www.webroot.com Open in urlscan Pro
159.255.219.5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Submission: On November 16 via api (November 16th 2022, 10:13:14 pm UTC) from US — Scanned from NL

Summary HTTP 66 Redirects Links 55 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 10 domains to perform 66 HTTP transactions. The main IP is 159.255.219.5, located in Netherlands and belongs to EQUINIX, GB. The main domain is www.webroot.com. The Cisco Umbrella rank of the primary domain is 220226.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on May 4th 2022. Valid for: a year.

This is the only time www.webroot.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 39	159.255.219.5 159.255.219.5	15830 (EQUINIX) (EQUINIX)
1	2600:9000:214... 2600:9000:214f:9e00:2:c605:29c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:e2:... 2606:4700:e2::ac40:840f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
3	52.222.214.110 52.222.214.110	16509 (AMAZON-02) (AMAZON-02)
7	18.64.119.63 18.64.119.63	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:62:... 2a04:4e42:62::159	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1b55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
66	13

39 159.255.219.5 (Netherlands) 1 redirects

ASN15830 (EQUINIX, GB)

www.webroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:9e00:2:c605:29c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

embed.typeform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e2::ac40:840f (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.214.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-110.fra56.r.cloudfront.net

www-cdn.webroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.64.119.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-119-63.txl50.r.cloudfront.net

blog-en.webroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:62::159 (United States)

ASN54113 (FASTLY, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1b55 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
49	webroot.com 1 redirects www.webroot.com — Cisco Umbrella Rank: 220226 www-cdn.webroot.com — Cisco Umbrella Rank: 590680 blog-en.webroot.com	2 MB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 410	175 KB
2	twimg.com pbs.twimg.com — Cisco Umbrella Rank: 710	4 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 690	322 B
1	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 1662
1	gstatic.com fonts.gstatic.com	38 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 53	119 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 43	1 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 867	240 KB
1	typeform.com embed.typeform.com — Cisco Umbrella Rank: 26737	11 KB
66	10

	Domain	Requested by
39	www.webroot.com	1 redirects www.webroot.com
9	cdn.cookielaw.org	www.googletagmanager.com cdn.cookielaw.org
7	blog-en.webroot.com	www.webroot.com
3	www-cdn.webroot.com	www.webroot.com
2	pbs.twimg.com	www.webroot.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	script.crazyegg.com	www.webroot.com
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googletagmanager.com	www.webroot.com
1	fonts.googleapis.com	www.webroot.com
1	use.fontawesome.com	www.webroot.com
1	embed.typeform.com	www.webroot.com
66	12

This site contains links to these domains. Also see Links.

Domain
my.webrootanywhere.com
community.webroot.com
partner.webroot.com
www.brightcloud.com
brightcloud.com
careers.opentext.com
www.youtube.com
www.facebook.com
www.linkedin.com
twitter.com
devcentral.f5.com
www.flashpoint-intel.com
github.com
wbrt.io
onlinexperiences.com
www.elegantthemes.com
www.wordpress.org
www.opentext.com
www.onetrust.com
docs.webroot.com
www.instagram.com

Subject Issuer	Validity	Valid
*.webroot.com Sectigo RSA Organization Validation Secure Server CA	`2022-05-04` - `2023-06-04`	a year	crt.sh
*.typeform.com Amazon	`2022-09-30` - `2023-10-29`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-06` - `2023-06-05`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
www-cdn.webroot.com Amazon	`2021-12-26` - `2023-01-23`	a year	crt.sh
blog-en.webroot.com Amazon	`2022-09-01` - `2023-09-29`	a year	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-10-25` - `2023-01-17`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Frame ID: 392DF60598477D84C41D8E3CAD59CC15
Requests: 67 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TrickBot Banking Trojan Adapts with New Module | WebrootBack ButtonSearch IconFilter IconView our Facebook pageView our LinkedIn pageFollow us on TwitterFollow us on InstagramSubscribe to our YouTube channel

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

66
Requests

98 %
HTTPS

75 %
IPv6

10
Domains

12
Subdomains

13
IPs

3
Countries

2429 kB
Transfer

5423 kB
Size

30
Cookies

55 Outgoing links

These are links going to different origins than the main page.

