cyware.com Open in urlscan Pro
52.24.83.42 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30...
Effective URL:
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=8897474...
Submission: On February 04 via api (February 4th 2021, 12:04:02 pm UTC) from DE

Summary HTTP 46 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 27 IPs in 6 countries across 24 domains to perform 46 HTTP transactions. The main IP is 52.24.83.42, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is cyware.com.
TLS certificate: Issued by Amazon on January 23rd 2021. Valid for: a year.

This is the only time cyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	199.60.103.2 199.60.103.2	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
4	52.24.83.42 52.24.83.42	16509 (AMAZON-02) (AMAZON-02)
13	2600:9000:20e... 2600:9000:20eb:8000:1:d92a:12c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::621	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:d2cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:b849	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	52.218.144.62 52.218.144.62	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:74b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:44b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:14bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:82ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5605	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:c9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:10c... 2a02:26f0:10c:58e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	3.12.28.145 3.12.28.145	16509 (AMAZON-02) (AMAZON-02)
46	27

2 199.60.103.2 (Canada) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

info.silobreaker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.24.83.42 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-24-83-42.us-west-2.compute.amazonaws.com

cyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2600:9000:20eb:8000:1:d92a:12c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

production.cyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::621 (Ascension Island)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d2cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:b849 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.144.62 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-w.amazonaws.com

cyware-ent.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:74b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:44b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:14bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:82ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5605 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c9cc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:58e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.12.28.145 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-12-28-145.us-east-2.compute.amazonaws.com

debugger.cyware.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	cyware.com cyware.com production.cyware.com	2 MB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	1 KB
2	hubspot.com forms.hubspot.com track.hubspot.com	1005 B
2	google.de www.google.de	215 B
2	google.com www.google.com	215 B
2	doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	1 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	gstatic.com fonts.gstatic.com	18 KB
2	silobreaker.com 1 redirects info.silobreaker.com	3 KB
1	cyware.io debugger.cyware.io	242 B
1	googleadservices.com www.googleadservices.com	12 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
1	licdn.com snap.licdn.com	2 KB
1	hubapi.com api.hubapi.com	569 B
1	hsforms.com forms.hsforms.com	298 B
1	hscollectedforms.net js.hscollectedforms.net	23 KB
1	hs-banner.com js.hs-banner.com	13 KB
1	hs-analytics.net js.hs-analytics.net	18 KB
1	hsadspixel.net js.hsadspixel.net	2 KB
1	amazonaws.com cyware-ent.s3.amazonaws.com	316 KB
1	hsforms.net js.hsforms.net	127 KB
1	hs-scripts.com js.hs-scripts.com	742 B
1	polyfill.io polyfill.io	509 B
1	googleapis.com fonts.googleapis.com	750 B
46	24

	Domain	Requested by
13	production.cyware.com	cyware.com production.cyware.com
4	cyware.com	info.silobreaker.com cyware.com production.cyware.com
2	px.ads.linkedin.com	1 redirects
2	www.google.de	cyware.com
2	www.google.com	cyware.com
2	www.google-analytics.com	production.cyware.com
2	fonts.gstatic.com	fonts.googleapis.com
2	info.silobreaker.com	1 redirects
1	debugger.cyware.io	production.cyware.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	www.googletagmanager.com	js.hsadspixel.net
1	snap.licdn.com	js.hsadspixel.net
1	api.hubapi.com	production.cyware.com
1	track.hubspot.com
1	forms.hsforms.com	cyware.com
1	forms.hubspot.com	production.cyware.com
1	stats.g.doubleclick.net	production.cyware.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	cyware-ent.s3.amazonaws.com	cyware.com
1	js.hsforms.net	cyware.com
1	js.hs-scripts.com	cyware.com
1	polyfill.io	cyware.com
1	fonts.googleapis.com	cyware.com
46	28

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com
www.kryptoslogic.com
www.menlosecurity.com
www.google.com
apps.apple.com
play.google.com
twitter.com
www.linkedin.com
www.youtube.com
www.iubenda.com

Subject Issuer	Validity	Valid
info.silobreaker.com Cloudflare Inc ECC CA-3	`2020-06-30` - `2021-06-30`	a year	crt.sh
*.cyware.com Amazon	`2021-01-23` - `2022-02-20`	a year	crt.sh
cyware.com Amazon	`2020-10-04` - `2021-11-03`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2020-07-27` - `2021-07-27`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2020-07-03` - `2021-07-03`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.cyware.io Amazon	`2021-01-06` - `2022-02-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Frame ID: B0464061810CABB74DBD7BBD16EBD6A9
Requests: 49 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42... Page URL
https://info.silobreaker.com/events/public/v1/track/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV... HTTP 307
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-15... Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-v(?:ue)-/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

46
Requests

100 %
HTTPS

81 %
IPv6

24
Domains

28
Subdomains

27
IPs

6
Countries

2563 kB
Transfer

3453 kB
Size

4
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.zdnet.com/article/new-trickbot-module-uses-masscan-for-local-network-reconnaissance/
Title: a new module

