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.34021002.1727112383.beae885

GET
H3 200 search-script.js Show response
customer.cludo.com/scripts/bundles/ 427 KB
77 KB 31ms
30ms Script
application/javascript 2606:4700:10::6816:1c60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/scripts/bundles/search-script.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:1c60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49d9b42c070befc015babb34120f727256d5ae55ea937cce30d7cde9dccdc3dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=300
content-encoding: br
cf-cache-status: HIT
etag: W/"06d1d1ee49db1:0"
age: 220
cf-ray: 8c7c3d4b4cf9bba1-FRA
access-control-allow-origin: *
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Wed, 18 Sep 2024 16:02:10 GMT
vary: Accept-Encoding
server: cloudflare
x-lb: 2

GET
H2 200 share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 648 B
775 B 94ms
88ms Image
image/svg+xml 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:41:23 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=50, origin; dur=0, ak_p; desc="1727112383284_399431126_460526599_7664_11903_17_0_146";dur=1
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: max-age=900
x-prod-n-02: Yes
content-length: 362
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 8 KB
8 KB 111ms
106ms Image
text/html 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-209-41.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
etag: "4dc263680765839bcf154c31da4ae22b:1592332529.612416"
pragma: no-cache
expires: Mon, 23 Sep 2024 17:26:23 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=HIT, edge; dur=65, origin; dur=0, ak_p; desc="1727112383284_399431126_460526600_9241_11586_13_0_146";dur=1
content-length: 3235
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/html
last-modified: Tue, 16 Jun 2020 18:35:29 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 LATAMFig1RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 115 KB
115 KB 235ms
230ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig1RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9a737728e7b58df7f041d3bc116b772513dbe032f506f2c94e721814fee0653d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "1cb8c-62156a63a3300"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=16, origin; dur=159, ak_p; desc="1727112383284_399431126_460526601_20235_11650_14_0_146";dur=1
content-length: 117644
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig2RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 102 KB
103 KB 275ms
269ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig2RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bdfafe044e589bf5e4f238a212543b478f5c20788250a65de2634795b20fdf15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=3
etag: "197e0-62156a63a3300"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:26 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=38, origin; dur=155, ak_p; desc="1727112383285_399431126_460526602_22090_10716_14_0_146";dur=1
content-length: 104416
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig3.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 44 KB
44 KB 237ms
231ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig3.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d29878164a9b6d38d44202a4e9e3f6ebc165c23c69faeaeb55d312bd56599617

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "aeb7-62156a63a3300"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=18, origin; dur=153, ak_p; desc="1727112383284_399431126_460526603_19859_11447_14_0_146";dur=1
content-length: 44727
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig4RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 152 KB
153 KB 280ms
274ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig4RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f1f4feffb5be0045c2c720f211c6293a7e7fddb7548323ea6298f0df3fde0294

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "25ff5-62156a6497540"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:24 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=33, origin; dur=173, ak_p; desc="1727112383284_399431126_460526604_23345_11395_14_0_146";dur=1
content-length: 155637
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:41 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Latam%20figure-05-01.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 36 KB
36 KB 524ms
519ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/Latam%20figure-05-01.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

454cb8f0084cceccd01e3cf3691a10258bd86fbd6dbfc5e3e2ab80ad83400086

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=30
etag: "8f3e-62156a61bae80"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:53 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=18, origin; dur=458, ak_p; desc="1727112383285_399431126_460526605_50399_11087_15_0_146";dur=1
content-length: 36670
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:38 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Latam%20figure-06-01.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 57 KB
58 KB 282ms
277ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/Latam%20figure-06-01.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4f5fc380b52a5670755662ecac2bf442d375e71f53b335ba798e3dfca095b0a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "e513-62156a62af0c0"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=55, origin; dur=159, ak_p; desc="1727112383284_399431126_460526607_24199_11316_13_0_146";dur=1
content-length: 58643
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:39 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig7RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 465 KB
466 KB 286ms
281ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig7RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

85ff987ec3f6df2c78c68b39d7b742c32dc6a1f3e17a13ef2b120adeb5100882

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=22
etag: "74391-62156a658b780"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:45 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=36, origin; dur=159, ak_p; desc="1727112383284_399431126_460526608_22279_11386_14_0_146";dur=1
content-length: 476049
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:42 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig8RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 167 KB
167 KB 290ms
286ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig8RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4de632194e6964e85e20360f4342e3753a57263a986bdf2eae6d64de38a14798

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "29a59-62156a667f9c0"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=56, origin; dur=158, ak_p; desc="1727112383292_399431126_460526609_24854_10293_13_0_146";dur=1
content-length: 170585
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:43 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig9RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 143 KB
144 KB 295ms
290ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig9RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d4a6071a770dbe37af27b4852940819a37b51250018233b7781152705e002ceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "23c12-62156a667f9c0"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=62, origin; dur=165, ak_p; desc="1727112383284_399431126_460526610_25444_11528_13_0_146";dur=1
content-length: 146450
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:43 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig10RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 180 KB
181 KB 723ms
719ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig10RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

873be680d3ddef940373267e6e36245a795a74f52aea10e71935c8aad4251a38

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2cff1-62156a6773c00"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:24 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=96, origin; dur=567, ak_p; desc="1727112383286_399431126_460526611_69225_9647_18_0_146";dur=1
content-length: 184305
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:44 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig11RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 408 KB
409 KB 297ms
293ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig11RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5d1d439744bb3a9a72fbc0c2fef7b0be2f0d3f164d4e79c2a10acfa40cb0b511

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "65fdc-62156a6867e40"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=33, origin; dur=160, ak_p; desc="1727112383284_399431126_460526612_22067_11270_14_0_146";dur=1
content-length: 417756
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:45 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig12RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 220 KB
221 KB 806ms
802ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig12RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7dffcf20eac7b2345159e39ec150605d84ea9f44a0dcbd7f6fc94efbf98f61a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=44
etag: "36fa7-62156a695c080"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:27:08 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=574, origin; dur=158, ak_p; desc="1727112383295_399431126_460526613_76936_12845_14_0_146";dur=1
content-length: 225191
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:46 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Latam%20figure-13-01.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 71 KB
72 KB 557ms
554ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/Latam%20figure-13-01.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a066032f441dc52838d1b42dcc6641e1acca1f6cfc456b5b421fd96b44416e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "11da7-62156a62af0c0"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=55, origin; dur=461, ak_p; desc="1727112383284_399431126_460526616_54341_11184_14_0_146";dur=1
content-length: 73127
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:39 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig14RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 67 KB
68 KB 299ms
295ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig14RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8c93f93a4e63a00a8bb2c15d87445a7fea1b47d472d2b04396579ee6652a7bc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=27
etag: "10d0b-62156a695c080"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:50 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=50, origin; dur=161, ak_p; desc="1727112383289_399431126_460526627_24259_11519_13_0_146";dur=1
content-length: 68875
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:46 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig15RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 90 KB
91 KB 585ms
582ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig15RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8c5a7917b6d8fbe09a19eb8d9cc5ee3cef6757b64497bfe2dbbcae951cd4bb47

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=34
etag: "16889-62156a6a502c0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:57 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=49, origin; dur=463, ak_p; desc="1727112383298_399431126_460526628_55234_12045_14_0_146";dur=1
content-length: 92297
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:47 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig16RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 356 KB
357 KB 561ms
558ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig16RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

03be325e57c1e138769dc6fd4dd5c1e22363309758bdfeda627cac7002598644

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=53
etag: "590b3-62156a6b44500"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:27:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=54, origin; dur=461, ak_p; desc="1727112383289_399431126_460526629_54695_11142_14_0_146";dur=1
content-length: 364723
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:48 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig17RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 621 KB
622 KB 645ms
642ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig17RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

8167fb87d5a7ade1606cb4ef338f5974eee0a1a8b4a991345a151ae24b8ad1e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "9b39a-62156a6c38740"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:24 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=92, origin; dur=501, ak_p; desc="1727112383289_399431126_460526630_62455_11401_13_0_146";dur=1
content-length: 635802
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:49 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig18RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 260 KB
261 KB 235ms
232ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig18RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

17970bc9a276ab8f18cf7b736016e8cc059574e1b7867f8d27e505ddbdd1aeef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=57
etag: "41066-62156a6d2c980"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:27:20 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=18, origin; dur=155, ak_p; desc="1727112383289_399431126_460526631_20406_11346_14_0_146";dur=1
content-length: 266342
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:50 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig19RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 190 KB
191 KB 522ms
520ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig19RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7d60675c8e7132a13f0e39f85145919e8acd5db090c777aa49876175a911d30f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2f822-62156a6e20bc0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:24 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=14, origin; dur=462, ak_p; desc="1727112383289_399431126_460526632_50759_11098_15_0_146";dur=1
content-length: 194594
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:51 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig20RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 184 KB
185 KB 239ms
236ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig20RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

fc9b6717cf6692fef1d9ebbdffde92264b1968ce839222fb1b400d635eed6e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2e12f-62156a6f14e00"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=24, origin; dur=161, ak_p; desc="1727112383289_399431126_460526633_21599_11526_14_0_146";dur=1
content-length: 188719
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:52 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig21RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 157 KB
158 KB 464ms
461ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig21RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dd10bdc3028ea118c380a271f449e41f27dd6f7e8e3e6f8a753539fa611a4034

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=25
etag: "274ff-62156a6f14e00"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:26:48 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=245, origin; dur=159, ak_p; desc="1727112383302_399431126_460526634_44818_11307_15_0_146";dur=1
content-length: 161023
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:52 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig22resize.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 126 KB
127 KB 333ms
331ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig22resize.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

45395d2f11cd67cd97a9916ca1b4d48fca9fafa168195e6b1466d9e8a176ff13

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=57
etag: "1f8a0-62156a7009040"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:27:20 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=61, origin; dur=159, ak_p; desc="1727112383291_399431126_460526635_25343_10282_13_0_146";dur=1
content-length: 129184
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:53 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 LATAMFig23RESIZE.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/ 40 KB
41 KB 353ms
351ms Image
image/png 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/latam-banking-trojan/LATAMFig23RESIZE.png

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b8378205408adf45d3502fe6969056114cd4f9a16e7630088b42d496659ad33c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=36
etag: "a04b-62156a7009040"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:59 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=136, origin; dur=166, ak_p; desc="1727112383289_399431126_460526636_33319_11303_13_0_146";dur=1
content-length: 41035
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/png
last-modified: Thu, 05 Sep 2024 03:11:53 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 granite.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 76ms
76ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383284_399431126_460526593_2710_11569_20_0_182";dur=1
content-length: 1422
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 15 Aug 2024 19:16:18 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 clientLibs.min.js Show response
www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/ 840 B
672 B 69ms
61ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

898241655767777d954a01288720b8487c6bfcaf831a0243b1e19a5cc67906a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383286_399431126_460526594_2885_10015_20_0_182";dur=1
content-length: 304
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Sun, 23 Jun 2024 23:33:12 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 sly.min.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 18 KB
7 KB 70ms
62ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: br
etag: "48de-56a21837c9c00-gzip"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 26 Sep 2024 01:40:30 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383286_399431126_460526595_2872_10034_20_0_182";dur=1
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Mon, 17 Jun 2024 05:04:34 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=202447
accept-ranges: bytes
content-length: 6497
x-xss-protection: 1;mode=block
server: Akamai Resource Optimizer

GET
H2 200 jwplayer.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 81 KB
23 KB 72ms
64ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: br
etag: "1457a-56a21837c9c00-gzip"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Sun, 29 Sep 2024 02:42:00 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383284_399431126_460526596_2712_11724_20_0_182";dur=1
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Thu, 05 Sep 2024 07:01:57 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=465337
accept-ranges: bytes
content-length: 22997
x-xss-protection: 1;mode=block
server: Akamai Resource Optimizer

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 75ms
37ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

daebe60287c37d53a04f216fde942a1453ffd8aed976f4079ae316926d7c0dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options: nosniff
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires: Mon, 23 Sep 2024 17:26:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 clientlib-trendresearch.min.js Show response
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 710 KB
144 KB 74ms
67ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

1d4b9c9db31602e3a45ae73efab893ceb4bac5d793014bbb44f3575fc4351681

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383295_399431126_460526597_3809_12518_20_0_182";dur=1
content-length: 146513
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 29 Aug 2024 08:02:37 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 header-footer.min.js Show response
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 36 KB
6 KB 76ms
69ms Script
application/javascript 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

50158df7c7c34b2ee50863ac98a702e15cb33e4fc91e46e1416abed0fafe1241

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112383284_399431126_460526598_2715_11639_20_0_182";dur=1
content-length: 5332
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 11 Jul 2024 03:14:59 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 821060e3-3f9c-4a2f-8613-8e0db4841f79.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 5 KB
2 KB 58ms
41ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/821060e3-3f9c-4a2f-8613-8e0db4841f79.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

293d0642bb36748cb0edbffeb9eb27ab33fff146e23e4fc0fe3eb49996b9fb34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: nboqqmr1WTH3xRAoObLqnw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCC78EE614078C
age: 81748
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 24 Sep 2024 17:26:23 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json
last-modified: Wed, 28 Aug 2024 18:26:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 09149f80-c01e-00bb-4777-f9727e000000
cf-ray: 8c7c3d4a2d7c2bb4-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1818
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 launch-75dcf65b28c1.min.js Show response
assets.adobedtm.com/d205b04dc657/0c07287192f8/ 227 KB
72 KB 78ms
13ms Script
application/x-javascript 2a02:26f0:3500:c90::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:c90::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2b420def5f6ff55354c7e92389035e28da2714675bc0ae319e3b276643336920

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=3600
timing-allow-origin: *
content-encoding: gzip
etag: "f243d3ea75e3767c2ef3bd0a5ecdcd3d:1712751857.747591"
expires: Mon, 23 Sep 2024 18:26:23 GMT
accept-ranges: bytes
access-control-allow-origin: https://www.trendmicro.com
content-length: 73766
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/x-javascript
last-modified: Wed, 10 Apr 2024 12:24:17 GMT
server: AkamaiNetStorage
vary: Accept-Encoding