URL: https://my.webrootanywhere.com/default.asp
Title: Business Accounts

Search URL Search Domain Scan URL

URL: https://community.webroot.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://partner.webroot.com/
Title: Partner Toolkit Login

Search URL Search Domain Scan URL

URL: https://www.brightcloud.com/
Title: Threat Intelligence

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/
Title: Threat Intelligence Services Overview

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/cloud-service-intelligence
Title: Cloud Service Intelligence

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/web-classification-and-reputation
Title: Web Classification and Reputation

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/ip-reputation
Title: IP Reputation

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/real-time-anti-phishing
Title: Real-Time Anti-Phishing

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/streaming-malware-detection
Title: Streaming Malware Detection

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/file-reputation
Title: File Reputation

Search URL Search Domain Scan URL

URL: https://brightcloud.com/threat-intelligence-services/mobile-security-sdk
Title: Mobile Security SDK

Search URL Search Domain Scan URL

URL: https://www.brightcloud.com/tools/url-ip-lookup.php
Title: URL/IP Lookup

Search URL Search Domain Scan URL

URL: https://www.brightcloud.com/tools/change-request.php
Title: URL/IP Change Request

Search URL Search Domain Scan URL

URL: https://www.brightcloud.com/contact
Title: Contact Sales / Support

Search URL Search Domain Scan URL

URL: https://careers.opentext.com/
Title: Job Openings

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=w7yAVHoRrAs

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.webroot.com%2Fblog%2F2018%2F03%2F21%2Ftrickbot-banking-trojan-adapts-new-module%2F&t=TrickBot%20Banking%20Trojan%20Adapts%20with%20New%20Module
Title: facebook 0

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.webroot.com%2Fblog%2F2018%2F03%2F21%2Ftrickbot-banking-trojan-adapts-new-module%2F&title=TrickBot%20Banking%20Trojan%20Adapts%20with%20New%20Module
Title: linkedin 1

Search URL Search Domain Scan URL

URL: http://twitter.com/share?text=TrickBot%20Banking%20Trojan%20Adapts%20with%20New%20Module&url=https%3A%2F%2Fwww.webroot.com%2Fblog%2F2018%2F03%2F21%2Ftrickbot-banking-trojan-adapts-new-module%2F&via=Webroot
Title: twitter 0

Search URL Search Domain Scan URL

URL: https://devcentral.f5.com/articles/is-xmaker-the-new-trickloader-24372)
Title: mailsearcher module

Search URL Search Domain Scan URL

URL: https://www.flashpoint-intel.com/blog/new-version-trickbot-adds-worm-propagation-module/
Title: worm module

Search URL Search Domain Scan URL

URL: https://github.com/dismantl/ImprovedReflectiveDLLInjection/blob/master/inject/src/LoadLibraryR.c
Title: ImprovedReflectiveDLLInjection

Search URL Search Domain Scan URL

URL: https://twitter.com/J_Hackz

Search URL Search Domain Scan URL

URL: https://twitter.com/Webroot
Title: WebrootFollowWebroot, an @OpenText company, supports businesses and home users with cloud-based data security for #CyberResilience.

Search URL Search Domain Scan URL

URL: https://twitter.com/Webroot/status/1592544502698639361
Title: 15 Nov

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/WiFiSecurity
Title: #WiFiSecurity

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/VPN
Title: #VPN

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/dataprivacy
Title: #dataprivacy

Search URL Search Domain Scan URL

URL: https://wbrt.io/3cgieHi
Title: https://wbrt.io/3cgieHi

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?in_reply_to=1592544502698639361&related=Webroot
Title: Reply on Twitter 1592544502698639361

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/retweet?tweet_id=1592544502698639361&related=Webroot
Title: Retweet on Twitter 15925445026986393611