Search URL Search Domain Scan URL

URL: https://www.kryptoslogic.com/blog/2021/02/trickbot-masrv-module/
Title: Kryptos Logic

Search URL Search Domain Scan URL

URL: https://www.menlosecurity.com/blog/trickbot-new-year-old-lure
Title: spam campaign

Search URL Search Domain Scan URL

URL: https://www.google.com/maps/place/Cyware+Labs/@40.7559136,-73.9881915,17z/data=!3m1!4b1!4m5!3m4!1s0x0:0xc1e4c88980c6b2fe!8m2!3d40.7559136!4d-73.9860028?hl=en
Title: Cyware Labs, 1460 Broadway, New York, NY 10036

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/cyware-social/id1082345915

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=co.cyware

Search URL Search Domain Scan URL

URL: https://twitter.com/CywareCo

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/10407612/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCBPcVKjzXijVkBWwV3wNjag

Search URL Search Domain Scan URL

URL: https://www.iubenda.com/terms-and-conditions/13599757
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.iubenda.com/privacy-policy/13599757/legal
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1 Page URL
https://info.silobreaker.com/events/public/v1/track/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1?_ud=9621c8f4-97ac-4bec-b041-740409efb263&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2232740%26time%3D1612440223294%26url%3Dhttps%253A%252F%252Fcyware.com%252Fnews%252Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%253F_hsmi%253D88974744%2526_hsenc%253Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&liSync=true

46 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49P...
info.silobreaker.com/e2t/tc/ 9 KB
2 KB 162ms
126ms Document
text/html 199.60.103.2
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.60.103.2 , Canada, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: info.silobreaker.com
:scheme: https
:path: /e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:32 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=d4e8cf4ac452ce732c250d0de27a02dca1612440212; expires=Sat, 06-Mar-21 12:03:32 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=67b6e1462985a54e5bdf9bca1517fc6435af6fdc-1612440212; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray: 61c43fbd8d4e1e79-AMS
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 080e862a7900001e7910353000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
server: cloudflare
content-encoding: br

GET
H2

200

Primary Request new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa Show response
cyware.com/news/
Redirect Chain

https://info.silobreaker.com/events/public/v1/track/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_...
https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQ...

293 KB
49 KB

1014ms
628ms

Document
text/html

52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU

Requested by

Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

c9135488238506768788d901ac1ce80816f79dc21ea16e2fbf392b833959ac66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: cyware.com
:scheme: https
:path: /news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1

Response headers

date: Thu, 04 Feb 2021 12:03:34 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
access-control-allow-origin: *
set-cookie: auth.strategy=local; Path=/
etag: "494c6-e+0fjgOhzw5fqBWGDOZhz/nJeLM"
accept-ranges: none
vary: Accept-Encoding
content-encoding: gzip
server: Cyware
cache-control: max-age=86400, no-cache, public
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains; preload;

Redirect headers

date: Thu, 04 Feb 2021 12:03:32 GMT
location: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
cf-ray: 61c43fbee8ea1e79-AMS
link: <https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU>; rel="canonical"
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
cf-request-id: 080e862b5500001e7960a36000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-robots-tag: none
server: cloudflare

GET
H2 200 a9e3035c06ced5018150.js Show response
production.cyware.com/social/ 3 KB
3 KB 58ms
19ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 82efa3a52ca2051d452e2c6b30a6574889b4ddf2e59345f223e5c2966f3a1816

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:39:15 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 15862
etag: "8b2018b56e28fde177a68eb40c1df483"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 2906
x-amz-cf-id: eKJ7OD4XKYAytShiUFGwmUVKetxLskpMNI6dV7fJ7D_jMxfocNhThA==

GET
H2 200 850ac2d58c15bb0d48f7.js Show response
production.cyware.com/social/ 188 KB
188 KB 68ms
29ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/850ac2d58c15bb0d48f7.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d16896edf8050f6a0cd7a7b9359ca7522be23382eac47ada9aa693c88cc519d1

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 01:45:51 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 37066
etag: "9e01af82290654e86a004c337a98972b"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 192230
x-amz-cf-id: bNKZMPL9jRo-AkQI-nBKdR94bjVVf2GJpknTPbcflP77HWJQB730eQ==

GET
H2 200 ab3c3fdc11d8a5319fde.js Show response
production.cyware.com/social/ 1 MB
1 MB 83ms
45ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 74d8bcba84408837591b6a12b342594272aad99a02eafe4a0280e6f8a444dea2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 09:10:41 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 10376
etag: "204dcdd0e6393cda79bb2e7abea7e11e"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 1373863
x-amz-cf-id: ix3Abx2F4dCxATIFpAW6GjKp-_U_wf9QDHgmdxoateYo8z5-j_8HdA==

GET
H2 200 84185a6080992cbb4815.js Show response
production.cyware.com/social/ 283 KB
283 KB 77ms
40ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/84185a6080992cbb4815.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f30acdaa946790462d6bd75c16d7b1559b24c57317e9bf78a1646bdb2d647ef3