GET
H2 200 autopilot_sdk.js Show response
cdn.bc0a.com/autopilot/f00000000017219/ 37 KB
14 KB 152ms
120ms Script
application/javascript 35.201.125.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.125.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

192.125.201.35.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f

Security Headers

Name	Value
Content-Security-Policy	default-src self; script-src self; style-src self;
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://www.trendmicro.com/

Response headers

access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=x1TL3Q==, md5=Oq0I5hLsqrsy+tjjbZlXjg==
etag: "3aad08e612ecaabb32fad8e36d99578e"
age: 0
x-goog-meta-sdk_canonical_host
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-meta-content_only: false
last-modified: Fri, 20 Oct 2023 15:39:22 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljtjKlvqU8j_WhAnJiB1xWrIoKj2efx_mXKzwLw_NN4_C5r2OUbWDDz6scHcdLosmRhmJGk
x-goog-meta-custom: true
x-goog-meta-marvel_config_consistency_custom: {"data-url":"dataservice.tmok.tm/tc.png,trendmicro.scene7.com,0,.66,1&qlt=80,1.0&amp","data-dropsrcset":"true","data-customerid":"f00000000017219","data-ignorepath":"uat-author.we.trendmicro.com,uat.we.trendmicro.com,prod-author.we.trendmicro.com,qa-author.we.trendmicro.com,qa.we.trendmicro.com"}
x-goog-meta-spa: false
cache-control: public, max-age=360
x-goog-meta-disable_debug_elements: false
accept-ranges: bytes
x-goog-generation: 1697816362499806
content-length: 12736
x-goog-meta-publishingdate: 2023-10-20 15:39:22
content-language: en
server: UploadServer
x-goog-meta-marvel_enabled: false
x-goog-metageneration: 3
x-goog-stored-content-encoding: gzip
x-goog-meta-sdk_request_parameters_case_sensitive: false
x-goog-meta-marvel_test_mode: false
expires: Mon, 23 Sep 2024 17:32:23 GMT
x-goog-stored-content-length: 12736
date: Mon, 23 Sep 2024 17:26:23 GMT
x-goog-meta-sdk_canonical_protocol
vary: Accept-Encoding
x-goog-meta-sdk_account_id: f00000000017219
strict-transport-security: max-age=63072000; includeSubDomains
x-goog-meta-sdk_log_level: 2
content-security-policy: default-src self; script-src self; style-src self;
x-goog-meta-marvel_customer_id
x-goog-storage-class: MULTI_REGIONAL
x-goog-meta-sdk_version: 1.5.9
x-goog-meta-sdk_whitelist: ixf
access-control-allow-origin: *

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
312 B 52ms
31ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8c7c3d4a8db02c3b-FRA
access-control-allow-origin: *
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/ 426 KB
103 KB 28ms
26ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: futiIRaAGsEL76yunD0yWQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10E7176E8
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 76663
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 19:54:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f5fb9793-c01e-00d6-7cbb-d7d850000000
cf-ray: 8c7c3d4b6f5068fd-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 105018
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 id Show response
dpm.demdex.net/ 369 B
919 B 127ms
39ms XHR
application/json 52.214.161.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=29C656F85FE1CBB80A495C08%40AdobeOrg&d_nsid=0&ts=1727112383233

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.214.161.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-161-17.eu-west-1.compute.amazonaws.com

Software

Resource Hash

316053aaf9346baa4841b37db43031f0f15c34c1940c5380191fe04cd2fc517a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v065-044719ea2.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
x-tid: uiH36BqdS+U=
expires: Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin: https://www.trendmicro.com
content-length: 311
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json;charset=utf-8
vary: Origin

GET
H2 200 1332074304 Show response
ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/ 8 KB
1 KB 48ms
19ms XHR
application/json 34.111.194.12
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/1332074304?client=js_sdk&client_version=1.5.9&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html&user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36
Requested by: Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.194.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 12.194.111.34.bc.googleusercontent.com
Software: bws/1.0 /
Resource Hash: 9f0f8b97bbedd536c657c8509450f8dbcc3618032ee7b22577d6d6f00f6a0e47

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: public, max-age=3600
content-encoding: br
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-be-pop: BRU-1-301
date: Mon, 23 Sep 2024 17:26:21 GMT
content-type: application/json
server: bws/1.0

GET
H2 200 LJA84-589LU-SVNVV-WKPLQ-NBTC7 Show response
s.go-mpulse.net/boomerang/ 160 KB
40 KB 351ms
58ms Script
application/javascript 2a02:26f0:e300:186::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/LJA84-589LU-SVNVV-WKPLQ-NBTC7
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300:186::11a6 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 718b81757a4a4d863ff8f7ee379db24abde81658399d718e4592cf265b04caaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=604800
timing-allow-origin: *
content-encoding: br
customappheader: mpulse-ab-boomr__git__361fdb1__git__361fdb1__p19.alsi10-lite
content-length: 41104
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 18 Aug 2024 08:14:02 GMT
vary: Accept-Encoding

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 114 KB
24 KB 428ms
426ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 757b1ade1a4833c94b964ff95fad2f1464b8ce479bb7f9d6b3b2ea66879c5179

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=300
content-encoding: gzip
etag: W/"a11ed20d049195f2fba5aac4d7ad55a8"
x-amz-version-id: Sbk551d24LDji48IeurqSRxI5sf95Q94
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: KSUfxcoLBDrFK8Y2h-uegEgX7oNb6UzvaIayI834LURlz_rp3AGVXg==
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 OpenSans.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/ 58 KB
58 KB 79ms
75ms Font
application/octet-stream 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/OpenSans.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: public, max-age=516
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=18, origin; dur=0, ak_p; desc="1727112383332_399431126_460526741_2811_10156_16_0_255";dur=1
content-length: 59444
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 material-symbols-outlined.woff2
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/ 225 KB
226 KB 63ms
59ms Font
application/octet-stream 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/material-symbols-outlined.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: public, max-age=1758
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=11, origin; dur=0, ak_p; desc="1727112383325_399431126_460526743_1449_11545_17_0_255";dur=1
content-length: 230732
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/octet-stream
last-modified: Thu, 07 Sep 2023 17:07:37 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/ 72 KB
72 KB 69ms
65ms Font
application/x-font-woff 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=1102
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=14, origin; dur=0, ak_p; desc="1727112383325_399431126_460526744_1741_11460_17_0_255";dur=1
content-length: 73259
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 34ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 156303
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 21 Sep 2025 22:01:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 21 Sep 2024 22:01:20 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H2 200 OpenSans-SemiBold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/ 58 KB
58 KB 44ms
43ms Font
application/octet-stream 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/OpenSans-SemiBold.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: public, max-age=1600
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=10, origin; dur=0, ak_p; desc="1727112383404_399431126_460526967_933_11667_15_0_255";dur=1
content-length: 59480
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/ 37 KB
38 KB 46ms
45ms Font
application/x-font-woff 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: public, max-age=1526
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=14, origin; dur=0, ak_p; desc="1727112383404_399431126_460526968_1353_11728_15_0_255";dur=1
content-length: 38313
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Interstate-Bold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/ 50 KB
51 KB 196ms
196ms Font
application/octet-stream 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/Interstate-Bold.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
x-prod-a-01: Yes
cache-control: public, max-age=150
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=164, origin; dur=0, ak_p; desc="1727112383404_399431126_460526969_16464_11766_15_0_255";dur=1
content-length: 51664
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/ 68 KB
68 KB 67ms
66ms Font
application/x-font-woff 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=185
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=3, ak_p; desc="1727112383425_399431126_460527012_1125_11765_15_0_255";dur=1
content-length: 69724
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/ 24 KB
14 KB 216ms
215ms Font
application/x-font-ttf 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-prod-a-01: Yes
cache-control: public, max-age=976
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=173, origin; dur=0, ak_p; desc="1727112383418_399431126_460527013_17357_12605_13_0_255";dur=1
content-length: 14370
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/x-font-ttf
last-modified: Thu, 09 Dec 2021 18:07:24 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 560194
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 17 Sep 2025 05:49:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 17 Sep 2024 05:49:49 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-956a-7310-a0c5-d638abf5107a/ 178 KB
32 KB 37ms
36ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-956a-7310-a0c5-d638abf5107a/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26d9c11091c7fe0bfc7ef04b672aafd066c29c29bcae1d6e1ddfe7cb53debc68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: aDEaAkNoPVWHoBo4WxpUBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCC78EE630E50F
age: 75352
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 24 Sep 2024 17:26:23 GMT
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json
last-modified: Wed, 28 Aug 2024 18:26:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: ec891875-401e-00c7-4977-f9ef4b000000
cf-ray: 8c7c3d4c48d52bb4-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 32284
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 404 token.json Show response
www.trendmicro.com/libs/granite/csrf/ 196 B
416 B 170ms
169ms XHR
text/html 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.trendmicro.com/libs/granite/csrf/token.json
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-209-41.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

server-timing: cdn-cache; desc=HIT, edge; dur=74, origin; dur=0, ak_p; desc="1727112383444_399431126_460527091_7840_11902_13_0_219";dur=1
content-length: 173
content-encoding: gzip
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
server: nginx

GET
H2 200 dest5.html
trendmicro.demdex.net/ Frame 20E9 0
0 106ms
32ms Document
text/html 52.17.201.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trendmicro.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.17.201.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-201-122.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 23 Sep 2024 17:26:23 GMT
dcs: dcs-prod-irl1-1-v065-0a63ce833.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 2 Sep 2024 10:58:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: +6L5ibKKTs0=

GET
H2

200

ibs:dpid=411&dpuuid=ZvGkvwAAAE8YDAOV
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=50693505083781453493726642188009331867
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGkvwAAAE8YDAOV

42 B
718 B

37ms
36ms

Image
image/gif

52.214.161.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGkvwAAAE8YDAOV

Requested by

Protocol

Server

52.214.161.17 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-214-161-17.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-2-v065-044719ea2.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: zgXIypQhTBU=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/gif

Redirect headers

Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZvGkvwAAAE8YDAOV
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length: 0
Date: Mon, 23 Sep 2024 17:26:23 GMT
Connection: keep-alive
Server: AMO-cookiemap/1.1

GET
H2 200 dict.en-US.json Show response
www.trendmicro.com/libs/cq/i18n/ 14 KB
4 KB 154ms
153ms XHR
application/json 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/libs/cq/i18n/dict.en-US.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=247
content-encoding: gzip
etag: "b91bea50244aae0b72b630e6c7e2791f"
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=106, origin; dur=0, ak_p; desc="1727112383492_399431126_460527217_11062_12990_13_0_255";dur=1
content-length: 4080
x-xss-protection: 1;mode=block
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 13 KB
3 KB 26ms
26ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: /1UdBS+YEc76mTiBEFqAyQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10971D872
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 7926
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 19:54:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 41b462fb-e01e-00ca-1356-d80047000000
cf-ray: 8c7c3d4eeb732bb4-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3017
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 21 KB
4 KB 25ms
25ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: c7xAZ9MSGAobGaTYg/Qtag==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 83349
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 19:54:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 324b1e67-601e-0071-7a6f-d8e1b3000000
cf-ray: 8c7c3d4eeb752bb4-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
566 B 56ms
55ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

daebe60287c37d53a04f216fde942a1453ffd8aed976f4079ae316926d7c0dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
x-content-type-options: nosniff
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
expires: Mon, 23 Sep 2024 17:26:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 utag.69.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 398ms
397ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.49.202006041752
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ee73898a4b24784c7a0bb80bc2960afe0328522cbd9a4e8ca70e9cc13703d2dc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"0ab3b661a06a361f47a7b8dbe70eee7f"
x-amz-version-id: ns.v4pDQYWoMaM44xz2MbD8MvzGNdATm
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: -W9gNXrgCsMNg0IzkJT8p7d2c1B669L_BuBr0Ll2s3uDqZis972M5A==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.138.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 118ms
108ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.138.js?utv=ut4.49.202010201643
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cc740e2f85c0de225c46dc13260e730a14d00b66f0b068ee4dd3bc9ca02de457

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"137179b51defd6489de984c7bc4b40c7"
x-amz-version-id: VWa.ux15GeDc2BjXL.2mfZ_lOLSFislc
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: MktRcdWmhC4fKTIdApV1DQEh6qDgqhTa_WrGQMySjm89O9pLkvj87Q==
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.81.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 24 KB
6 KB 402ms
393ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.49.202305162129
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 18fc4918ba75d7fd72c3595a98f73f0a994a24444c7d4a6718ff62e2209624a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"52e1a14e95cb3763048718b69b2eb2a6"
x-amz-version-id: ym.6a6txQP_bMmx.hIYxbR9PgRQBSPOm
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: ceNahmCtyt5-p8m0cVMyDVXj01Lm6HhlXZ2RwsDHgCDzJHi4eeV7Ow==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.29.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 399ms
390ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.49.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5da9c51865ce2133c0713c8b7822fd58d72bc4e60c94976b9b6b9a66e72cdf58

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"8f076357c9517efdc3ba80bbdf749075"
x-amz-version-id: E8sYL5p7KmiJRPiY9waxcaAT6FnDX.mS
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: ZNg4DAoOCJFQHRC0WMj0um0LorMG7POlvjv1gr_bsPXvZQRsbqIYyA==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:11 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.18.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 399ms
390ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.49.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dcc4d4718f57c5ee1e6a224d0e04fd117708518182a87453d82d0040b303e604

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"4eaf5287a34d23067b20068f0e530ab5"
x-amz-version-id: .bqaesoee36e5Q7Ivl9JCFCa2iiNmGhF
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: ZrusYgo2TwijCpALU1GsWD6DelDqj8S1oU5rtEZHKZJdK6aSK2yAdQ==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.22.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 408ms
399ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.22.js?utv=ut4.49.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f057d625f50c513ac2c93d4b7740e28afbce1f5184a6f2866367d6d669816b64