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/like?tweet_id=1592544502698639361&related=Webroot
Title: Like on Twitter 15925445026986393612

Search URL Search Domain Scan URL

URL: https://twitter.com/Spiceworks

Search URL Search Domain Scan URL

URL: https://twitter.com/Spiceworks/status/1592170126824337408
Title: 14 Nov

Search URL Search Domain Scan URL

URL: https://twitter.com/Carbonite
Title: @Carbonite

Search URL Search Domain Scan URL

URL: https://twitter.com/webroot
Title: @webroot

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/malware
Title: #malware

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/malwareattack
Title: #malwareattack

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/malwaredefence
Title: #malwaredefence

Search URL Search Domain Scan URL

URL: https://onlinexperiences.com/Launch/QReg/ShowUUID=6C4319A6-0CAB-4028-B2FC-47F59192BE93&LangLocaleID=1033&AffiliateData=swzd_twitterpost
Title: https://onlinexperiences.com/Launch/QReg/ShowUUID=6C4319A6-0...

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?in_reply_to=1592170126824337408&related=Spiceworks
Title: Reply on Twitter 1592170126824337408

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/retweet?tweet_id=1592170126824337408&related=Spiceworks
Title: Retweet on Twitter 15921701268243374083

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/like?tweet_id=1592170126824337408&related=Spiceworks
Title: Like on Twitter 15921701268243374086

Search URL Search Domain Scan URL

URL: http://www.elegantthemes.com/
Title: Elegant Themes

Search URL Search Domain Scan URL

URL: http://www.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

URL: https://www.opentext.com/about/cookie-policy
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

URL: https://community.webroot.com/t5/Business/ct-p/ent0
Title: Community

Search URL Search Domain Scan URL

URL: https://docs.webroot.com/us/en
Title: User Guides

Search URL Search Domain Scan URL

URL: https://www.opentext.com/about/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Webroot
Title: View our Facebook page

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/7434
Title: View our LinkedIn page

Search URL Search Domain Scan URL

URL: https://www.instagram.com/webroot/
Title: Follow us on Instagram

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/WebrootSoftware?sub_confirmation=1
Title: Subscribe to our YouTube channel

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65

https://www.webroot.com/download_file/4685 HTTP 302
https://www-cdn.webroot.com/8416/4909/6290/Webroot-logo-global-icon-color-inverted.svg

66 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/ 76 KB
17 KB 1719ms
1413ms Document
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

96332da8932c72d133812013c6e2445b94fb14d4d8c4a79306a37907313d96c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Cache-Control: private, max-age=0, proxy-revalidate, no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: br
Content-Length: 16173
Content-Type: text/html; charset=UTF-8
Date: Wed, 16 Nov 2022 22:13:04 GMT
Expires: Fri, 20 May 2022 18:06:38 GMT
Keep-Alive: timeout=5, max=250
Link: <http://wordpressblog.webroot.com/wp-json/>; rel="https://api.w.org/" <http://wordpressblog.webroot.com/wp-json/wp/v2/posts/24078>; rel="alternate"; type="application/json" <http://wordpressblog.webroot.com/?p=24078>; rel=shortlink
Pragma: no-cache
RTSS: 1-2-159
Server: Apache
Vary: Accept-Encoding
X-Client-IP: 31.204.152.216
X-Content-Type-Options: nosniff
X-Duration: D=763265
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.min.css
www.webroot.com/blog/wp-includes/css/dist/block-library/ 79 KB
11 KB 550ms
533ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "13abe-5d5e57c3164bd-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=5748
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK ctf-styles.min.css
www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/css/ 15 KB
3 KB 562ms
511ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/css/ctf-styles.min.css?ver=1.8.4

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

6a360fb959551957e70a7cd4da97893c04b98d9a8378fc548aee38adac30ac97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-160
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:31:45 GMT
Server: Apache
ETag: "3a6f-5d3d2c62d3e40-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=5126
Keep-Alive: timeout=5, max=250
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK slick.css
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/ 2 KB
1 KB 583ms
531ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/slick.css?ver=20170502