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 22:52:20 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 47477
etag: "e2680a3159b5a3aa314c4bd1c442d4d1"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 289648
x-amz-cf-id: yP4wpElLaJ3rSNGR8DBcTsbBjbgfEGqrMs3XWAAwZefxEz0-RmhOiQ==

GET
H2 200 20d9a83167db52d23cd4.js Show response
production.cyware.com/social/ 14 KB
14 KB 97ms
59ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/20d9a83167db52d23cd4.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a6f5b70c11a59bd2b27a534812185b21e5c2c4a4367a69bf7069ebee21fdd07

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 22:52:20 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 47477
etag: "33c65c9badff270e60ba508134c2911b"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 13840
x-amz-cf-id: xaFonv1X6qmVh8V8wgAlNLrwiO8B0Cjyxt_BmJSX4DRhpZRs-mcN0Q==

GET
H2 200 css
fonts.googleapis.com/ 4 KB
750 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Requested by

Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2e8b49e8529d1acbd9834ac3ea1993ef3d37323bacac1acf2823cfa3939916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 04 Feb 2021 11:07:16 GMT
server: ESF
date: Thu, 04 Feb 2021 12:03:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 Feb 2021 12:03:36 GMT

GET
H2 200 37ae63c.svg
production.cyware.com/social/img/ 5 KB
6 KB 23ms
20ms Image
image/svg+xml 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/37ae63c.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d6aa44d7515541e116c9a091bb0b5a70e4f81728126347261635b5cda6aec1e4

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 06:12:16 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 21081
etag: "37ae63c6a9fe1cfb6c915056f0bba93a"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 5434
x-amz-cf-id: W6UCVW6OfibGo7c-5VzXZZqp_vIaTXeI5e2srQrKqd7Skhzk-YPaUA==

GET
H2 200 shutterstock_388569319.jpg
cyware.com/smart/unsafe/120x130/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/ 4 KB
5 KB 253ms
246ms Image
image/jpeg 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyware.com/smart/unsafe/120x130/smart/filters:quality(80)/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_388569319.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware /

Resource Hash

85b72d835785786caeae28d952423f715e423e09416c83bd6f92cdb62ed83686

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:36 GMT
x-content-type-options: nosniff
server: Cyware
etag: "d3b4ed0ad02d84c0241f06e85c5e293889ae87ab"
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: image/jpeg
cache-control: max-age=315360000, max-age=86400, no-cache, public
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4567
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 6fed3be.svg
production.cyware.com/social/img/ 7 KB
7 KB 16ms
10ms Image
image/svg+xml 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/6fed3be.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ec6b9513987f66b5903cebdb93bcc616b68f9909f647d3f50b7a6544dcfd9e2f

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 19:05:42 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 61075
etag: "6fed3be0b0fc000ff8c8e5e1220f4687"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 7075
x-amz-cf-id: 5GXPqeGOVYFq4qk6OKHSIAc35MfMNmtMd0jwZXGdB2XYb7pVYqlbhw==

GET
H2 200 1c7498a.svg
production.cyware.com/social/img/ 6 KB
6 KB 15ms
9ms Image
image/svg+xml 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/1c7498a.svg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 194bf057cf24ac499b27acd6017d5eb780c2ec352c826780e90147ff14e997a2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 01:59:46 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:04 GMT
server: AmazonS3
age: 36231
etag: "1c7498ab808c1be2cfa222749a6e4165"
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 5783
x-amz-cf-id: J9669dnI7kk1t0sSIi6r7CnhSrmTytaQUrz-JmADMQWGNAdt7Dqw1Q==

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 72 B
509 B 64ms
25ms Script
text/javascript 2a04:4e42:400::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?features=es6%2CPromise%2CMutationObserver%2CIntersectionObserver%2Ces5%2CObject.entries%2CEventSource

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:400::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 618504
detected-user-agent: Chrome/83.0.4103
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Thu, 28 Jan 2021 02:35:56 GMT
date: Thu, 04 Feb 2021 12:03:36 GMT
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/83.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 7288424.js Show response
js.hs-scripts.com/ 2 KB
742 B 449ms
444ms Script
application/javascript 2606:4700::6811:d2cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/7288424.js
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:d2cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27981ba1fd2fecc9398e24c22e48f49ab69490fa86106be3a85fef280d88ac52

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:36 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
x-trace: 2B5B52BBFBF004821E81CBF91E3DD38DB4F908FF5C000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://cyware.com
access-control-max-age: 3600
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 61c43fd91ae82bf2-FRA
cf-request-id: 080e863bb300002bf257b72000000001
expires: Thu, 04 Feb 2021 12:04:36 GMT

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 520 KB
127 KB 150ms
78ms Script
application/javascript 2606:4700::6811:b849
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b849 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6f31a335ef4afee665755556d8d50cfb3239d80601283c56af47c339f887a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:36 GMT
via: 1.1 738984066968793a5714282f49fe0ab9.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
age: 575
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e863bf800001f45353fd000000001
last-modified: Wed, 03 Feb 2021 03:28:54 UTC
server: cloudflare
etag: W/"2b49c17e03a5c2f522eedf069cfb79a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-version-id: qFuEFzmMzpEnwV6.DIVDel5RqtXWWdE5
access-control-allow-origin: *
cache-control: s-maxage=600, max-age=0
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43fd98e9d1f45-FRA
x-amz-cf-id: A4kne_KkfIFfHvh8kHg18XzI_kNaw2UlT3PG1VoEpD9-H7BdqMY-yQ==