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"0464b9660f3254a22dab15e08810bd36"
x-amz-version-id: lLwcSUgIrdHcCQli98PA3QgKzwaS66i0
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: zbw2cYwi8IFs44Vs-fxeVeFIcIRwqjB8gB_hCglC0JbrzyzL9c0PPw==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 410ms
401ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.49.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d8d12aec28fbac51cd794cd38502fea3652485034407aecffe46f2c6fd31d3df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"3e06b5772fe056495db4f91ff0978f4f"
x-amz-version-id: CePmfHLAtvpO8kPuncDtshWRbY0OrhCj
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: lwOHP9j03KEZbJzIeuN2LF2X2G0V-cq8hSQS0yu1LZDuYa9ZUynICw==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.43.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 408ms
400ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.49.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 43b80cd82f36e0ab060a90d0d251880d0199afb8fb67be7c3eac50ab3f3c8afe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"f30566125cd17d31df6655b80450212b"
x-amz-version-id: BgEwfSXFfgmVTl762wBETJSMc4Eq.i2m
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 5vQj2FsLORDxeYsL5glLWVvf4UPa-kfGcycXf6BdwNyZGRel1ATzWA==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.75.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 400ms
392ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.49.201608171750
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a2bb9485b7d1336d57383fcd7a93faf03d9ae5aaf7753fa864c92107c135735

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"b91a6616cf0765a73d917ef605bbff72"
x-amz-version-id: gfgLyM9lA4SA4a0D5WBQ6Md7LJHgDqTD
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: txOSqcijZEB9rDtyc5j4RXzgT4IVMH-9POBq2cegz5W6yjrYE1XW8A==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.115.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 10 KB
3 KB 436ms
429ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.115.js?utv=ut4.49.202109201636
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c00d9b408261611ce8f1140b8468ab5ffe2855f85195f093dd4a0aedad890cf8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"c8b44a82425633f0dd115c0e451925ba"
x-amz-version-id: 8Voz_B2iriei7CGLeb11_GTn2HLW7PvN
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: Q0PEdSqcvZwlow_--l7QTcpD-YY-EZ_CSOo381w6-1ri2jrpoJbEvg==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.117.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 116ms
109ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.117.js?utv=ut4.49.202109291943
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f28c05d6295472f7dd63e8eeb59e0d1b433ed9b7a60129efff8c7fffe3875093

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"b54e48a939e9853cca5fc0eba2bcd800"
x-amz-version-id: HOspWFs14s6yeHSIzlkoT84VpygRCxlJ
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: iXG6a5EufPkW8ULmM9vsTgfAtUVqNSJ62_DwjSPoIKSO3mT0CN7nFw==
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.127.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 419ms
413ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.49.201905291644
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cc651a190957f7e8a2a11543e666494f750eeacab9c5b79915cd284d819bd7f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"9d6978c108511a6056443697dbe342f9"
x-amz-version-id: KdOY2JbM6LbQsTHTnHcMJkYOKwUt7r4P
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: M4sVvhtky8-7T64A5aTu8HmuUItKnYI_2Ii-fmUzcFnNZ0u8fBGFdA==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.145.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 413ms
409ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.49.202305162129
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f0b37c6e8940c99069a86c372b1c03c4e370d54b9f1baf23a9f6b6c39f6ac7f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"a90745ca235b3fa4469b02b7ba332ce6"
x-amz-version-id: vP7MIVvZFedge6WEtJfx3Vh8qs6Euro7
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 1OdBGWcDRr6L2dhBDTd1ilbqZq78Ax_bxyspGVzLR8HGtUn5Jc2L0A==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.171.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 14 KB
4 KB 396ms
392ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.171.js?utv=ut4.49.202308081722
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 39c195b4396975d0d8312a180757d36621162c3c2f2530d16472d0e1ca2fd3a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"54e2351571ee62289c1d413e0eef9be9"
x-amz-version-id: 4QFObIX3l.e16qLoA5Y_sRQOZH19lxyC
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: LfEMaX4pqI6zvukMKH6HvM9wi83VCuczh15wy0obu8dw1FFV3Ccskw==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.181.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 408ms
404ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.181.js?utv=ut4.49.202210212104
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09fdf87496da0f4c299dd090e802e0c371f02a87391c1e9ac7d9430672790740

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"3c8d7265cfd6959c5519236b3f89e3a6"
x-amz-version-id: ve8kWRnID9bDBv8YZdBsGX17Pqz5yPnT
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 8hGP6fvx9UFUNOAIK9nuEW0M3va0LGHfLnt3nAWcva9dDpuWcMHEyg==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.182.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 3 KB
2 KB 413ms
410ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.182.js?utv=ut4.49.202212122044
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 19e0028f1c1b5c45df4b2ec37a31d1ed3d34bcbb57325ae2a3c744a3fc7bc72a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"4cf1d9b925b7d0ba3ece3c096a73e33d"
x-amz-version-id: p9bYiDiILfSEYxUsy5GyiaDNVEip4YgQ
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: nXgg2A2tFCmB606Ci0z1D8MWdBuV6_pv0eUeKNWqtCQRYAVxuc5kuw==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.184.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
2 KB 393ms
390ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.184.js?utv=ut4.49.202407301623
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f3937dfb65cd39c59f5f8162eb9e652d8d321d18089857e53e387f2244d7482

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"e82487f676345e25a34636fc8c529416"
x-amz-version-id: 3RaUA7QqTLcBa6hF2SJRvGz2d9k1qVUq
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: kNXKDYTVZNVttuH6rsc7_FZn2_06_uyaEIPxMlc1cfRUQ8QXqMDsRg==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:15 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.187.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 397ms
394ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202402161940
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7d37a29c4b29e8c5ee89c48069cc6dacedd33d817cb57e8bba1a535011f1ece9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"410706255ad4f185fef8a5b0edd452f7"
x-amz-version-id: eItVZgqi.z8qWK5cELCJ2sxLzMDF_22D
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: M2BNR4suWZvdLlYMFDB_9mBY4LzXlJXOf78nDtVT_GKfFTAfBHQfKA==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.189.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 12 KB
5 KB 422ms
420ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.189.js?utv=ut4.49.202305082144
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa9977a82006181f4794b832b3accfb3ebb1784fb9c00b02d3e34f2b5d036e00

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"dd9b98a3b0f6da57b1b54902c576435b"
x-amz-version-id: 2EpOjX.TYAFVbzzifBICICMdSbKZUFBe
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: oL7NGKLX4wnW-wE4jIHiNx-EJ0jUFnCGxPaWxXFfeOLhmX5-mxp3vg==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.192.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 2 KB
1 KB 395ms
393ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.192.js?utv=ut4.49.202305252141
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d5565491575b6e7e34519ff95adc8749bf232d908d98b19af0e598f97d9e77eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"d210f543e76c02221e466a5ae563835b"
x-amz-version-id: lL_5mhFC1RLNbFPqbm6ajVGT07C93eRh
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 6ZbcM_Fpq24wXCKpDlIX8Nmsgbj1kYnnoEz95AXXPlvGLCMa4FkOYw==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.205.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 4 KB
2 KB 396ms
394ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.205.js?utv=ut4.49.202402222121
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cb34b12ae47afd7bb5befa05bb2e48251693bbefcc2e75a76fe6f72aff24d587

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"a96438243f1d5ad3102066a358ad5b63"
x-amz-version-id: TNnV4zzKWWGmR10CsrgqQgm21GW9cLw2
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: G2RuaAOsSSxOL-3aQPalqILKO5BK-mYd6GuOlpmPDbQOJ9InZZ5ZeA==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:15 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 utag.210.js Show response
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 7 KB
2 KB 395ms
393ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.210.js?utv=ut4.49.202407242125
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2b524add8d0ff5dbbd3429d65441cc4fba7c803a5f486e539842be2af0d9b58e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
etag: W/"9907ebd4576295ced11bf6ecd26816b4"
x-amz-version-id: GYYbnbW5KeZ9uGmKPn1uAwFhFEP9Lv9y
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
x-amz-cf-id: Sm1S5U9ZgK6iJlYVF-ma1ZMWtj8oKGnvVvMXzkYREhBxS09CMVMPEQ==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
last-modified: Fri, 13 Sep 2024 17:44:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
x-amz-server-side-encryption: AES256

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 31ms
30ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 6599
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:23 GMT
content-type: image/svg+xml
last-modified: Mon, 23 Sep 2024 06:01:56 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: c50fc515-501e-0097-3cce-0df043000000
cf-ray: 8c7c3d4f7b6168fd-FRA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/c41f1db5/www-widgetapi.vflset/ 31 KB
10 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c41f1db5/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12a9667fd6b08fd3a1d424ec68050efcf81b3ff05bcfea4afa13f37ef1c61eea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 2416
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Tue, 23 Sep 2025 16:46:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 16:46:07 GMT
last-modified: Thu, 19 Sep 2024 04:17:06 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10444
x-xss-protection: 0
server: sffe

GET
H2 200 config.json Show response
c.go-mpulse.net/api/ 2 KB
1 KB 252ms
181ms XHR
application/json 2a02:26f0:4700:29a::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=LJA84-589LU-SVNVV-WKPLQ-NBTC7&d=www.trendmicro.com&t=5757041&v=1.803.70&sl=0&si=0224e0cc-dd05-480f-843a-cac91d413451-ska0fy&plugins=AK,ConfigOverride,Continuity,PageParams,RT,PaintTiming,NavigationTiming,ResourceTiming,Memory,Errors,Akamai,EventTiming,BFCache,LOGN&acao=&ak.ai=807181
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:4700:29a::11a6 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 460a8fcb2ffb9b8c7b7998f2de1acd6cff53b555f809dab05193ac6ab15edcb7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
timing-allow-origin: *
content-encoding: gzip
access-control-allow-origin: *
alt-svc: h3=":443"; ma=93600
content-length: 879
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/json
vary: Accept-Encoding

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 218 KB
78 KB 46ms
22ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

267f502bf1fc4032ddc729a6db0c2ba09d2dd9cd57336c5301bcc4e03a95a1a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:08:04 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79736
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ktag.js Show response
resources.xg4ken.com/js/v2/ 11 KB
4 KB 124ms
32ms Script
application/javascript 52.49.43.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EB

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.43.23 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-43-23.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cc801ce0c56b23a865f8db45353f3d6b22b4a29c3728cf05d4634e181cbed937

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=86400, public
content-encoding: gzip
etag: "66f160c2-f32"
expires: Tue, 24 Sep 2024 17:26:24 GMT
content-length: 3890
date: Mon, 23 Sep 2024 17:26:24 GMT
x-xss-protection: 1; mode=block
content-type: application/javascript
last-modified: Mon, 23 Sep 2024 12:36:18 GMT
server: nginx

GET
H2 204 td
www.googletagmanager.com/ 0
130 B 39ms
38ms Image
text/plain 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=GTM-MT6DHL8&v=3&t=t&pid=1177247682&dl=www.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html&tdp=GTM-MT6DHL8;;0;0;0&frm=0&z=0
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 462 KB
113 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2b1b28c6febd3c73227bd5f678a7875fdb2411e388fbef36b5bac5a56553397d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 115755
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 197ms
19ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Content-Encoding: gzip
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 729
Date: Mon, 23 Sep 2024 17:26:24 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2

200

sumome.js Show response
load.sumome.com/
Redirect Chain

https://load.sumome.com/
https://load.sumome.com/sumome.js

2 KB
2 KB

60ms
59ms

Script
application/javascript

2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/sumome.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: 702a5e3ad4151d3f0c29a3d1510d6cbd93ebe47c6d28090cb28d96c152c74c2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"45a3e73f97a8bf6757858f2cd584e5aa"
date: Mon, 23 Sep 2024 17:26:24 GMT
last-modified: Fri, 20 Sep 2024 15:27:02 GMT
cdn-cachedat: 09/20/2024 15:35:45
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: Ae62vnV4sw+HUolC+Htzc4wBRheSbPm4switu3ZoPIyY8kOzSEe7vXlCMSFWQ29o7ZPEkRFhB0s=
cdn-cache: HIT
cache-control: max-age=600
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: c64407da0517521b87f61cd1a0e6c9f5
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: H4ZVVSK447DN8H3K
cdn-edgestorageid: 1080
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

Redirect headers

cache-control: no-cache
location: https://load.sumome.com/sumome.js
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 9e80547b375de4b9dab8efaf691ac1a4
cdn-pullzone: 1686293
content-length: 162
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/html
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 305ms
126ms Script
text/javascript 18.193.54.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.192.js?utv=ut4.49.202305252141
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.193.54.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-54-173.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e29f9d33670f9b5be6c78747a5e74d1bd0c0f2923480246d4ba4004768679d63

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/javascript

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 192ms
15ms Script
text/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.49.201510262117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
content-encoding: gzip
age: 5104
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 18:01:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
date: Mon, 23 Sep 2024 16:01:20 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
server: Golfe2
vary: Accept-Encoding

GET
H2 200 revenuepulse-lib-v3.js Show response
resources.trendmicro.com/rs/945-CXD-062/images/ 2 KB
1 KB 320ms
143ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: public, max-age=60
content-encoding: gzip
cf-cache-status: REVALIDATED
etag: "41f5f-6f3-61e30c626462f"
x-content-type-options: nosniff
cf-ray: 8c7c3d52faf0362b-FRA
expires: Mon, 23 Sep 2024 17:27:24 GMT
accept-ranges: bytes
content-length: 695
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/x-javascript
last-modified: Sat, 27 Jul 2024 01:44:51 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 208ms
37ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"b57737a151d7fd411c90e2eb8cdb171e"
age: 23543
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4FVnu8VFjKQQiLxS8HbOYuv%2BNQSrD38yiH8hKbeLfZESBlIdxKV2z74hcmi8yI%2B3y8pA7Xes7Atn6a%2BO817bnjo4qAJwAA3qGG8KSnczDBHDeUNHK0gKfTLjgd1uvtNzpTyLvaqO"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c7c3d52fdb29f1b-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 336 KB
106 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f59dd9cbd85d76315cdfa68088b11e8af14a13fb3598d55cd32c81ebe3549f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 23 Sep 2024 17:26:24 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 108016
date: Mon, 23 Sep 2024 17:26:24 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 336 KB
105 KB 42ms
41ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba6ab8e7ed51e559d8cd5a3d97a9b66908f2edfbe28cc75e3c1a77785b946a07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 23 Sep 2024 17:26:24 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107950
date: Mon, 23 Sep 2024 17:26:24 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 equally-widget.min.js Show response
widget.equally.ai/ 959 KB
263 KB 162ms
13ms Script
text/javascript 52.222.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/equally-widget.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.187.js?utv=ut4.49.202402161940