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d917660c3d6f7aad32ebc4b0012c6d0bb84a13e201a012e334bcca4b9f4686c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-98
Content-Length: 557
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 26 Oct 2017 07:56:52 GMT
Server: Apache
ETag: "6c1-55c6e83dcd900-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=5417
Keep-Alive: timeout=5, max=250
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK font-awesome.min.css
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/ 30 KB
8 KB 584ms
532ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/font-awesome.min.css?ver=20170502

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-94
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 26 Oct 2017 07:56:52 GMT
Server: Apache
ETag: "7918-55c6e83dcd900-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=250
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK style.css
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/ 8 KB
2 KB 572ms
519ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css/style.css?ver=20170502

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

6a601e465ad7d2f84b43aaafa7f3bc75c4454b26d6c5bd74b0bd12b6698ea6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 1504
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 26 Oct 2017 07:56:52 GMT
Server: Apache
ETag: "20f8-55c6e83dcd900-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=250
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK pagenavi-css.css
www.webroot.com/blog/wp-content/plugins/wp-pagenavi/ 374 B
1016 B 563ms
509ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:05 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-84
Content-Length: 239
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:32:07 GMT
Server: Apache
ETag: "176-5d3d2c77cefc0-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=250
Expires: Sat, 19 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK style.css
www.webroot.com/blog/wp-content/plugins/monarch/css/ 113 KB
13 KB 1081ms
531ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.4.14

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:32:00 GMT
Server: Apache
ETag: "1c56d-5d3d2c7122000-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=5930
Keep-Alive: timeout=5, max=248
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK style.css
www.webroot.com/blog/wp-content/themes/Divi/ 453 KB
56 KB 1096ms
534ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/themes/Divi/style.css?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

5fa1ba6c3cabb6402b9b8df1930a6f90950bf6b90f09b31b80acfaf4d9f138aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-160
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 24 Jun 2020 20:30:17 GMT
Server: Apache
ETag: "715fb-5a8da5818f367-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=4999
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK webroot.libraries.min.css
www.webroot.com/application/css/libraries/ 273 KB
44 KB 1077ms
513ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/application/css/libraries/webroot.libraries.min.css?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

5106a1bf65945ce87340006a1ac052b277bcbd933678683c58cbf98ece2f0989

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-84
Content-Length: 43899
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 12 Oct 2022 21:26:50 GMT
Server: Apache
ETag: "443fb-5eadd0cff35f3-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK style.css
www.webroot.com/blog/wp-content/themes/Divi-Child/ 18 KB
5 KB 1107ms
535ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/themes/Divi-Child/style.css?ver=3.7

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

30abf0df9c871c063eca357bae588ea9975ed5354fbb22cb44868a0675b65117

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 4547
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 24 Jun 2020 20:30:17 GMT
Server: Apache
ETag: "47e9-5a8da5818e7af-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK dashicons.min.css
www.webroot.com/blog/wp-includes/css/ 58 KB
36 KB 1122ms
538ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/css/dashicons.min.css?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-98
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "e688-5d5e57c3183fd-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
X-Duration: D=5031
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK jquery.min.js Show response
www.webroot.com/blog/wp-includes/js/jquery/ 87 KB
31 KB 1627ms
524ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "15db1-5d5e57c33a2f5-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=5183
Keep-Alive: timeout=5, max=247
Expires: Fri, 16 Dec 2022 22:13:06 GMT

GET
H/1.1 200
OK jquery-migrate.min.js Show response
www.webroot.com/blog/wp-includes/js/jquery/ 11 KB
5 KB 1636ms
528ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 4169
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "2bd8-5d5e57c339f0d-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=248
Expires: Fri, 16 Dec 2022 22:13:06 GMT