GET
DATA 200
OK truncated
/ 823 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5636027d157543583d21ae2574222e4b4ff16ebf12d5a70d6f074940195fb92

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 639 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325bb368e3fc5a1f6ad31c10e3038e41568383733c767ce3d81d88baba391ff8

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 657 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e530afcd39959ea41c6c4d2fc2c4fd097b0ae5bed210dcaf8bad0cd60d31a5ba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 221ms
0ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cyware.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 22:00:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 50577
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Thu, 03 Feb 2022 22:00:39 GMT

GET
H2 200 647a323.ttf
production.cyware.com/social/fonts/ 12 KB
12 KB 343ms
17ms Font
binary/octet-stream 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/fonts/647a323.ttf
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b8783d5fa087983659871825aaf0c0582509f3fce9174bfbe4d811a6ff04bfb8

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 20:52:20 GMT
via: 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
vary: Origin
age: 54677
x-cache: Hit from cloudfront
content-length: 12212
last-modified: Wed, 20 Jan 2021 09:48:59 GMT
server: AmazonS3
etag: "647a3236a1d84b9c369251168a1ff97f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: dbvdNmgRyaEdkYS6wEzQvJWr4Ao6wZTWYnfbmOtj7FIaKEXNmhq8dQ==

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 222ms
0ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cyware.com
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,600&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 15:38:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 73529
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Thu, 03 Feb 2022 15:38:07 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 2256
date: Thu, 04 Feb 2021 11:26:03 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Thu, 04 Feb 2021 13:26:03 GMT

GET
H2 200 93ca01d.jpg
production.cyware.com/social/img/ 3 KB
4 KB 178ms
0ms Image
image/jpeg 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://production.cyware.com/social/img/93ca01d.jpg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 144f3e783ff9333379de9720b8182e7e1115f51ef29a58059c8be590557b7470

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 05:18:29 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:49:01 GMT
server: AmazonS3
age: 24312
etag: "93ca01db7b98aec53231108d9a42984a"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 3526
x-amz-cf-id: xOoH-WGWwb5oALNZw6GvESuISvewEFqygmUkWLb92A-FppGuSSaeZA==

GET
H2 200 category-slug-map Show response
cyware.com/api-social/ 2 KB
1 KB 365ms
278ms XHR
application/json 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/api-social/category-slug-map

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

3bbc3caa2f3515d496602dc7f4b05045d0d76c573d7ec2ac90af95e8da62fb77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:40 GMT
content-encoding: gzip
etag: W/"97b-oaHxdeUE2UUxkqPjq4nDexjEBV4"
server: Cyware
x-powered-by: Express
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400, no-cache, public
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Origin, Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 event-types Show response
cyware.com/api-social/ 80 B
542 B 265ms
213ms XHR
application/json 52.24.83.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyware.com/api-social/event-types

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.83.42 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-83-42.us-west-2.compute.amazonaws.com

Software

Cyware / Express

Resource Hash

1c29911377afb700041f265d91ae3443493511c92e0b7944ad177684f3971fd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:40 GMT
content-encoding: gzip
etag: W/"50-vFfRg8QlCC/fLcnjbRRDa4klWqM"
server: Cyware
x-powered-by: Express
x-frame-options: allow-from https://lynxgrc.com https://www.incidentresponse.com https://new.cyware.com https://consortiam.net https://securitycurrent.com
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400, no-cache, public
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Origin, Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK 4fc6_shutterstock_1788902369.jpg
cyware-ent.s3.amazonaws.com/image_bank/ 316 KB
316 KB 928ms
190ms Image
image/jpeg 52.218.144.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cyware-ent.s3.amazonaws.com/image_bank/4fc6_shutterstock_1788902369.jpg
Requested by: Host: cyware.com
URL: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.144.62 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c8b3046ca35121b34cdbc63f0cce915d9263103d736bd0ab493bd48f7ffc1fe8

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Thu, 04 Feb 2021 12:03:42 GMT
Last-Modified: Mon, 28 Sep 2020 15:32:50 GMT
Server: AmazonS3
x-amz-request-id: 4836927AF9DCCEF7
ETag: "5b6903b14b7498ea67016163d4daac14"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 323594
x-amz-id-2: Ptw+XvccOzpVaaIbmb7bVKZOSVO6jxuEp0bn3m3W8v5nrOwauPgD9UijR2RkJwgOBkZ+uVXFCJw=

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
64 B 87ms
56ms XHR
text/plain 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1029034690&t=pageview&_s=1&dl=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&dp=%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&ul=en-us&de=UTF-8&dt=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABEAAAAC~&jid=749454378&gjid=1548108443&cid=1477872857.1612440221&tid=UA-74369186-1&_gid=70000703.1612440221&_r=1&_slc=1&z=1521239732