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-214-66.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ea34c88a2cc61324499aa7feacbbd95b9c97449a6a8ec642bde22290cbd41be8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
etag: W/"0e5f1404a2c3585c4a1d34611194944f"
age: 31276
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: KDdrHNip2q1Nsex9QaIusMJwCmPmnMi9A-y9obJaf-6WSh_i_S0ClQ==
date: Mon, 23 Sep 2024 08:45:14 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Sun, 15 Sep 2024 12:22:12 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 122731c1a09cfba14dfeeff504946134.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
sjs.bizographics.com/ 47 KB
17 KB 171ms
26ms Script
application/javascript 2a02:26f0:3500:10::210:a99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs.bizographics.com/insight.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.43.js?utv=ut4.49.201510262117

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=50711
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 16683
date: Mon, 23 Sep 2024 17:26:24 GMT
last-modified: Mon, 06 May 2024 17:20:18 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 149ms
14ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
content-encoding: gzip
age: 7
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 19:26:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
date: Mon, 23 Sep 2024 17:26:17 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
server: Golfe2
vary: Accept-Encoding

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
10 KB 147ms
14ms Script
application/javascript 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, max-age=604800
content-encoding: gzip
etag: "tIg8n6xaLBY4WwNLLw9OGA=="
expires: Mon, 30 Sep 2024 17:26:24 GMT
accept-ranges: bytes
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
vary: Accept-Encoding

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 54 KB
20 KB 108ms
70ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

d9fabfbfd4d425891b9001334226ce1c9e13ec0eaf73abe83db40350c35a305f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
etag: 12542973666880365711
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 20075
x-xss-protection: 0
server: cafe

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 143ms
25ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip"
accept-ranges: bytes
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Mon, 23 Sep 2024 17:26:24 GMT
x-tw-cdn: FT
last-modified: Fri, 22 Mar 2024 21:07:24 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000168-IAD, cache-muc13942-MUC
x-amz-server-side-encryption: AES256

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 130ms
17ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66e78018-111cd"
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 20:26:24 GMT
accept-ranges: bytes
content-length: 18822
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Mon, 16 Sep 2024 00:47:20 GMT

GET
H/1.1 200
OK pixel.js Show response
origin.acuityplatform.com/event/v2/ 2 KB
3 KB 129ms
14ms Script
application/javascript 23.201.250.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://origin.acuityplatform.com/event/v2/pixel.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.250.60 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-250-60.deploy.static.akamaitechnologies.com
Software: nginx/1.14.0 /
Resource Hash: 89cf66cb9de8da20fc15e9953845dd4d1de2c0fb465c827a09d818449222c533

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

ETag: "63b5cc24-978"
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 2424
Date: Mon, 23 Sep 2024 17:26:24 GMT
Content-Type: application/javascript
Last-Modified: Wed, 04 Jan 2023 18:57:40 GMT
Server: nginx/1.14.0

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 210ms
100ms Script
text/javascript 2606:4700::6812:1247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.127.js?utv=ut4.49.201905291644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1247 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=0; includeSubDomains; preload
cache-control: public, max-age=1200
content-encoding: br
cf-bgj: minify
cf-cache-status: HIT
age: 5621
via: 1.1 google
cf-ray: 8c7c3d53cb961901-FRA
expires: Mon, 23 Sep 2024 17:46:24 GMT
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/javascript
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 25ms
10ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=23, mss=1232, tbw=4471, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: QuZbbyRedygFefHsaF+7SbveYOQdt2tcCtOpnF6FWGbGMClWGOohfXsAwh27GxmOm18PoAZBoaUZe5Lv6pam0w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 58953
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
431 B 11ms
10ms Script
application/javascript 2600:9000:235a:a200:7:2bfb:7c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202409131743&cb=1727112384349
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:a200:7:2bfb:7c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-amz-version-id: 2XUX04X5QEw0.xFya64khU._sHTRl_Pz
etag: "7bc0ee636b3b83484fc3b9348863bd22"
age: 46
x-cache: Hit from cloudfront
x-amz-cf-id: iNiA6YWqSTI_X2-wGr3I59G5fM10tTNnQ-ySv2S1kfUXz17oufRDFQ==
date: Mon, 23 Sep 2024 17:25:39 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 11 Mar 2023 06:57:46 GMT
cache-control: max-age=300
via: 1.1 60dc145c687858f10bb3fe6251ad4ffe.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 2
x-amz-cf-pop: FRA60-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-5427711&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

56007b71a6d5ed0c546f0b405bf1771bbcf14857de855b28c78242080d059ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:08:04 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79090
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 134ms
33ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1F489A708E544C65B254B4C4299CD747 Ref B: FRAEDGE2011 Ref C: 2024-09-23T17:26:24Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 271 KB
93 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-929919117&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

016f4f3d8b3b5bb5297bb1c4e7e415e0ab71288d00dc522d87777c0f234a42eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 94953
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 215 KB
77 KB 34ms
33ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-9572106&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

55ec6f06b3f7613063981efbffcd58a551ebfc773865b976a1dce8c52a39971a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
expires: Mon, 23 Sep 2024 17:26:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 23 Sep 2024 16:59:56 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 79089
x-xss-protection: 0
server: Google Tag Manager

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 14 KB
6 KB 67ms
15ms Script
application/x-javascript 18.172.103.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.103.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-172-103-101.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 71d18af9ee879a36717e1ea3367b669031e3f6b12cb0aa1373fd200d278c4e6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
ETag: W/"0a898f6edf2d77595f7378557dd8fb96"
Age: 49627
Connection: keep-alive
Via: 1.1 67697a0060e2336f6ffa8579d528820e.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Du23d_z3UZy4Fyme4z_YiEtW5tC3dGViRgg1-yIxfgIr19qkWiOnBg==
Date: Mon, 23 Sep 2024 03:39:18 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 11 Sep 2024 19:27:43 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P8
x-amz-server-side-encryption: AES256

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=7730593977051895126

4 B
279 B

473ms
383ms

Image
application/json

2600:9000:206f:aa00:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=7730593977051895126
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Server: 2600:9000:206f:aa00:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

via: 1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)
apigw-requestid: ekauPj89IAMESww=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 4
x-amz-cf-id: 3sqQ2wGjsda19srfwvb5BPnfRxh2HOPnZe6et1KNl7qaDPofayDBxg==
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/json
x-amz-cf-pop: FRA56-C1

Redirect headers

cache-control: no-store, no-cache, private
location: https://attr.ml-api.io/?domain=www.trendmicro.com&pId=7730593977051895126
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.76; 45.141.152.76; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 45993078-a133-4fb4-b3c6-5a904400d9c9
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 23 Sep 2024 17:26:24 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 70ms
25ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-4502MK3B94&gtm=45je49j0v884954515za200&_p=1727112384003&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&gdid=dYWJhMj.dYmQxMT&cid=1238298223.1727112385&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1727112384&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&dr=https%3A%2F%2Ft.co%2F&dt=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.consumer=not_consumer&tfd=2864
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4502MK3B94&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: text/plain
server: Golfe2

GET activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=2355371282007;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuse...
5427711.fls.doubleclick.net/ Frame FA40 0
0

GET
H3 200 activity;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=2355371282007;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand...
ad.doubleclick.net/ 0
23 B 109ms
41ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=2355371282007;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=1037108164;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9188098692z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 23 Sep 2024 17:26:24 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"12667305702621695893"}],"aggregatable_trigger_data":[{"filters":[{"14":["3936796"]}],"key_piece":"0x2fca2d57034719ee","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x828af442be9ecca4","not_filters":{"14":["3936796"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"16371251678229578974","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"12667305702621695893","filters":[{"14":["3936796"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"12667305702621695893","filters":[{"14":["3936796"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"12667305702621695893","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"12667305702621695893","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["5427711"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 200 rules-p-yyb3JEF9Pm8ey.js Show response
rules.quantcount.com/ 3 B
448 B 62ms
10ms Script
application/javascript 2600:9000:223c:400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-yyb3JEF9Pm8ey.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "8a80554c91d9fca8acb82f023de02f11"
age: 44690
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: d1lGvlSP0Cq7U6fYjHeK_SuW4DVZWCEnuiuW82PaC4tXOl1mPF3IBw==
date: Mon, 23 Sep 2024 05:06:36 GMT
content-type: application/javascript
last-modified: Sat, 04 Mar 2017 21:25:15 GMT
vary: Accept-Encoding
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
via: 1.1 84294257ed643a88ee54d2e3f7d7ccea.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3
x-amz-cf-pop: FRA56-P2
server: AmazonS3

GET activityi;src=9572106;type=trend002;cat=globa0;ord=5872169385511;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut...
9572106.fls.doubleclick.net/ Frame 8B1E 0
0

GET
H3 200 activity;register_conversion=1;src=9572106;type=trend002;cat=globa0;ord=5872169385511;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-tar...
ad.doubleclick.net/ 0
23 B 41ms
40ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=9572106;type=trend002;cat=globa0;ord=5872169385511;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=499455593;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9190653197z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 23 Sep 2024 17:26:24 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"3786233285360337905"}],"aggregatable_trigger_data":[{"filters":[{"14":["12441272"]}],"key_piece":"0x9716f0a3d598a4af","source_keys":["12","13","14","15","16","17","18","19","20","21","899991560","899991561","899991562","899991563"]},{"key_piece":"0xf10034d3aa7cb31a","not_filters":{"14":["12441272"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","899991560","899991561","899991562","899991563"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"899991560":65,"899991561":65,"899991562":65,"899991563":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"1356697486237079312","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"3786233285360337905","filters":[{"14":["12441272"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"3786233285360337905","filters":[{"14":["12441272"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"3786233285360337905","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"3786233285360337905","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["9572106"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 10ms
10ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Wed, 01 Jan 2025 17:26:24 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Mon, 23 Sep 2024 17:26:24 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 16ms
15ms Image
image/gif 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=588027347&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=de-de&utmje=0&utmfl=-&utmdt=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&utmhid=1359406478&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&utmht=1727112384867&utmac=UA-29051577-12&utmcc=__utma%3D44797537.1238298223.1727112385.1727112385.1727112385.1%3B%2B__utmz%3D44797537.1727112385.1.1.utmcsr%3Dtrendmicroresearch%7Cutmccn%3D092024_Mekotio%7Cutmcmd%3Dsmk%3B&utmjid=460498833&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Mon, 23 Sep 2024 17:26:24 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
server: Golfe2

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 914
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 18:11:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 17:11:10 GMT
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1129
x-xss-protection: 0
server: sffe

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
811 B 9ms
8ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 2083
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:51:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 23 Sep 2024 16:51:41 GMT
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 697
x-xss-protection: 0
server: sffe

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
835 B 538ms
497ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.trendmicro.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 000622ccb0328270dc4c531ddd7e8e52
x-msedge-ref: Ref A: C069187B493E4714B71E79B37E3D8A5D Ref B: FRAEDGE2020 Ref C: 2024-09-23T17:26:24Z
x-li-fabric: prod-lva1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYizLAygnDcTFMd3X6OUg==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
x-li-source-fabric: prod-lor1
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok...

0
266 B

168ms
114ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&e_ipv6=AQKum5cVDta5ggAAAZIf65I3UJDOXqzagZyOd1Qpm6jAeHpU-acPFvqvGFvOLlHm159SXaf-mWmbIli9Qzccxr1gQUJ0
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 572C49B6A89F44D7BDFF02506D4DB993 Ref B: DUS30EDGE0412 Ref C: 2024-09-23T17:26:25Z
x-li-fabric: prod-lva1
x-li-uuid: AAYizLA3pc3p24mubyWF6Q==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=8866&time=1727112384914&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&e_ipv6=AQKum5cVDta5ggAAAZIf65I3UJDOXqzagZyOd1Qpm6jAeHpU-acPFvqvGFvOLlHm159SXaf-mWmbIli9Qzccxr1gQUJ0
x-msedge-ref: Ref A: 667597DCB01E4A87AE4C1F6DA4144500 Ref B: FRAEDGE1917 Ref C: 2024-09-23T17:26:24Z
x-li-fabric: prod-lva1
x-li-uuid: AAYizLAyg8oI9kd25qYrRg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-source-fabric: prod-lor1
date: Mon, 23 Sep 2024 17:26:24 GMT

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame 1C13 0
0 53ms
50ms Document
text/html 2606:4700:10::6816:46c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 3520
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8c7c3d55d9949bf4-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 23 Sep 2024 17:26:24 GMT
last-modified: Mon, 23 Sep 2024 16:27:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E3kDZqVXqxtEfoONAJbMDkktb3tAJU77lm39NabnxVYTMHbccbi5AmUVCpPjJjr20H1MJ%2F28lIne24bSDSWYj2U53j7UGHPjPnw4OJjQ5%2BvqL5e5brHS9poqQeVuw3zcrEsjWvRJ8fTTMV5hI1MEKHGm"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.D0Uc7kY6.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 36ms
26ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"6fea96ea56ee4fff557b8776f9c8c3a6"
age: 14375
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zXPYYtm4fLtOANxh%2BqwjbzHmgNWK7mXMYl4LWRXJvFcTbPE%2F%2FQN3Ouhx1Q0dg6XWuTrptEEFeU88BfJpXdoNV%2Ft0J%2FKr5cN6ah6qjpjjiNIt8M48ezrAH6oxtL%2FgXwS7dgOjK04h"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=315360000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c7c3d55d93cd3a6-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 243552383039605 Show response
connect.facebook.net/signals/config/ 76 KB
15 KB 9ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/243552383039605?v=2.9.167&r=stable&domain=www.trendmicro.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