GET
H/1.1 200
OK custom.js Show response
www.webroot.com/blog/wp-content/themes/Divi-Child/js/ 278 B
1017 B 1641ms
526ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/themes/Divi-Child/js/custom.js?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

ee9812a8e5a77479bd85ac07993b6b221fbe17c670eac77b8bee49ee7c5acfb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-94
Content-Length: 225
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 11 Mar 2020 15:18:27 GMT
Server: Apache
ETag: "116-5a095bf8f1142-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=248
Expires: Fri, 16 Dec 2022 22:13:06 GMT

GET
H2 200 embed.js Show response
embed.typeform.com/next/ 42 KB
11 KB 158ms
36ms Script
application/x-javascript 2600:9000:214f:9e00:2:c605:29c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.typeform.com/next/embed.js
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:9e00:2:c605:29c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0f3177a35320166dbe9145941c74c6a35b6c906540d05f35260400734f84f894

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-amz-version-id: v_wThpYab1ChQZShD3KotVEYaDsjToPl
content-encoding: gzip
via: 1.1 511c8b6c7e903efca023a504d527516a.cloudfront.net (CloudFront)
date: Wed, 16 Nov 2022 22:12:05 GMT
last-modified: Mon, 14 Nov 2022 15:20:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 71
etag: W/"79e92b1e82ca7b73b99f2f199db4fb29"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: dlIIRQjjgxOe7yNLTDa-WlEN_LQVIBj12DSD6iPzD4SGr3Dcpw3WQQ==

GET
H/1.1 200
OK modules.ttf
www.webroot.com/blog/wp-content/plugins/monarch/core/admin/fonts/ 90 KB
37 KB 1703ms
513ms Font
application/font-sfnt 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/core/admin/fonts/modules.ttf

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: br
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-84
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:31:59 GMT
Server: Apache
ETag: "168f0-5d3d2c702ddc0"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/font-sfnt
Cache-Control: max-age=172800
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=248
Expires: Fri, 18 Nov 2022 22:13:07 GMT

GET
H2 200 all.js Show response
use.fontawesome.com/releases/v5.0.7/js/ 665 KB
240 KB 113ms
52ms Script
application/javascript 2606:4700:e2::ac40:840f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.7/js/all.js
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:840f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea838cefb95ad4291003ceeb9f1172739820daaeadf3c378f3353401e2cf4d67

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: CY60R1NA1PGHNQ0Y
age: 548196
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: L0vUfOS4t4a2O2yDRVtF2Cms4tOwYlWxFOZAYTy/Yz0pV5TJLo/9n0FysfyN1iR5JVv5uVeTjFk=
last-modified: Wed, 30 Jun 2021 15:27:50 GMT
server: cloudflare
etag: W/"2c0e527f3bfa32990e908bafceab0436"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FyQWTxj%2BmBxM%2FK1ajDGAmsED3a2O5BSE96wLzGZ4Mh5xO5qbCg9%2FArlHi%2BiVqBm2lJ6U9%2BkHPNOCvSMQaKLHzzEDbJbNhZzD0Rt9s37y7FzEg3rVr0VhJ2r0ap7AG5teM6bJ%2FECF7mke1sOEUieApvD9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31556926
cf-ray: 76b392703f2bb99a-AMS

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 113ms
40ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@400;500;800&display=swap

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f3579d05fcc963a07f7841aaa521939dd505f50f3020a3bd8b7d8949fc9c26d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 16 Nov 2022 22:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 16 Nov 2022 22:13:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 16 Nov 2022 22:13:05 GMT

GET
H/1.1 200
OK et-divi-customizer-global-16685484077635.min.css
www.webroot.com/blog/wp-content/et-cache/global/ 10 KB
3 KB 1113ms
531ms Stylesheet
text/css 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/et-cache/global/et-divi-customizer-global-16685484077635.min.css

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

9c9f5165567dad7b43aaf0b82ec7ab3a978fb9ce9e8da3ddfba5e5faec4d856f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-94
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Tue, 15 Nov 2022 21:40:08 GMT
Server: Apache
ETag: "2984-5ed8933294186-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=249
Expires: Sat, 19 Nov 2022 22:13:06 GMT