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 5 KB
2 KB 223ms
0ms Script
application/javascript 2606:4700::6811:74b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:74b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3399b34b280df0bae72875db0c8920320cc6b8ce3e64413541fdcb7fd53a2a8f

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:41 GMT
via: 1.1 98e30e5953336545df428a8f5923a289.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 179
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.222/bundles/pixels-release.js&cfRay=61c43b97f91c4aaf-FRA
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
cf-request-id: 080e864f7100002c52e9ace000000001
last-modified: Fri, 29 Jan 2021 04:30:45 UTC
server: cloudflare
etag: W/"c8d54dcba2e9466890079ae550d834bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: tMGfNCDI8YaArCWxgAwYbahB1RP10YKq
cache-control: max-age=600
x-hs-cache-status: EXPIRED
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43ff8b8132c52-FRA
x-amz-cf-id: n9Ry2z3Xh4PegjG3PC36EJxchfeXe4K2IpJAQVfICUgusiYeeovrHg==

GET
H2 200 7288424.js Show response
js.hs-analytics.net/analytics/1612440000000/ 61 KB
18 KB 218ms
0ms Script
text/javascript 2606:4700::6811:44b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1612440000000/7288424.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:44b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e4de3133efb8cfc29593809c401f7ad7b5b29533401837bbf8817b12e5c172

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:41 GMT
content-encoding: br
cf-cache-status: HIT
age: 175
x-amz-server-side-encryption: AES256
x-amz-request-id: 85B6615DD2620BA7
x-amz-id-2: XHZhnSL+MtIG/ZIbJ2zGS1rU45oWsQpUAvbmjI+hPYJ0A9lxXsxW6Zfkl5Fgx1QcKIJFTxWUY/M=
last-modified: Tue, 02 Feb 2021 23:49:14 GMT
server: cloudflare
etag: W/"206bd4c254149078c6839c807b2f8c94"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-request-id: 080e864f6e00001f2d6fb1e000000001
cf-ray: 61c43ff8aeef1f2d-FRA
expires: Thu, 04 Feb 2021 12:05:46 GMT

GET
H2 200 7288424.js Show response
js.hs-banner.com/ 54 KB
13 KB 209ms
0ms Script
text/javascript 2606:4700::6812:14bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/7288424.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaf2fcedc750e57874345df198b57bf5b61a85282630cf4d0270003097693be3

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash: crc32c=6ZzsEQ==, md5=S+40otmoasXCSU0y/3HUTw==
date: Thu, 04 Feb 2021 12:03:41 GMT
content-encoding: br
cf-cache-status: HIT
age: 175
x-guploader-uploadid: ABg5-UytGWGU7Asu21eC7aR_eht-rsHZB_YLE9_vg7UY2ps3XPogjh1X5GsJCSKvr0FtQ-wL6-i-Jng4Yv8ikfg_06w
x-goog-storage-class: STANDARD
access-control-max-age: 604800
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript; charset=UTF-8
cf-request-id: 080e864f7e00002bcaabaf0000000001
timing-allow-origin: *
last-modified: Tue, 05 Jan 2021 19:44:03 GMT
server: cloudflare
etag: W/"4bee34a2d9a86ac5c2494d32ff71d44f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-goog-generation: 1609875843800176
access-control-allow-origin: https://cyware.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
x-goog-stored-content-length: 55617
cf-ray: 61c43ff8cc442bca-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Thu, 04 Feb 2021 12:05:46 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 78 KB
23 KB 218ms
0ms Script
application/javascript 2606:4700::6811:82ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7288424.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:82ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a12ac37a39b2818801153898a9e716122189a054cb0cc0a98131ead6b57751d9

Request headers

Origin: https://cyware.com
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:41 GMT
via: 1.1 0712e4ad4264127dfcb76a114b130495.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 80482
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.224/bundles/project.js&cfRay=61bc9314bd5a2c2e-IAD
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
x-amz-replication-status: COMPLETED
content-encoding: br
cf-request-id: 080e864f7f000096bc388fd000000001
last-modified: Tue, 02 Feb 2021 01:41:22 UTC
server: cloudflare
etag: W/"4175c61bef30fbed4a4fea09f2f20c4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: YxTlDDuGm95GnTHKn2AaGJe9LDW9YpHd
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: HIT
x-amz-cf-pop: IAD89-C3
cf-ray: 61c43ff8cd7796bc-FRA
x-amz-cf-id: 0YgvmAhUGyNfvH_iajngk4cOv0uxVKD87EVRE6cNcONvLMHXDtNzvg==

POST
H3-Q050 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
65 B 122ms
103ms XHR
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-74369186-1&cid=1477872857.1612440221&jid=749454378&gjid=1548108443&_gid=70000703.1612440221&_u=aEBAAEAAEAAAAC~&z=1721240876

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 04 Feb 2021 12:03:41 GMT
content-type: text/plain
access-control-allow-origin: https://cyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 18ms
18ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-74369186-1&cid=1477872857.1612440221&jid=749454378&_u=aEBAAEAAEAAAAC~&z=400714842