075eaeaa24396deaf64ee5a0d3412418b5110822aa98628ec51d87ee8512073a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=68, mss=1232, tbw=67143, tp=62, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: ajZ7+ifqCKaNmPvX79mWLZBjh1imvqIuFLyXRvAloXrm4KiuxktMjnxxcBrZ94bowGiMNHdVisUxDknx9UJmbQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 15180
x-xss-protection: 0

GET
H2 200 1.46ec647ca3511952dc00.js Show response
load.sumome.com/ 465 KB
152 KB 34ms
33ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/1.46ec647ca3511952dc00.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: 5e0fc3dbb73f65f7e3901449fa3ee2813960e11faae65cb7c2df923cba2e30c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"0941f3e3156027aa98fc8801fd9db690"
date: Mon, 23 Sep 2024 17:26:24 GMT
last-modified: Wed, 18 Sep 2024 19:19:22 GMT
cdn-cachedat: 09/18/2024 19:21:43
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: xpgOKiN62ouRatpQoOz850TGq0/Y0KWFRQ0jIU+WTpKXJIrAH8i/vfajk3wxOAkJu3WHWrBXxi4=
cdn-cache: HIT
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: e54f51064488357f766d8acde32dec04
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: QD51ZDHY20N6F5FR
cdn-edgestorageid: 1081
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 18.46ec647ca3511952dc00.js Show response
load.sumome.com/ 43 KB
19 KB 56ms
56ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/18.46ec647ca3511952dc00.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: c0a0cf4f21fa3e4dfcf4003127d7e76c5258ce6bef2a30d260ace782d261d6b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"d7b2eec232104085e1666b9b5d33cd16"
date: Mon, 23 Sep 2024 17:26:25 GMT
last-modified: Wed, 18 Sep 2024 19:19:22 GMT
cdn-cachedat: 09/18/2024 19:21:42
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: /YXW5JSU7vp9u8jk/LX3WrMf6lPKehEFAqdRDk41YRqcKndWIQSDU/YXSggUYm1eggPK4S+LBw0=
cdn-cache: HIT
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 9b0baf78498a5f34a8d17eaa2d2eb9ae
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 0B2MKEJ1QP9BJBGV
cdn-edgestorageid: 1079
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 100ms
98ms Stylesheet
text/css 18.193.54.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.193.54.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-54-173.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c564b7cedb11c28a97fe8292fc8d20bf6b8e0ede52994d80f55c7c8a082c6700

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 115ms
98ms Fetch
image/jpeg 18.193.54.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.193.54.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-54-173.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/jpeg

GET
H/1.1 204
No Content pj Show response
e.acuityplatform.com/ 0
188 B 93ms
14ms Script
text/plain 154.59.122.94
COGENT-174

General

Check archive.org

Show headers Download Go to

Full URL: https://e.acuityplatform.com/pj?pk=5371219865983838496&pu=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 154.59.122.94 Schiphol, Netherlands, ASN174 (COGENT-174, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-allow-origin: *

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/1015287688/ 5 KB
3 KB 22ms
22ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1015287688/?random=1727112384991&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&rfmt=3&fmt=4

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

8327bfb3b1a5fd3868717fc973c2c9c0c242b1c03f54699f3284a9ad81625b01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2640
date: Mon, 23 Sep 2024 17:26:25 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 getuidj Show response
secure.adnxs.com/ 29 B
1 KB 26ms
26ms XHR
application/json 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

aca652e985ffe2a9790fc35b1039199696cc6e9e1d22088b062c06a2aa8325b6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.76; 45.141.152.76; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
an-x-request-uuid: e98d9033-0107-4090-9b10-3ddf0d228f9a
content-length: 29
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 23 Sep 2024 17:26:25 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 15ms
7ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.trendmicro.com
content-length: 7
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 35 B
336 B 91ms
23ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: dbcafd69cdbcda0186272ff0a68dcab1a8dd8b20da8b92f6b466b9cb138945d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:ac8:20:3a00:1012:75f3:463c:6bc
expires: Mon, 23 Sep 2024 17:26:25 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727112385028_34901612_420934837_32_1227_6_41_219";dur=1
access-control-allow-origin: https://www.trendmicro.com
content-length: 35
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/html
vary: Origin

GET adsct
t.co/1/i/ 0
0

GET adsct
analytics.twitter.com/1/i/ 0
0

GET adsct
t.co/1/i/ 0
0

GET adsct
analytics.twitter.com/1/i/ 0
0

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
440 B 123ms
122ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1279657&r=1727112385018&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&version=2.4
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
ibc_rate_tier: 1279657
Referer: https://www.trendmicro.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-encoding: identity
expires: Mon, 23 Sep 2024 18:26:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 43
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/gif
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
vary: Origin
x-guploader-uploadid: AD-8ljse-wgQt59TGzs1WiJadbiFQ7kGNP3mUXjWj-Rx7fLsVT08LuPFCsrcollBZdAYZ1j14Us
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1670534369365034
content-length: 43
server: nginx/1.20.2

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 161ms
111ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1279657&r=1727112385018&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 23 Sep 2024 17:26:25 GMT
expires: Mon, 23 Sep 2024 17:26:25 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: AD-8ljuoOM9b4U_FC6lVMWFxdkHZosQSAvDtVe8Xl92iSAv-QU4g8wO6K_8Lwk7MbkDN1T2Uh4g

GET
H2 200 26044208.js Show response
bat.bing.com/p/action/ 369 B
423 B 33ms
32ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/26044208.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0F1B2817C1104D0380BE6A484AAC1F43 Ref B: FRAEDGE2011 Ref C: 2024-09-23T17:26:25Z
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:26:24 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 pixel;r=1763422802;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtre...
pixel.quantserve.com/ 35 B
455 B 21ms
11ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1763422802;rf=0;a=p-yyb3JEF9Pm8ey;url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio;ref=https%3A%2F%2Ft.co%2F;uht=2;fpan=1;fpa=P0-613941062-1727112384752;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;d=trendmicro.com;dst=1;et=1727112385079;tzo=-120;ogl=url.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-%2Ctitle.Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%252C%20BBTok%20Abuses%20Utility%20Command%2Cdescription.Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20use%2Csite_name.Trend%20Micro%2Cimage.https%3A%2F%2Fwww%252Etrendmicro%252Ecom%2Fcontent%2Fdam%2Ftrendmicro%2Fglobal%2Fen%2Fresearch%2Fthumbnails%2F%2Clocale.en_US;ses=eec93dc0-af2f-4971-8a63-2d5272191244;mdl=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=86400
cache-control: private, no-cache, no-store, proxy-revalidate
pragma: no-cache
expires: Fri, 04 Aug 1978 12:00:00 GMT
content-length: 35
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
date: Mon, 23 Sep 2024 17:26:25 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[],"trigger_data":"1"}]}
content-type: image/gif

POST
H/1.1 200
OK visitWebPage
945-cxd-062.mktoresp.com/webevents/ 2 B
318 B 572ms
98ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1727112385082&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1727112385082-31597&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html&_mchPc=https%3A&_mchVr=163&_mchEcid=29C656F85FE1CBB80A495C08%40AdobeOrg%3A6%3A55154392717789483164135576546273069570&_mchHa=&_mchRe=https%3A%2F%2Ft.co%2F&_mchQp=utm_source%3Dtrendmicroresearch__-__utm_medium%3Dsmk__-__utm_campaign%3D092024_Mekotio
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: 2640bf24-c550-4a66-a41f-bd9307dad99a
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Mon, 23 Sep 2024 17:26:25 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 15ms
15ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1359406478&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&dr=https%3A%2F%2Ft.co%2F&ul=de-de&de=UTF-8&dt=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.1238298223.1727112385.1727112385.1727112385.1&_utmz=44797537.1727112385.1.1.utmcsr%3Dtrendmicroresearch%7Cutmccn%3D092024_Mekotio%7Cutmcmd%3Dsmk&_utmht=1727112385084&_u=aCDCCAIrBAAAACAMIg~&cid=1238298223.1727112385&tid=UA-44592531-1&_gid=1502934814.1727112385&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&cd2=Mhica%20Romero%7CThreats%20Analyst%2CJoshua%20Aquino%7CThreats%20Analyst%2CJanus%20Agcaoili%7CThreats%20Analyst%2CChristian%20Jason%20Geollegue%7CThreat%20Response%20Engineer%2CAllen%20Benedict%20Magpoc%7CSr.%20Threat%20Response%20Engineer%2CMark%20Jason%20Co%7CSr.%20Threat%20Solution%20Engineer%2CKim%20Benedict%20Victorio%7CCybersecurity%20Engineer%2CAdriel%20Isidro%7CSr.%20Engineer%20-%20Threat%20Research%2CRaymond%20Joseph%20Alfonso%7CSr.%20Threat%20Response%20Engineer&cd3=2024-09-05&z=553591966

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
date: Mon, 23 Sep 2024 17:26:25 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 159ms
145ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&v=1.1.27

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:25 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 120ms
106ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22f0978075a275d14104571cd0b3e9919c9748869b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22810eb8f4ed8abcee5cd1e233263d8d3f%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&v=1.1.27

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:25 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 122ms
109ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:25 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3 200 de.js Show response
static.addtoany.com/menu/locale/ 750 B
1001 B 25ms
24ms Script
application/javascript 2606:4700:10::ac43:2794
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/locale/de.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:2794 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"86610d84a116a5704d658324728b063f"
age: 3908
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=huqnunWOEb1NKuc6CaGjE2IxVCDQEq%2BgbHkujp21RZYSMlPR5qsqv5%2BUjvidmUT449rG%2F5bWZXvcmX18g6R0fOZTi8gPzvKozMFIOgGZXEWtR%2Foi9sIAY8PhMseG2uEB59%2B4SesWNfQFqlWhsJAZe1U2"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-polished: origSize=902
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=86400, stale-while-revalidate=30, public
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8c7c3d570b949f1b-FRA
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 319 KB
100 KB 33ms
33ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2ea29a59882cbd54d99299ee8b0134eef1ea3d32525d86c12e0f3371d2d1b5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Mon, 23 Sep 2024 17:26:25 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102812
date: Mon, 23 Sep 2024 17:26:25 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 33ms
8ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1727112385140&sw=1600&sh=1200&v=2.9.167&r=stable&a=tmtealium&ec=0&o=12318&fbp=fb.1.1727112385137.291446658356474506&cs_est=true&ler=other&cdl=API_unavailable&it=1727112384975&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1328, tbw=2844, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 170ms
145ms Image
image/png 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=243552383039605&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1727112385140&sw=1600&sh=1200&v=2.9.167&r=stable&a=tmtealium&ec=0&o=12318&fbp=fb.1.1727112385137.291446658356474506&cs_est=true&ler=other&cdl=API_unavailable&it=1727112384975&coo=false&rqm=FGET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7417891212187172580"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 3j0EdPQjHF6eCFa+eEz20bWiGME3MW1DZyHnEMkIKlsIqttOR3f2Rllhjy/KPhNyGFa4zWE77ZzkayVwf80e1w==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7417891212187172580", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=14, mss=1328, tbw=3161, tp=-1, tpl=-1, uplat=137, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H3

200

/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTy...
https://www.google.com/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&...
https://www.google.de/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u...

42 B
64 B

68ms
34ms

Image
image/gif

2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECShV0cmlnZ2VyLCBldmVudC1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI-fDHgcvZiAMVRKGDBx0jSDK4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8&is_vtc=1&cid=CAQSKQDpaXnfULjlLSFs_QI3qhbyp3J2bPmzR5BHFcQzryZItomgKueNFTGp&random=2104025035&resp=GooglemKTybQhCsO&ipr=y

Requested by

Protocol

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 23 Sep 2024 17:26:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
location: https://www.google.de/pagead/1p-conversion/1015287688/?random=1608703872&cv=9&fst=1727112384991&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=466465926&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ref=https%3A%2F%2Ft.co%2F&tiba=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&async=1&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECShV0cmlnZ2VyLCBldmVudC1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI-fDHgcvZiAMVRKGDBx0jSDK4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOhtodHRwczovL3d3dy50cmVuZG1pY3JvLmNvbS8&is_vtc=1&cid=CAQSKQDpaXnfULjlLSFs_QI3qhbyp3J2bPmzR5BHFcQzryZItomgKueNFTGp&random=2104025035&resp=GooglemKTybQhCsO&ipr=y
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 23 Sep 2024 17:26:25 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 / Show response
sumome.com/api/load/ 803 B
1 KB 172ms
162ms Fetch
application/json 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/api/load/

Requested by

Host: load.sumome.com
URL: https://load.sumome.com/18.46ec647ca3511952dc00.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-96-223.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

4c56a5d883627786c764c3fc2a9c3e4bff521f0b0dce1525b87cc29148a73b07

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
content-length: 803
date: Mon, 23 Sep 2024 17:26:26 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

OPTIONS
H2 204 /
sumome.com/api/load/ Frame 0
0 1667ms
160ms Preflight 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/api/load/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-80-96-223.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Mon, 23 Sep 2024 17:26:26 GMT
server: nginx/1.21.5

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 760 B
725 B 29ms
14ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: bba6c74b51fa493e32e7bd916388df1d6a6efc08df83ea42bc20cfbdbd248282

Request headers

Authorization: Token f0978075a275d14104571cd0b3e9919c9748869b
X-6s-CustomID: WebTag1.0 810eb8f4ed8abcee5cd1e233263d8d3f
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-encoding: gzip
x-6si-region: eu-central-1a
access-control-allow-credentials: true
x-trace-id: 5928051200812477824
access-control-allow-origin: https://www.trendmicro.com
content-length: 403
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: nginx

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 36ms
9ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.trendmicro.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Mon, 23 Sep 2024 17:26:25 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 1248948597211000796