GET
H/1.1 200
OK core.js+ssdomvar.js+generic-adapter.js Show response
www.webroot.com/__ssobj/ 17 KB
6 KB 1259ms
33ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.webroot.com/__ssobj/core.js+ssdomvar.js+generic-adapter.js
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),
Reverse DNS
Software: Apache /
Resource Hash: 6189a4dd3c23d3f65c33204ed8083642eb820a2257352145f999308a665538ad

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:06 GMT
Content-Encoding: br
Last-Modified: Sun, 06 Nov 2022 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=248
RTSS: 1-2-160
Content-Length: 6132
SBSS: 1
Expires: Thu, 17 Nov 2022 22:13:06 GMT

GET
H2 200 webroot-logo-corporate.svg
www-cdn.webroot.com/6114/9987/6454/ 14 KB
5 KB 153ms
37ms Image
image/svg+xml 52.222.214.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www-cdn.webroot.com/6114/9987/6454/webroot-logo-corporate.svg
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-110.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1a91e0a02f091ba91cd4ed3ac451b81b5ac81cd2d4e9f004e730a539c64627fb

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Mon, 14 Nov 2022 06:05:08 GMT
content-encoding: gzip
via: 1.1 740769d10d5ef217a54d33b1ec64faf4.cloudfront.net (CloudFront)
last-modified: Thu, 27 Sep 2018 14:22:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 230880
etag: W/"5bf6a82b6fc2c0ff99e3a641ad78c0c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: max-age=259200
x-amz-cf-id: 4vxUZ5QdbqwEuF8RswldAtXGabzeU9aCl7Ii2p1rAVktsg7pV8jqjA==

GET
H2 200 TrickBot-Module-800x400.jpg
blog-en.webroot.com/wp-content/uploads/2018/03/ 133 KB
133 KB 949ms
766ms Image
image/jpeg 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/TrickBot-Module-800x400.jpg
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3d26dcaaf67dc0f3c16207c4ad3169b20106013522cfa8db487a9326fcb62277

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:21 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "af89c89e5ecc623c2a7fe076547899fe"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 135844
x-amz-cf-id: fxnTaOXCT836JjJeSgmTGcTm8ef7H3IPpvw6PmA7OhsS6AdnVIhEFQ==
expires: Thu, 19 Mar 2020 21:11:20 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
www.webroot.com/blog/wp-includes/js/ 18 KB
6 KB 527ms
526ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-94
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "4705-5d5e57c33f4fd-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=246
Expires: Fri, 16 Dec 2022 22:13:08 GMT

GET
H2 200 Jason-Davison_avatar_1525473208.jpg
blog-en.webroot.com/wp-content/uploads/2019/03/26135512/ 451 KB
452 KB 922ms
739ms Image
image/jpeg 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2019/03/26135512/Jason-Davison_avatar_1525473208.jpg
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d261cba562e13ad40fb85bc3671d6ffc4fb9f1ae07da994b287de02005ab1b08

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Tue, 26 Mar 2019 19:55:13 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "f33442235f16e5b32cfd62a8ceb6f2aa"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 461466
x-amz-cf-id: D5pgZMDcwEODcDDVuTNFObmfkuiuSVhJq14VMqSreFyBH9xiqFkF5g==
expires: Wed, 25 Mar 2020 19:55:12 GMT

GET
H2 200 Q0d_bH_C_normal.jpg
pbs.twimg.com/profile_images/1513711825007026181/ 2 KB
2 KB 115ms
32ms Image
image/jpeg 2a04:4e42:62::159
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1513711825007026181/Q0d_bH_C_normal.jpg

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:62::159 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