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 18ms
18ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-74369186-1&cid=1477872857.1612440221&jid=749454378&_u=aEBAAEAAEAAAAC~&z=400714842

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
forms.hubspot.com/collected-forms/v1/config/ 115 B
536 B 114ms
113ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/collected-forms/v1/config/json?portalId=7288424&utk=

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ea17086828c522aa1ef196dec0bd559e97fd7806af1a26639d71b843e11885a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:42 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e8651fc0000d6d5743ec000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fB9YpuNJbNL8TN%2FHyAGNee11%2BCGAdNf2%2BAL3sJgnaflzySPVeIZGRSaHdhpC8VF6PATnNbMewwSnpc5MQYdMNCgBNDh8U5%2BS%2BJHRn61TE4iAyemgGQeol4DNM3TFig%3D%3D"}],"max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://cyware.com
access-control-allow-credentials: false
cf-ray: 61c43ffccbe1d6d5-FRA
access-control-allow-headers: *

GET
H2 200 4f96684999e450d0bab7.js Show response
production.cyware.com/social/ 21 KB
21 KB 32ms
31ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/4f96684999e450d0bab7.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dab3dc392b427fa80a47eb075f9c3d5c5485f203cdd68e0bf06b9185bffbc14d

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 06:39:33 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 19450
etag: "970f4da6d022de65dc2dfeed327ceae3"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 21620
x-amz-cf-id: 42QsY67He6K_1EhZDs7omOCU7WcmNgXlW9goDLOPujHD9zsDicE9qw==

GET
H2 200 d5ecacc692abc5131009.js Show response
production.cyware.com/social/ 16 KB
16 KB 32ms
31ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/d5ecacc692abc5131009.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8336f858ea70793d6472fc6b485f6c3860422eeb72d68fc8700c5d9ecd9c9623

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 20:59:17 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:58 GMT
server: AmazonS3
age: 54266
etag: "5abd538c146b6785888ce11383060509"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 15928
x-amz-cf-id: 0VYg4neN4Zxi9E90ELGJHYg8HNPp7tTAlnhuftht3dC_lQC7ppyxlw==

GET
H2 200 81fe404f670a24fa71fa.js Show response
production.cyware.com/social/ 5 KB
5 KB 32ms
31ms Script
application/javascript 2600:9000:20eb:8000:1:d92a:12c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://production.cyware.com/social/81fe404f670a24fa71fa.js
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/a9e3035c06ced5018150.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:8000:1:d92a:12c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c5181ce795e6e315c32deb6862f1ae2ebbd7099a5a698ee66a1ccd731242e606

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 20:59:17 GMT
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jan 2021 09:48:57 GMT
server: AmazonS3
age: 54266
etag: "3a7d6402de48a6998c4948c8eb82b9a7"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 5056
x-amz-cf-id: sZ3RexE8yDVdg22gCfKyYjhVPPY8bQ-OdGeS-fWnvXtSkToWH_Cdiw==

GET
H2 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
298 B 151ms
139ms Image
image/gif 2606:4700::6810:5605
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5605 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-trace: 2B0A428A3CBA290B8C27C97DC2579860CC6CA82AA1000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 61c440007bb3dfb7-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35
cf-request-id: 080e86544e0000dfb7830bf000000001

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
469 B 34ms
34ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=7288424&pu=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&t=New+Trickbot+Malware+Component+Performs+Local+Network+Reconnaissance+%7C+Cyware+Alerts+-+Hacker+News&cts=1612440222933&vi=112a0d41768e7c78137ebdfeebb36256&nc=true&ce=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:42 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"max_age":604800,"report_to":"cf-nel"}
cf-ray: 61c440016ccc061c-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
cf-request-id: 080e8654e30000061c803d6000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jIEMOrw8F%2BpjBnem%2FNGyUwg5%2B87t1uvyZAuLvyA3ULavJMUi%2BDgBEpp6CcQmLJnSq%2BxwI8mZZzDVJpHhGanS%2F2lV4r4VndvfOxTnXs7YjTxNLAp96CmQPBoegJZgGw%3D%3D"}]}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixel/ 132 B
569 B 130ms
129ms XHR
application/json 2606:4700::6811:c9cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=7288424

Requested by

Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42244f0e5c3f64fe7873c0d0788d1e7dd358069c913224b23dc07aaccacbc418

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:43 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"max_age":604800,"report_to":"cf-nel"}
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 080e8654dd00004a5c61bad000000001
server: cloudflare
x-trace: 2B54111EF399D813747E50DF6F82AC6BF0B8BEF736000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SQ8R08Q2oPJBw9QQ%2FQ3Xq1s2e3WnaScIKamj0CkIVRpjyb8vrlqHsO5rwBxVtBt4NVOWfrDReu%2BhJmzuRNvXo0ZXe4QFx37%2FDZD4FmbrJayjrr56o6TEPH6cNA%3D%3D"}]}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://cyware.com
access-control-allow-credentials: false
cf-ray: 61c440016f194a5c-FRA
access-control-allow-headers: *

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Feb 2021 12:03:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=79600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
38 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-712433333

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

79d696c6b60b71daa96719682f4cf1c2b74c81d499c88c9bed11fb2f15578656

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:43 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39020
x-xss-protection: 0
expires: Thu, 04 Feb 2021 12:03:43 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2232740%26time%3D1612440223294%26url%3Dhttps%253A%252F%252Fcyware.com%252Fnews%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_...