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 163 B
359 B 100ms
99ms XHR
text/plain 18.193.54.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=1j7Ig4BaDD-2O7rpgSDWYw&is_js=true&landing_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&t=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&tip=ZabeQGA9CdsJ3J3_sZK4oVIQSPlwraGONVTVvyfsIZg&host=https%3A%2F%2Fwww.trendmicro.com&sa_conv_data_css_value=%270-0860521f-cbfc-5ec9-6269-906ff5c8e9b4%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90860521fcbfc5ec96269906ff5c8e9b42d8d984c&l_src=&l_src_d=&u_src=trendmicroresearch&u_src_d=2024-09-23T17%3A26%3A24.983Z&shop=false&sa-user-id-v3=s%253AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQgwMnGtwYwAToEQN4Ii0IEobwLuw.X6rHWqm7C3J3adwJgzPP6bcN0kKdnDY05tVS1bwMItg&sa-user-id-v2=s%253ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%252B0lT6DQInO0mJKcjUEU0&sa-user-id=s%253A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%252BiQQG%252F2%252BmOfhWwFrDYHRu5J1Y6x37A
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.193.54.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-54-173.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 7aa5165924f115f6e8c64a1e2d6bf238c5f33665fac27c6d69ba9e05a6bc701a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.trendmicro.com
content-length: 163
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 18ms
15ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-JSMMKXDWBS&gtm=45je49j0v9164383042za200&_p=1727112384003&gcd=13l3l3l2l2l1&npa=0&dma_cps=syphamo&dma=1&tag_exp=0&gdid=dYWJhMj.dYmQxMT&ul=de-de&sr=1600x1200&cid=1238298223.1727112385&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&dr=https%3A%2F%2Ft.co%2F&dt=Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)&sid=1727112385&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&ep.ua_dimension_2=Mhica%20Romero%7CThreats%20Analyst%2CJoshua%20Aquino%7CThreats%20Analyst%2CJanus%20Agcaoili%7CThreats%20Analyst%2CChristian%20Jason%20Geollegue%7CThreat%20Response%20Engineer%2CAllen%20Benedict%20Magpoc%7CSr.%20Threat%20Response%20Engineer%2CMark%20Jason%20Co%7CSr.%20Threat%20Solution%20Engineer%2CKim%20Benedict%20Victorio%7CCybersecurity%20Engineer%2CAdriel%20Isidro%7CSr.%20Engineer%20-%20Threat%20Research%2CRaymond%20Joseph%20Alfonso%7CSr.%20Threat%20Response%20Engineer&ep.ua_dimension_3=2024-09-05&tfd=3487
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JSMMKXDWBS&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: text/plain
server: Golfe2

GET
BLOB 200
OK 7284aa47-1872-4303-af9b-3a7dcbc4093e
https://www.trendmicro.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.trendmicro.com/7284aa47-1872-4303-af9b-3a7dcbc4093e
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif
Content-Length: 43

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
209 B 110ms
108ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D132D575D46E4C65B9F32BA7BB93212C Ref B: FRAEDGE1917 Ref C: 2024-09-23T17:26:25Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYizLA5ej7VPHJwu11G1g==
x-li-proto: http/2
access-control-allow-origin: https://www.trendmicro.com
x-cache: CONFIG_NOCACHE
date: Mon, 23 Sep 2024 17:26:24 GMT
vary: Origin

GET
H2 200 up
insight.adsrvr.org/track/ Frame 5B53 0
0 242ms
38ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&upid=803df29&upv=1.1.0&paapi=1
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: text/html
date: Mon, 23 Sep 2024 17:26:25 GMT
server: Kestrel

GET
H2 200 favicon.ico
www.trendmicro.com/content/dam/trendmicro/ 3 KB
4 KB 222ms
221ms Other
image/x-icon 23.206.209.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.209.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-209-41.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3818e71293245021a4db81e76832f162d45ff7cb518be638f0cc96797f7c2361

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio

Response headers

content-encoding: gzip
etag: "d1a-609031a4befc0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Mon, 23 Sep 2024 17:27:06 GMT
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=27, origin; dur=159, ak_p; desc="1727112385516_399431126_460533119_18564_18727_18_0_219";dur=1
date: Mon, 23 Sep 2024 17:26:25 GMT
content-type: image/x-icon
vary: Accept-Encoding
last-modified: Tue, 31 Oct 2023 13:26:31 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=41
accept-ranges: bytes
content-length: 3377
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 config Show response
api.equally.ai/api/v1/widget/ 39 KB
39 KB 135ms
133ms XHR
application/json 18.215.47.1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=76d0cdf81764befa6ed3704d39d8b4ad
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.215.47.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-47-1.compute-1.amazonaws.com
Software: nginx /
Resource Hash: de92b47473cacb4f157f0a62770610c8af4dc4625238e4d691a6e1f369e24c02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Referer: https://www.trendmicro.com/

Response headers

apigw-requestid: ekauagkVoAMEVtg=
access-control-allow-origin: *
content-length: 40180
date: Mon, 23 Sep 2024 17:26:26 GMT
content-type: application/json
server: nginx

OPTIONS
H2 204 config
api.equally.ai/api/v1/widget/ Frame 0
0 337ms
104ms Preflight 18.215.47.1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=76d0cdf81764befa6ed3704d39d8b4ad
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.215.47.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-47-1.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,equally-auth-provider,equally-client-id,referer,user-agent,x-referer
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: ekauZgCmIAMEV8w=
date: Mon, 23 Sep 2024 17:26:26 GMT
server: nginx

POST
H2 204 /
02179915.akstat.io/ 0
228 B 196ms
173ms Ping
image/gif 2a02:26f0:e300:186::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://02179915.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/LJA84-589LU-SVNVV-WKPLQ-NBTC7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:e300:186::11a6 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: Mon, 23 Sep 2024 17:26:26 GMT
access-control-allow-origin: https://www.trendmicro.com
alt-svc: h3=":443"; ma=93600
x-xss-protection: 0
date: Mon, 23 Sep 2024 17:26:26 GMT
content-type: image/gif

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 98ms
97ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A24%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:26 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:26 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 204 config
api.equally.ai/api/v1/widget/ Frame 0
0 111ms
111ms Preflight 18.215.47.1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=76d0cdf81764befa6ed3704d39d8b4ad
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.215.47.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-47-1.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,equally-auth-provider,equally-client-id,referer,user-agent,x-referer
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: ekaudjRDIAMEbVQ=
date: Mon, 23 Sep 2024 17:26:26 GMT
server: nginx

GET
H2 200 OpenDyslexic-Regular.woff
widget.equally.ai/fonts/ 16 KB
17 KB 11ms
11ms Font
font/woff 52.222.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/fonts/OpenDyslexic-Regular.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-214-66.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

2282dbd646a0e093b6315a3692cb2ab6c9bca68d46c01f7c6fba2f1ae924a953

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 3000
etag: "7312cd3f9b4e0804d9051e37e97579bf"
age: 55327
access-control-allow-methods: HEAD, GET
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: Z65RD9Id9188MEbL_C1rk26KEllMdwwfq2d3s5UtBH2EIw6oeZW-bw==
date: Mon, 23 Sep 2024 02:04:20 GMT
content-type: font/woff
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Sun, 15 Sep 2024 12:22:13 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 626c544a24a86c6cd608360f520b6d8c.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16636
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 config Show response
api.equally.ai/api/v1/widget/ 27 B
158 B 139ms
134ms XHR
application/json 18.215.47.1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=76d0cdf81764befa6ed3704d39d8b4ad
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.215.47.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-47-1.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
Content-Type: text/plain;charset=UTF-8

Response headers

apigw-requestid: ekauejRdIAMEVxA=
access-control-allow-origin: *
content-length: 27
date: Mon, 23 Sep 2024 17:26:26 GMT
content-type: application/json
server: nginx

GET
H2 200 en.json Show response
widget.equally.ai/locales/ 10 KB
4 KB 24ms
10ms Fetch
application/json 52.222.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/locales/en.json

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-214-66.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f3d804706c6ccb7955d146f5b9a86c200ee5788031e0c8601a0d758da2ce6e54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"c8654951b307d59acadb3324470b6d22"
age: 36513
access-control-allow-methods: HEAD, GET
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: LvHcYZ3niwg8SSDi__fdMEc_5CcMrbk4PmqE2gfi-5RCvrPXEN6ddQ==
date: Mon, 23 Sep 2024 07:17:54 GMT
content-type: application/json
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Sun, 15 Sep 2024 12:22:13 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 626c544a24a86c6cd608360f520b6d8c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 equallyai-widget.css
widget.equally.ai/ Frame 57F9 33 KB
8 KB 13ms
5ms Stylesheet
text/css 52.222.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/equallyai-widget.css

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-214-66.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

854ddbc5992a2937cb1f4dc3410bbfe29f87ead7333b7ffcdc574d8cef820834

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: W/"0af86e2d854d27f3d87308e726dacdb0"
age: 53338
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: dkatH44bC91V3Af-XhTx1ki9fp4nIBVb-4x3PABxKXm7CEGD_9M_WA==
date: Mon, 23 Sep 2024 02:37:29 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 15 Sep 2024 12:22:12 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 122731c1a09cfba14dfeeff504946134.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 145ms
144ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:27 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:27 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 204 services
sumome.com/ Frame 0
0 160ms
160ms Preflight 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/services
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-80-96-223.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Mon, 23 Sep 2024 17:26:27 GMT
server: nginx/1.21.5

POST
H2 200 services Show response
sumome.com/ 124 B
653 B 173ms
172ms Fetch
application/json 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/services

Requested by

Host: load.sumome.com
URL: https://load.sumome.com/18.46ec647ca3511952dc00.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-96-223.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

88d1d0dd8730d866219619561304b3b5c22e3999a59dab5f70b88384312eff0f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
content-length: 124
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 23 Sep 2024 17:26:27 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 3.46ec647ca3511952dc00.js Show response
load.sumome.com/ 676 KB
182 KB 14ms
14ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/3.46ec647ca3511952dc00.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: ad4307e063ad404176f0f8ebdb9cc8c7f7e931d955b3e507d5fccce5057dc5df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"7ab13d19479a6e9429900eac65683b85"
date: Mon, 23 Sep 2024 17:26:27 GMT
last-modified: Wed, 18 Sep 2024 19:19:23 GMT
cdn-cachedat: 09/18/2024 19:22:17
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: dskjKruZ4jeLxXJwy7DPh7zkLZIa8WmNZOZ0qp6n16m7MPlJVERaTikfyAA8YjPLGUegy6NR2l0=
cdn-cache: HIT
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 57fc393995c4915cbc180ab374b3ccf3
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 41RXC53M3DQNZQFS
cdn-edgestorageid: 1080
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 6.46ec647ca3511952dc00.js Show response
load.sumome.com/ 85 KB
23 KB 19ms
19ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/6.46ec647ca3511952dc00.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: cc11f004f68e459ca5e932f07d11f5a6699d98c09d0a5b6ea53b8128b29f512e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"4fe5cf605d9699d0e284feb35983f890"
date: Mon, 23 Sep 2024 17:26:27 GMT
last-modified: Wed, 18 Sep 2024 19:19:23 GMT
cdn-cachedat: 09/18/2024 19:22:17
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: DKmHMCH75zc3+HeBPToUSuwareLVvdSXsQJGU951LTvfdXOhT8EhEQfwf8Y/8PNIeQ307i7Z2VE=
cdn-cache: HIT
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: f259a213fb047e09347360d9a00ad3ee
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 41RHNQSQ44N7HP1P
cdn-edgestorageid: 1081
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 0.46ec647ca3511952dc00.js Show response
load.sumome.com/ 1 MB
69 KB 18ms
18ms Script
application/javascript 2400:52e0:1e00::1079:1
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/0.46ec647ca3511952dc00.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: BunnyCDN-DE1-1079 /
Resource Hash: 99e1662145d49d40c3f8b51605a7e866c746f59908ef9282adf772f8dd1796d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: W/"e257aaf520595c386bcf8cee028000d9"
date: Mon, 23 Sep 2024 17:26:27 GMT
last-modified: Wed, 18 Sep 2024 19:19:22 GMT
cdn-cachedat: 09/18/2024 19:22:19
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-requestpullcode: 200
x-amz-id-2: 1Ku6a6fSNGtRHiRB5gL3nxt0cv+NqEFUrpXvZX4wYSGdpdjDdr2R1h8oA2Vy4W/9RC0GRgu4RaE=
cdn-cache: HIT
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 20b2d7266d7201758b29b90310bbc01c
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 3NK8KMEHECWPYEWC
cdn-edgestorageid: 1082
server: BunnyCDN-DE1-1079
cdn-requestcountrycode: DE

GET
H2 200 features Show response
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ 3 KB
2 KB 189ms
164ms XHR
application/json 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-80-96-223.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

9fe32fcedd92823e81afe9b6e9a644a9d532e28b050cd62d206c751d1b2b7ac8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

X-Sumo-Auth: undefined
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
content-encoding: gzip
etag: "-1185325989"
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
date: Mon, 23 Sep 2024 17:26:27 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

OPTIONS
H2 204 features
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ Frame 0
0 187ms
186ms Preflight 35.80.96.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.80.96.223 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-80-96-223.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-sumo-auth
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Mon, 23 Sep 2024 17:26:27 GMT
server: nginx/1.21.5

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 118ms
107ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A26%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:28 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:28 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 105ms
104ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:29 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:29 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 100ms
99ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A28%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:30 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:30 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 102ms
101ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=adcea767-69ba-4b60-801c-387b59277729&session=73879389-eca1-4b2e-8247-05e7430e427f&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2023%20Sep%202024%2017%3A26%3A29%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Notorious%20Mekotio%20and%20BBTok%20are%20having%20a%20resurgence%20targeting%20Latin%20American%20users.%20Mekotio%E2%80%99s%20latest%20variant%20suggests%20the%20gang%20behind%20it%20is%20broadening%20their%20target%2C%20while%20BBTok%20is%20seen%20abusing%20MSBuild.exe%20to%20evade%20detection.%20%22%2C%22keywords%22%3A%22phishing%2Carticles%2C%20news%2C%20reports%2Cresearch%22%2C%22title%22%3A%22Banking%20Trojans%20Mekotio%20Looks%20to%20Expand%20Targets%2C%20BBTok%20Abuses%20Utility%20Command%20%7C%20Trend%20Micro%20(US)%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&pageViewId=11d81737-a1ad-4d51-805b-f1ae3829bd86&an_uid=7730593977051895126&ipv6=2001%3Aac8%3A20%3A3a00%3A1012%3A75f3%3A463c%3A6bc&v=1.1.27

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 23 Sep 2024 17:26:31 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 23 Sep 2024 17:26:31 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 5427711.fls.doubleclick.net
URL: https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=2355371282007;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=1037108164;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9188098692z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio?