66d9dcb1b94c15b910852839de75c1db1632ca3b5f54e6119d529f20532452a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=631138519
date: Wed, 16 Nov 2022 22:13:07 GMT
x-content-type-options: nosniff
x-cache: HIT, HIT
server-timing: x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length: 1807
x-served-by: cache-lhr7348-LHR, cache-hhn11537-HHN, cache-tw-ZZZ1
last-modified: Tue, 12 Apr 2022 02:51:17 GMT
x-tw-cdn: FT
content-type: image/jpeg
access-control-allow-origin: *
x-transaction-id: b1bbf9bf7b470e9f
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
perf: 7626143928
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H2 200 zUovOkdD_normal.jpg
pbs.twimg.com/profile_images/857036910341931012/ 2 KB
2 KB 32ms
32ms Image
image/jpeg 2a04:4e42:62::159
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/857036910341931012/zUovOkdD_normal.jpg

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:62::159 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cccbd0110d003c5dd6b1aa53a31a63f72626088f85bb1f686252e7a778c8925f

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=631138519
date: Wed, 16 Nov 2022 22:13:07 GMT
x-content-type-options: nosniff
x-cache: HIT, HIT
server-timing: x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length: 2035
x-served-by: cache-lhr7329-LHR, cache-hhn11537-HHN, cache-tw-ZZZ1
last-modified: Wed, 26 Apr 2017 00:59:37 GMT
x-tw-cdn: FT
content-type: image/jpeg
access-control-allow-origin: *
x-transaction-id: ff0a20daa6af4a9f
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
perf: 7626143928
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H/1.1 200
OK slick.min.js Show response
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/js/ 41 KB
11 KB 536ms
536ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/js/slick.min.js?ver=20170502

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 26 Oct 2017 07:56:52 GMT
Server: Apache
ETag: "a3e1-55c6e83dcd900-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=6290
Keep-Alive: timeout=5, max=246
Expires: Fri, 16 Dec 2022 22:13:07 GMT

GET
H/1.1 200
OK idle-timer.min.js Show response
www.webroot.com/blog/wp-content/plugins/monarch/js/ 3 KB
2 KB 529ms
528ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/js/idle-timer.min.js?ver=1.4.14

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

80fa756dda143f69fb3ce750e905cc8188150dc4c6b7539bf3627fe26530b405

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-94
Content-Length: 1064
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:32:00 GMT
Server: Apache
ETag: "a4b-5d3d2c7122000-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=247
Expires: Fri, 16 Dec 2022 22:13:07 GMT

GET
H/1.1 200
OK custom.js Show response
www.webroot.com/blog/wp-content/plugins/monarch/js/ 26 KB
6 KB 519ms
516ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/js/custom.js?ver=1.4.14

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

43b5c9ad80f0a5d1c63568583e9cf6cd5ca8454a680f4ee80d5d63d00b15a360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 5582
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:32:00 GMT
Server: Apache
ETag: "6855-5d3d2c7122000-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=247
Expires: Fri, 16 Dec 2022 22:13:07 GMT

GET
H/1.1 200
OK custom.min.js Show response
www.webroot.com/blog/wp-content/themes/Divi/js/ 250 KB
60 KB 527ms
524ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/themes/Divi/js/custom.min.js?ver=3.7

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d714f6dbeb37f1dd1919e9567223ee3023d92f41ab13f502aca043593375a4c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-160
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 11 Mar 2020 15:18:28 GMT
Server: Apache
ETag: "3e6d1-5a095bf907c8d-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=6344
Keep-Alive: timeout=5, max=247
Expires: Fri, 16 Dec 2022 22:13:07 GMT

GET
H/1.1 200
OK common.js Show response
www.webroot.com/blog/wp-content/plugins/monarch/core/admin/js/ 1 KB
1 KB 519ms
516ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/core/admin/js/common.js?ver=4.9.3

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-98
Content-Length: 566
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:31:59 GMT
Server: Apache
ETag: "53f-5d3d2c702ddc0-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=5952
Keep-Alive: timeout=5, max=248
Expires: Fri, 16 Dec 2022 22:13:07 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
www.webroot.com/blog/wp-includes/js/ 1 KB
2 KB 535ms
534ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-includes/js/wp-embed.min.js?ver=5.8.6