0
63 B

194ms
191ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:44 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: WawlP9eJYBYQnRhbnisAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
content-length: 0
x-li-uuid: lIWBNteJYBawgGzTryoAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: C91E2DD8B36E4590AFD09AFC791066BD Ref B: FRAEDGE1415 Ref C: 2021-02-04T12:03:43Z
x-frame-options: sameorigin
date: Thu, 04 Feb 2021 12:03:43 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=31536000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2232740&time=1612440223294&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
12 KB 58ms
52ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-712433333

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

c4eb51f22f568120cf9ab08fbeae1a5369ec10fd7dba0ceba07038b07a9a9975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 12:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 12189
x-xss-protection: 0
server: cafe
etag: 7685221537260973389
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 04 Feb 2021 12:03:43 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/712433333/ 3 KB
1 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/712433333/?random=1612440223490&cv=9&fst=1612440223490&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b886f030aabc11d6b7c236ed306057623878adef5792f1c0290cdc564bdfc453

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1253
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/712433333/ 42 B
108 B 31ms
25ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/712433333/?random=1612440223490&cv=9&fst=1612440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&async=1&fmt=3&is_vtc=1&random=2424045080&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/712433333/ 42 B
108 B 28ms
23ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/712433333/?random=1612440223490&cv=9&fst=1612440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1r0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcyware.com%2Fnews%2Fnew-trickbot-malware-component-performs-local-network-reconnaissance-153685fa%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU&tiba=New%20Trickbot%20Malware%20Component%20Performs%20Local%20Network%20Reconnaissance%20%7C%20Cyware%20Alerts%20-%20Hacker%20News&async=1&fmt=3&is_vtc=1&random=2424045080&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cyware.com/news/new-trickbot-malware-component-performs-local-network-reconnaissance-153685fa?_hsmi=88974744&_hsenc=p2ANqtz--TDC4hMUpoPTBZNIsrfnIWNCDLc0-ELXDVTcz5MSv_6pDXwu8BQETuslXPJLqVHdQf5u8vu-tiUCJRo_2Wv7zEi3yCR0xGzVCfO0zTWQLIBEMpfTU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 Feb 2021 12:03:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
debugger.cyware.io/api/14/store/ 41 B
242 B 393ms
122ms Fetch
application/json 3.12.28.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://debugger.cyware.io/api/14/store/?sentry_key=9c07e881c5374efaaa34073581390682&sentry_version=7
Requested by: Host: production.cyware.com
URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.12.28.145 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-12-28-145.us-east-2.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 62d926ed6b45aa3f61e67871ba0b2af045c577119ac4e5dcf9a476cd7a52e475

Request headers

Referer: https://cyware.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://cyware.com
date: Thu, 04 Feb 2021 12:03:53 GMT
server: nginx/1.14.0 (Ubuntu)
content-type: application/json
content-length: 41
vary: Origin
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cyware.com/	1970-01-19 15:54:02	Name: __hssc Value: 86885063.1.1612440222918
.cyware.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cyware.com/	1970-01-20 01:15:36	Name: hubspotutk Value: 112a0d41768e7c78137ebdfeebb36256
.cyware.com/	1970-01-20 01:15:36	Name: __hstc Value: 86885063.112a0d41768e7c78137ebdfeebb36256.1612440222918.1612440222918.1612440222918.1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://info.silobreaker.com/e2t/tc/VVVXY01dQ_1-W83hv_53HCFJzVcSh174mFlK-N8hWs4_2-HwrV1-WJV7CgY8DVQ-q7D42n_N9W1kZBms1pRmW4W30KNZJ7-lvsZMDV25j6kh1nW2X6xrM5rnVj2W3tvXJY4GHyvzW4pq4_26ZQN69VgrQ-B4fNfK6W46g-XN7hp3cKW1YdPnq8LzMy4W5WrTVN49Pb3sN1h0NGFm7jgjW6yHzMZ27Vx4mW3ThLfp3L-92KW2K2mH79bxcYqVnnrq28-2gN9W11p7Fr1zC8HMW85lzfl8DRHP_W8W7tWm8GbXSXN7Hc_0cNDP7vW16lYyD6jKDcKN23qywK_Vx9WW7WG0Nr6JkVlkN4v1r64KrrD_W98MNn37qBZqhW7nzq-D1-s_7735pw1(Line 13) Message: toS
console-api	log	URL: https://production.cyware.com/social/ab3c3fdc11d8a5319fde.js(Line 2) Message: default