Domain: 9572106.fls.doubleclick.net
URL: https://9572106.fls.doubleclick.net/activityi;src=9572106;type=trend002;cat=globa0;ord=5872169385511;npa=1;auiddc=869399772.1727112384;u1=%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html;gdid=dYWJhMj;ps=1;pcor=499455593;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe49j0v9190653197z872003116za201zb72003116;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;tag_exp=0;epver=2;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio?

Domain: t.co
URL: https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=26f4fdbb-dd8c-4506-9329-1582e12d8d96&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b0b1922d-1d40-4ef2-b385-f5ee55f14bdd&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.30

Domain: analytics.twitter.com
URL: https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=26f4fdbb-dd8c-4506-9329-1582e12d8d96&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b0b1922d-1d40-4ef2-b385-f5ee55f14bdd&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&tw_iframe_status=0&txn_id=oalxs&type=javascript&version=2.3.30

Domain: t.co
URL: https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=8e37cb3f-d2cd-44be-931e-b16e4bb6ca43&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b0b1922d-1d40-4ef2-b385-f5ee55f14bdd&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&tw_iframe_status=0&txn_id=nuwoi&type=javascript&version=2.3.30

Domain: analytics.twitter.com
URL: https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=8e37cb3f-d2cd-44be-931e-b16e4bb6ca43&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=b0b1922d-1d40-4ef2-b385-f5ee55f14bdd&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&tw_iframe_status=0&txn_id=nuwoi&type=javascript&version=2.3.30

Verdicts & Comments Add Verdict or Comment

190 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

60 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 09:15:26	Name: muc Value: eef8b426-c76a-4c8a-8e0a-f80817783095
.t.co/	1970-01-20 23:45:14	Name: __cf_bm Value: aEt1kutx26VhIOF2o5OLI8enBWQtKtOBlGm2m6ZdtZY-1727112381-1.0.1.1-iwxq650kOtCM.YoCY7_CEo30AW2yJfhpzS77JXtuwep4xCjlGaG2IoywLYhhk_qPwUPfCyh0.wmkwqeymyWKlA
.research.trendmicro.com/	1970-01-21 04:04:24	Name: _bit Value: o8nhql-72623900704ab6206b-00s
www.trendmicro.com/	1970-01-20 23:45:12	Name: NSC_MC_dxu-bfn-xfc_XBG-IUUQ Value: ffffffff09224f4245525d5f4f58455e445a4a423660
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: zlGJpXarEZk
.youtube.com/	1970-01-21 04:04:24	Name: VISITOR_INFO1_LIVE Value: ujqEMHvC_8Y
.youtube.com/	1970-01-21 04:04:24	Name: VISITOR_PRIVACY_METADATA Value: CgJERRIEEgAgKQ%3D%3D
.demdex.net/	1970-01-21 04:04:24	Name: demdex Value: 50693505083781453493726642188009331867
.trendmicro.com/	1969-12-31 23:59:59	Name: AMCVS_29C656F85FE1CBB80A495C08%40AdobeOrg Value: 1
.dpm.demdex.net/	1970-01-21 04:04:24	Name: dpm Value: 50693505083781453493726642188009331867
.trendmicro.com/	1970-01-21 09:21:12	Name: AMCV_29C656F85FE1CBB80A495C08%40AdobeOrg Value: 179643557%7CMCIDTS%7C19990%7CMCMID%7C55154392717789483164135576546273069570%7CMCAAMLH-1727717183%7C6%7CMCAAMB-1727717183%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1727119583s%7CNONE%7CMCSYNCSOP%7C411-19997%7CvVersion%7C5.5.0
.trendmicro.com/	1970-01-21 08:30:48	Name: utag_main Value: v_id:01921feb8d5a007a83faff3b55fc0506500bd05d00b08$_sn:1$_se:1$_ss:1$_st:1727114183835$ses_id:1727112383835%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/	1970-01-20 23:45:15	Name: _c1utm Value: utm_campaign=092024_Mekotio&utm_medium=smk&utm_source=trendmicroresearch&utm_content=undefined
.trendmicro.com/	1969-12-31 23:59:59	Name: _c1Ref Value: /en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html
.trendmicro.com/	1969-12-31 23:59:59	Name: _formRef Value: https://www.trendmicro.com/en_us/research/24/i/banking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=092024_Mekotio
.trendmicro.com/	1970-01-20 23:46:38	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+Sep+23+2024+19%3A26%3A23+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=824cf70e-f92e-4bfd-8eee-922e1bfae648&interactionCount=0&landingPath=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F24%2Fi%2Fbanking-trojans-mekotio-looks-to-expand-targets--bbtok-abuses-ut.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A0%2CC0004%3A0
.trendmicro.com/	1970-01-21 01:54:48	Name: _gcl_au Value: 1.1.869399772.1727112384
tags.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id Value: s%3A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%2BiQQG%2F2%2BmOfhWwFrDYHRu5J1Y6x37A
.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id Value: s%3A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%2BiQQG%2F2%2BmOfhWwFrDYHRu5J1Y6x37A
tags.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id-v2 Value: s%3ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%2B0lT6DQInO0mJKcjUEU0
.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id-v2 Value: s%3ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%2B0lT6DQInO0mJKcjUEU0
tags.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id-v3 Value: s%3AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQgwMnGtwYwAToEQN4Ii0IEobwLuw.X6rHWqm7C3J3adwJgzPP6bcN0kKdnDY05tVS1bwMItg
.srv.stackadapt.com/	1970-01-21 08:30:48	Name: sa-user-id-v3 Value: s%3AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQgwMnGtwYwAToEQN4Ii0IEobwLuw.X6rHWqm7C3J3adwJgzPP6bcN0kKdnDY05tVS1bwMItg
.resources.trendmicro.com/	1970-01-20 23:45:14	Name: __cf_bm Value: ZC4GJ17XQTupjTxD0ajPYxSGNZKSHJuUoPxhtmiiUys-1727112384-1.0.1.1-C37m95cBQwHr23wX7imW5GpFeLCrPpFaJBggyJoek7iVf8ofmY0s_qm5bo98.7oSk9CxVZEfEHPBww_4I3Fcgg
.trendmicro.com/	1970-01-21 09:21:12	Name: _ga_4502MK3B94 Value: GS1.1.1727112384.1.0.1727112384.0.0.0
.techtarget.com/	1970-01-20 23:45:14	Name: __cf_bm Value: fRVlsULlDKeL5fGuo.ZPDEvwUJYYeehV.umMmFNN9Uc-1727112384-1.0.1.1-N_weiokzqs9S0__GIYqQvenf4FprrjtBgMZMrJGe7kSKV9QeA8dN4LL_tCaVDBbvGh41RJX0NEb4oF6BWXmeIA
.doubleclick.net/	1970-01-21 00:28:24	Name: ar_debug Value: 1
.trendmicro.com/	1970-01-21 09:21:12	Name: __utma Value: 44797537.1238298223.1727112385.1727112385.1727112385.1
.trendmicro.com/	1969-12-31 23:59:59	Name: __utmc Value: 44797537
.trendmicro.com/	1970-01-21 04:08:00	Name: __utmz Value: 44797537.1727112385.1.1.utmcsr=trendmicroresearch\|utmccn=092024_Mekotio\|utmcmd=smk
.trendmicro.com/	1970-01-20 23:45:12	Name: __utmt Value: 1
.trendmicro.com/	1970-01-20 23:45:14	Name: __utmb Value: 44797537.1.10.1727112385
.trendmicro.com/	1970-01-21 09:21:12	Name: _ga Value: GA1.2.1238298223.1727112385
.trendmicro.com/	1970-01-20 23:46:38	Name: _gid Value: GA1.2.1502934814.1727112385
.adnxs.com/	1970-01-21 01:54:48	Name: XANDR_PANID Value: O0WoTzgr5rwMHcJw424PDl5xMnGPr5rAlet28PzcreF2i7js9VBNEwlCkpLTaaaFJWaXtAJNeUQZEk2r_e0gtsCnryCR8Ny_sRAQTtyub_w.
.adnxs.com/	1970-01-21 09:21:12	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 01:54:48	Name: uuid2 Value: 7730593977051895126
.trendmicro.com/	1969-12-31 23:59:59	Name: querystring Value: utm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D092024_Mekotio
www.trendmicro.com/	1970-01-21 00:28:24	Name: sa-u-source Value: trendmicroresearch
www.trendmicro.com/	1970-01-21 00:28:24	Name: sa-u-date Value: 2024-09-23T17:26:24.983Z
www.trendmicro.com/	1970-01-21 08:30:48	Name: sa-user-id Value: s%253A0-0860521f-cbfc-5ec9-6269-906ff5c8e9b4.iANDidbHJN0SJ%252BiQQG%252F2%252BmOfhWwFrDYHRu5J1Y6x37A
www.trendmicro.com/	1970-01-21 08:30:48	Name: sa-user-id-v2 Value: s%253ACGBSH8v8XsliaZBv9cjptC2NmEw.nzwjbSbzqIpuWUHwOOEkTl0%252B0lT6DQInO0mJKcjUEU0
www.trendmicro.com/	1970-01-21 08:30:48	Name: sa-user-id-v3 Value: s%253AAQAKICi_UwGIV8YzPpAr0X0RxUo3DmFNfR8Wg5_GsAhNtTb1ENYBGAQgwMnGtwYwAToEQN4Ii0IEobwLuw.X6rHWqm7C3J3adwJgzPP6bcN0kKdnDY05tVS1bwMItg
.acuityplatform.com/	1970-01-21 08:30:48	Name: auid Value: 1080654432789
.trendmicro.com/	1970-01-21 09:21:12	Name: _mkto_trk Value: id:945-CXD-062&token:_mch-trendmicro.com-1727112385082-31597
.quantserve.com/	1970-01-21 09:15:26	Name: mc Value: 66f1a4c1-176c9-cc6a1-842d2
www.trendmicro.com/	1970-01-20 23:55:17	Name: _an_uid Value: 7730593977051895126
www.trendmicro.com/	1970-01-21 09:21:12	Name: _gd_visitor Value: adcea767-69ba-4b60-801c-387b59277729
www.trendmicro.com/	1970-01-20 23:45:26	Name: _gd_session Value: 73879389-eca1-4b2e-8247-05e7430e427f
.trendmicro.com/	1970-01-21 09:09:41	Name: __qca Value: P0-613941062-1727112384752
.trendmicro.com/	1970-01-21 01:54:48	Name: _fbp Value: fb.1.1727112385137.291446658356474506
www.trendmicro.com/	1970-01-21 00:28:24	Name: __smVID Value: 15c721bc87e3b42625a0c76f5ef74df95e6da04ab2e21b64b5e8feb2a8e6a35f
.trendmicro.com/	1970-01-20 23:46:38	Name: _uetsid Value: f58ed2c079d011efbf24e7a4c5a5ebfe
.trendmicro.com/	1970-01-21 09:06:48	Name: _uetvid Value: f58f0e5079d011ef942a397fdf1f6eb3
.doubleclick.net/	1970-01-21 09:06:48	Name: IDE Value: AHWqTUnT-uzVeeWBzSGjnDVjRDuG-0jXK_tfEzJH1_w9W9Flftmu5CzfFQtjinWn
.linkedin.com/	1970-01-21 08:30:48	Name: bcookie Value: "v=2&a8cdb8b9-736b-489c-845f-26b1ff8ee166"
.linkedin.com/	1970-01-21 04:04:24	Name: li_gc Value: MTswOzE3MjcxMTIzODU7MjswMjGGsC1IHKaQb/WvXodeGGs1qay1NUprhjIIHpWgk85lkw==
.linkedin.com/	1970-01-20 23:46:38	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=3349:u=1:x=1:i=1727112385:t=1727198785:v=2:sig=AQG8XuErHBn38cfgw7GnguydBzfcsXwM"
.trendmicro.com/	1970-01-21 09:21:12	Name: _ga_JSMMKXDWBS Value: GS1.2.1727112385.1.0.1727112385.0.0.0
.www.trendmicro.com/	1970-01-20 23:55:17	Name: RT Value: "z=1&dm=www.trendmicro.com&si=44d94109-4bec-43cc-b8e0-bc360a8c2788&ss=m1fa4aqb&sl=1&tt=2u7&bcn=%2F%2F02179915.akstat.io%2F&ld=2ua"

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://assets.adobedtm.com/d205b04dc657/0c07287192f8/launch-75dcf65b28c1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 6) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://www.trendmicro.com/libs/granite/csrf/token.json Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

02179915.akstat.io
5427711.fls.doubleclick.net
945-cxd-062.mktoresp.com
9572106.fls.doubleclick.net
ad.doubleclick.net
analytics.twitter.com
api.equally.ai
assets.adobedtm.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
c.go-mpulse.net
cdn.bc0a.com
cdn.cookielaw.org
cm.everesttech.net
connect.facebook.net
customer.cludo.com
dpm.demdex.net
e.acuityplatform.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ibc-flow.techtarget.com
insight.adsrvr.org
ipv6.6sc.co
ixfd2-api.bc0a.com
j.6sc.co
js.adsrvr.org
load.sumome.com
munchkin.marketo.net
origin.acuityplatform.com
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
research.trendmicro.com
resources.trendmicro.com
resources.xg4ken.com
rules.quantcount.com
s.go-mpulse.net
s.ml-attr.com
secure.adnxs.com
secure.quantserve.com
sjs.bizographics.com
ssl.google-analytics.com
static.addtoany.com
static.ads-twitter.com
sumome.com
t.co
tags.srv.stackadapt.com
tags.tiqcdn.com
trendmicro.demdex.net
trendmicro.scene7.com
trk.techtarget.com
widget.equally.ai
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.trendmicro.com
www.youtube.com
5427711.fls.doubleclick.net
9572106.fls.doubleclick.net
analytics.twitter.com
t.co
104.17.70.206
13.107.42.14
142.250.181.226
142.250.181.230
154.59.122.94
172.66.0.227
18.172.103.101
18.193.54.173
18.215.47.1
192.28.144.124
199.232.188.157
2.17.100.184
2001:4860:4802:34::36
23.201.250.60
23.206.209.41
2400:52e0:1e00::1079:1
2600:9000:206f:aa00:5:7a81:86c0:93a1
2600:9000:223c:400:6:44e3:f8c0:93a1
2600:9000:235a:a200:7:2bfb:7c00:93a1
2606:4700:10::6816:1c60
2606:4700:10::6816:46c5
2606:4700:10::ac43:2794
2606:4700:4400::ac40:9b77
2606:4700::6812:1247
2606:4700::6812:572a
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2620:1ec:21::14
2620:1ec:33::10
2a00:1450:4001:806::2003
2a00:1450:4001:808::2008
2a00:1450:4001:808::200e
2a00:1450:4001:80e::2003
2a00:1450:4001:813::2002
2a00:1450:4001:813::2008
2a00:1450:4001:828::2004
2a00:1450:4001:82b::200a
2a00:1450:4001:830::200e
2a02:26f0:3500:10::210:a99
2a02:26f0:3500:c90::1e80
2a02:26f0:4700:29a::11a6
2a02:26f0:4700::210:238
2a02:26f0:ab00::214:8e70
2a02:26f0:e300:186::11a6
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
34.111.194.12
34.111.208.231
34.252.69.234
35.201.125.192
35.80.96.223
37.252.171.53
52.17.201.122
52.214.161.17
52.222.214.66
52.223.40.198
52.49.43.23
67.199.248.12
68.67.153.60
76.223.9.105
88.221.60.75
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
016f4f3d8b3b5bb5297bb1c4e7e415e0ab71288d00dc522d87777c0f234a42eb
03be325e57c1e138769dc6fd4dd5c1e22363309758bdfeda627cac7002598644
045cf7fd65fd76199b79479c9bfd035d30e173ef2942f8b82360c85a811e843a
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
075eaeaa24396deaf64ee5a0d3412418b5110822aa98628ec51d87ee8512073a
09fdf87496da0f4c299dd090e802e0c371f02a87391c1e9ac7d9430672790740
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e
1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
12a9667fd6b08fd3a1d424ec68050efcf81b3ff05bcfea4afa13f37ef1c61eea
1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c
16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776
17970bc9a276ab8f18cf7b736016e8cc059574e1b7867f8d27e505ddbdd1aeef
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
18fc4918ba75d7fd72c3595a98f73f0a994a24444c7d4a6718ff62e2209624a4
19e0028f1c1b5c45df4b2ec37a31d1ed3d34bcbb57325ae2a3c744a3fc7bc72a
1a2bb9485b7d1336d57383fcd7a93faf03d9ae5aaf7753fa864c92107c135735
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
1d4b9c9db31602e3a45ae73efab893ceb4bac5d793014bbb44f3575fc4351681
2282dbd646a0e093b6315a3692cb2ab6c9bca68d46c01f7c6fba2f1ae924a953
267f502bf1fc4032ddc729a6db0c2ba09d2dd9cd57336c5301bcc4e03a95a1a1
26d9c11091c7fe0bfc7ef04b672aafd066c29c29bcae1d6e1ddfe7cb53debc68
27fd123f23c19c3fdd7e51b404b96425bc94b91d5c489815cda40a7cd537db0a
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
293d0642bb36748cb0edbffeb9eb27ab33fff146e23e4fc0fe3eb49996b9fb34
2ac314870072e1aad5c1c2c1ebb9ba542bf1a9df18963c2c4f1d8fcab8711bde
2b1b28c6febd3c73227bd5f678a7875fdb2411e388fbef36b5bac5a56553397d
2b420def5f6ff55354c7e92389035e28da2714675bc0ae319e3b276643336920
2b524add8d0ff5dbbd3429d65441cc4fba7c803a5f486e539842be2af0d9b58e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ea29a59882cbd54d99299ee8b0134eef1ea3d32525d86c12e0f3371d2d1b5e4
316053aaf9346baa4841b37db43031f0f15c34c1940c5380191fe04cd2fc517a
3818e71293245021a4db81e76832f162d45ff7cb518be638f0cc96797f7c2361
39c195b4396975d0d8312a180757d36621162c3c2f2530d16472d0e1ca2fd3a9
3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3f59dd9cbd85d76315cdfa68088b11e8af14a13fb3598d55cd32c81ebe3549f2
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b
43b80cd82f36e0ab060a90d0d251880d0199afb8fb67be7c3eac50ab3f3c8afe
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45395d2f11cd67cd97a9916ca1b4d48fca9fafa168195e6b1466d9e8a176ff13
454cb8f0084cceccd01e3cf3691a10258bd86fbd6dbfc5e3e2ab80ad83400086
460a8fcb2ffb9b8c7b7998f2de1acd6cff53b555f809dab05193ac6ab15edcb7
49d9b42c070befc015babb34120f727256d5ae55ea937cce30d7cde9dccdc3dc
49e7cc1a7169e40913fdcd4d2eec26a80f8372f9c0a99e52bac80cdbb1a5779c
4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
4c56a5d883627786c764c3fc2a9c3e4bff521f0b0dce1525b87cc29148a73b07
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4de632194e6964e85e20360f4342e3753a57263a986bdf2eae6d64de38a14798
4f3937dfb65cd39c59f5f8162eb9e652d8d321d18089857e53e387f2244d7482
4f5fc380b52a5670755662ecac2bf442d375e71f53b335ba798e3dfca095b0a3
50158df7c7c34b2ee50863ac98a702e15cb33e4fc91e46e1416abed0fafe1241
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
55ec6f06b3f7613063981efbffcd58a551ebfc773865b976a1dce8c52a39971a
56007b71a6d5ed0c546f0b405bf1771bbcf14857de855b28c78242080d059ab5
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d
5d1d439744bb3a9a72fbc0c2fef7b0be2f0d3f164d4e79c2a10acfa40cb0b511
5da9c51865ce2133c0713c8b7822fd58d72bc4e60c94976b9b6b9a66e72cdf58
5e0fc3dbb73f65f7e3901449fa3ee2813960e11faae65cb7c2df923cba2e30c0
5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8
60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
702a5e3ad4151d3f0c29a3d1510d6cbd93ebe47c6d28090cb28d96c152c74c2d
718b81757a4a4d863ff8f7ee379db24abde81658399d718e4592cf265b04caaa
71d18af9ee879a36717e1ea3367b669031e3f6b12cb0aa1373fd200d278c4e6a
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
757b1ade1a4833c94b964ff95fad2f1464b8ce479bb7f9d6b3b2ea66879c5179
76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7aa5165924f115f6e8c64a1e2d6bf238c5f33665fac27c6d69ba9e05a6bc701a
7d37a29c4b29e8c5ee89c48069cc6dacedd33d817cb57e8bba1a535011f1ece9
7d60675c8e7132a13f0e39f85145919e8acd5db090c777aa49876175a911d30f
7dffcf20eac7b2345159e39ec150605d84ea9f44a0dcbd7f6fc94efbf98f61a4
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
8167fb87d5a7ade1606cb4ef338f5974eee0a1a8b4a991345a151ae24b8ad1e7
8327bfb3b1a5fd3868717fc973c2c9c0c242b1c03f54699f3284a9ad81625b01
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
854ddbc5992a2937cb1f4dc3410bbfe29f87ead7333b7ffcdc574d8cef820834
85ff987ec3f6df2c78c68b39d7b742c32dc6a1f3e17a13ef2b120adeb5100882
873be680d3ddef940373267e6e36245a795a74f52aea10e71935c8aad4251a38
88d1d0dd8730d866219619561304b3b5c22e3999a59dab5f70b88384312eff0f
898241655767777d954a01288720b8487c6bfcaf831a0243b1e19a5cc67906a3
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
89cf66cb9de8da20fc15e9953845dd4d1de2c0fb465c827a09d818449222c533
89e7238488e96cffd68668c16693da4ad4588d0a1a9a170e2eff33c3ad4b16c1
8c5a7917b6d8fbe09a19eb8d9cc5ee3cef6757b64497bfe2dbbcae951cd4bb47
8c93f93a4e63a00a8bb2c15d87445a7fea1b47d472d2b04396579ee6652a7bc3
8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
90b024f2bb6ac5bf0a8a77160406044bc6e6549fbf7717a88af8e82023d9fa62
91b0809d8b9dc57eaa09cb0e13c210b24edfaeadb94a8cff0fee02751c1b0b5f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
99e1662145d49d40c3f8b51605a7e866c746f59908ef9282adf772f8dd1796d9
9a737728e7b58df7f041d3bc116b772513dbe032f506f2c94e721814fee0653d
9b6167b65b17e5f70e7f42429ef885790d8923fa69dd61bc9cbdff75686579d2
9f0f8b97bbedd536c657c8509450f8dbcc3618032ee7b22577d6d6f00f6a0e47
9fe32fcedd92823e81afe9b6e9a644a9d532e28b050cd62d206c751d1b2b7ac8
a066032f441dc52838d1b42dcc6641e1acca1f6cfc456b5b421fd96b44416e95
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aa9977a82006181f4794b832b3accfb3ebb1784fb9c00b02d3e34f2b5d036e00
aca652e985ffe2a9790fc35b1039199696cc6e9e1d22088b062c06a2aa8325b6
ad4307e063ad404176f0f8ebdb9cc8c7f7e931d955b3e507d5fccce5057dc5df
ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae
b8378205408adf45d3502fe6969056114cd4f9a16e7630088b42d496659ad33c
ba6ab8e7ed51e559d8cd5a3d97a9b66908f2edfbe28cc75e3c1a77785b946a07
bba6c74b51fa493e32e7bd916388df1d6a6efc08df83ea42bc20cfbdbd248282
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
bdfafe044e589bf5e4f238a212543b478f5c20788250a65de2634795b20fdf15
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
c00d9b408261611ce8f1140b8468ab5ffe2855f85195f093dd4a0aedad890cf8
c0a0cf4f21fa3e4dfcf4003127d7e76c5258ce6bef2a30d260ace782d261d6b2
c564b7cedb11c28a97fe8292fc8d20bf6b8e0ede52994d80f55c7c8a082c6700
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb34b12ae47afd7bb5befa05bb2e48251693bbefcc2e75a76fe6f72aff24d587
cc11f004f68e459ca5e932f07d11f5a6699d98c09d0a5b6ea53b8128b29f512e
cc651a190957f7e8a2a11543e666494f750eeacab9c5b79915cd284d819bd7f4
cc740e2f85c0de225c46dc13260e730a14d00b66f0b068ee4dd3bc9ca02de457
cc801ce0c56b23a865f8db45353f3d6b22b4a29c3728cf05d4634e181cbed937
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382
d29878164a9b6d38d44202a4e9e3f6ebc165c23c69faeaeb55d312bd56599617
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d4a6071a770dbe37af27b4852940819a37b51250018233b7781152705e002ceb
d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1
d5565491575b6e7e34519ff95adc8749bf232d908d98b19af0e598f97d9e77eb
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
d8d12aec28fbac51cd794cd38502fea3652485034407aecffe46f2c6fd31d3df
d9fabfbfd4d425891b9001334226ce1c9e13ec0eaf73abe83db40350c35a305f
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
daebe60287c37d53a04f216fde942a1453ffd8aed976f4079ae316926d7c0dfc
dbcafd69cdbcda0186272ff0a68dcab1a8dd8b20da8b92f6b466b9cb138945d7
dcc4d4718f57c5ee1e6a224d0e04fd117708518182a87453d82d0040b303e604
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd10bdc3028ea118c380a271f449e41f27dd6f7e8e3e6f8a753539fa611a4034
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de92b47473cacb4f157f0a62770610c8af4dc4625238e4d691a6e1f369e24c02
e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c
e29f9d33670f9b5be6c78747a5e74d1bd0c0f2923480246d4ba4004768679d63
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
ea34c88a2cc61324499aa7feacbbd95b9c97449a6a8ec642bde22290cbd41be8
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ee73898a4b24784c7a0bb80bc2960afe0328522cbd9a4e8ca70e9cc13703d2dc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f057d625f50c513ac2c93d4b7740e28afbce1f5184a6f2866367d6d669816b64
f0b37c6e8940c99069a86c372b1c03c4e370d54b9f1baf23a9f6b6c39f6ac7f0
f1f4feffb5be0045c2c720f211c6293a7e7fddb7548323ea6298f0df3fde0294
f28c05d6295472f7dd63e8eeb59e0d1b433ed9b7a60129efff8c7fffe3875093
f3d804706c6ccb7955d146f5b9a86c200ee5788031e0c8601a0d758da2ce6e54
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
fc9b6717cf6692fef1d9ebbdffde92264b1968ce839222fb1b400d635eed6e7d
fccc0c93601e70e152b4337e6448f90fe3771495da1c42c703a8181347b479b6
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.trendmicro.com Open in urlscan Pro 23.206.209.41 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

209 Requests

94 %HTTPS

52 %IPv6

46 Domains

66 Subdomains

56 IPs

6 Countries

8152 kBTransfer

16106 kBSize

60 Cookies

23 Outgoing links

Page URL History

Redirected requests

209 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.trendmicro.com Open in urlscan Pro
23.206.209.41 Public Scan

Screenshot
Live screenshot

Full Image

209
Requests

94 %
HTTPS

52 %
IPv6

46
Domains

66
Subdomains

56
IPs

6
Countries

8152 kB
Transfer

16106 kB
Size

60
Cookies

209 HTTP transactions
0 data transactions