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
cyware-ent.s3.amazonaws.com
cyware.com
debugger.cyware.io
fonts.googleapis.com
fonts.gstatic.com
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
info.silobreaker.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
polyfill.io
production.cyware.com
px.ads.linkedin.com
snap.licdn.com
stats.g.doubleclick.net
track.hubspot.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
172.217.22.2
199.60.103.2
2600:9000:20eb:8000:1:d92a:12c0:93a1
2606:4700::6810:5605
2606:4700::6811:44b0
2606:4700::6811:74b0
2606:4700::6811:82ab
2606:4700::6811:b849
2606:4700::6811:c9cc
2606:4700::6811:d2cc
2606:4700::6812:14bf
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:810::2003
2a00:1450:4001:821::200e
2a00:1450:4001:828::2008
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::200a
2a00:1450:400c:c00::9c
2a02:26f0:10c:58e::25ea
2a04:4e42:400::621
2a05:f500:11:101::b93f:9005
3.12.28.145
52.218.144.62
52.24.83.42
0ea17086828c522aa1ef196dec0bd559e97fd7806af1a26639d71b843e11885a
144f3e783ff9333379de9720b8182e7e1115f51ef29a58059c8be590557b7470
194bf057cf24ac499b27acd6017d5eb780c2ec352c826780e90147ff14e997a2
1a6f5b70c11a59bd2b27a534812185b21e5c2c4a4367a69bf7069ebee21fdd07
1c29911377afb700041f265d91ae3443493511c92e0b7944ad177684f3971fd3
27981ba1fd2fecc9398e24c22e48f49ab69490fa86106be3a85fef280d88ac52
325bb368e3fc5a1f6ad31c10e3038e41568383733c767ce3d81d88baba391ff8
3399b34b280df0bae72875db0c8920320cc6b8ce3e64413541fdcb7fd53a2a8f
3bbc3caa2f3515d496602dc7f4b05045d0d76c573d7ec2ac90af95e8da62fb77
3d2e8b49e8529d1acbd9834ac3ea1993ef3d37323bacac1acf2823cfa3939916
42244f0e5c3f64fe7873c0d0788d1e7dd358069c913224b23dc07aaccacbc418
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
62d926ed6b45aa3f61e67871ba0b2af045c577119ac4e5dcf9a476cd7a52e475
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
74d8bcba84408837591b6a12b342594272aad99a02eafe4a0280e6f8a444dea2
79d696c6b60b71daa96719682f4cf1c2b74c81d499c88c9bed11fb2f15578656
82efa3a52ca2051d452e2c6b30a6574889b4ddf2e59345f223e5c2966f3a1816
8336f858ea70793d6472fc6b485f6c3860422eeb72d68fc8700c5d9ecd9c9623
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85b72d835785786caeae28d952423f715e423e09416c83bd6f92cdb62ed83686
85e4de3133efb8cfc29593809c401f7ad7b5b29533401837bbf8817b12e5c172
a12ac37a39b2818801153898a9e716122189a054cb0cc0a98131ead6b57751d9
a6f31a335ef4afee665755556d8d50cfb3239d80601283c56af47c339f887a7d
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b8783d5fa087983659871825aaf0c0582509f3fce9174bfbe4d811a6ff04bfb8
b886f030aabc11d6b7c236ed306057623878adef5792f1c0290cdc564bdfc453
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c4eb51f22f568120cf9ab08fbeae1a5369ec10fd7dba0ceba07038b07a9a9975
c5181ce795e6e315c32deb6862f1ae2ebbd7099a5a698ee66a1ccd731242e606
c5636027d157543583d21ae2574222e4b4ff16ebf12d5a70d6f074940195fb92
c8b3046ca35121b34cdbc63f0cce915d9263103d736bd0ab493bd48f7ffc1fe8
c9135488238506768788d901ac1ce80816f79dc21ea16e2fbf392b833959ac66
d16896edf8050f6a0cd7a7b9359ca7522be23382eac47ada9aa693c88cc519d1
d6aa44d7515541e116c9a091bb0b5a70e4f81728126347261635b5cda6aec1e4
dab3dc392b427fa80a47eb075f9c3d5c5485f203cdd68e0bf06b9185bffbc14d
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e530afcd39959ea41c6c4d2fc2c4fd097b0ae5bed210dcaf8bad0cd60d31a5ba
eaf2fcedc750e57874345df198b57bf5b61a85282630cf4d0270003097693be3
ec6b9513987f66b5903cebdb93bcc616b68f9909f647d3f50b7a6544dcfd9e2f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f30acdaa946790462d6bd75c16d7b1559b24c57317e9bf78a1646bdb2d647ef3

cyware.com Open in urlscan Pro 52.24.83.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

46 Requests

100 %HTTPS

81 %IPv6

24 Domains

28 Subdomains

27 IPs

6 Countries

2563 kBTransfer

3453 kBSize

4 Cookies

11 Outgoing links

Page URL History

Redirected requests

46 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cyware.com Open in urlscan Pro
52.24.83.42 Public Scan

Screenshot
Live screenshot

Full Image

46
Requests

100 %
HTTPS

81 %
IPv6

24
Domains

28
Subdomains

27
IPs

6
Countries

2563 kB
Transfer

3453 kB
Size

4
Cookies

46 HTTP transactions
3 data transactions