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 765
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 19 Jan 2022 01:41:31 GMT
Server: Apache
ETag: "592-5d5e57c338f6d-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=246
Expires: Fri, 16 Dec 2022 22:13:08 GMT

GET
H/1.1 200
OK ctf-scripts.min.js Show response
www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/js/ 16 KB
7 KB 534ms
533ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/js/ctf-scripts.min.js?ver=1.8.4

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

88e83545208250959661a3df52b21e6b7cd0f9d36d9c95e61812b79add9c6aa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:31:45 GMT
Server: Apache
ETag: "3f2e-5d3d2c62d3e40-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=5331
Keep-Alive: timeout=5, max=245
Expires: Fri, 16 Dec 2022 22:13:08 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 554 KB
119 KB 136ms
65ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NPDZV9

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

10d4b59f1c0d027af121c5f9ed20a564bdaab824683b4f29725302f3f6037a3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121069
x-xss-protection: 0
last-modified: Wed, 16 Nov 2022 21:00:26 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 16 Nov 2022 22:13:07 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Font
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: text/plain;charset=US-ASCII

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/ 37 KB
38 KB 102ms
31ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@400;500;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Mon, 14 Nov 2022 16:54:37 GMT
x-content-type-options: nosniff
age: 191910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37924
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:54:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 14 Nov 2023 16:54:37 GMT

GET
H/1.1 200
OK modules.ttf
www.webroot.com/blog/wp-content/themes/Divi/core/admin/fonts/ 90 KB
36 KB 702ms
530ms Font
application/font-sfnt 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/themes/Divi/core/admin/fonts/modules.ttf

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-content/themes/Divi/style.css?ver=5.8.6

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.webroot.com/blog/wp-content/themes/Divi/style.css?ver=5.8.6
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:07 GMT
Content-Encoding: br
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-84
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 11 Mar 2020 15:18:27 GMT
Server: Apache
ETag: "168f0-5a095bf8f20e2"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/font-sfnt
Cache-Control: max-age=172800
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=247
Expires: Fri, 18 Nov 2022 22:13:07 GMT

GET
H2 410 1464.js
script.crazyegg.com/pages/scripts/0021/ 0
0 212ms
143ms Script
application/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0021/1464.js?463510
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Nov 2022 22:13:07 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400, s-maxage=86400
cf-ray: 76b392705f3c1c83-AMS
content-length: 0

GET
H/1.1 200
OK monarch.ttf
www.webroot.com/blog/wp-content/plugins/monarch/css/fonts/ 15 KB
10 KB 1036ms
538ms Font
application/font-sfnt 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-content/plugins/monarch/css/fonts/monarch.ttf

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.4.14

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

8c102baea959329be23bb8a5d6bc268ce1668484995f0d23c2f88b46d7653c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.webroot.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.4.14
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: br
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-98
Content-Length: 9734
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Thu, 23 Dec 2021 16:32:00 GMT
Server: Apache
ETag: "3af8-5d3d2c7122000"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/font-sfnt
Cache-Control: max-age=172800
Accept-Ranges: bytes
X-Duration: D=7575
Keep-Alive: timeout=5, max=247
Expires: Fri, 18 Nov 2022 22:13:08 GMT

GET
H2 200 Trickbot-image1.png
blog-en.webroot.com/wp-content/uploads/2018/03/ 150 KB
150 KB 851ms
731ms Image
image/png 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/Trickbot-image1.png
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a878fcdd35bae8e91925e0fca9780fa67aefa19aad3d3976b59926e7e076d79

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:21 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "7de7fca3e0a07caf2bdccbaf6ccf32ce"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 153312
x-amz-cf-id: 9gQmPh8H71usYSOFiPyYJfHhjmk4zxbFNaeCwEWq4pKIXgdMyrA8YA==
expires: Thu, 19 Mar 2020 21:11:20 GMT

GET
H2 200 Trickbot-image2.png
blog-en.webroot.com/wp-content/uploads/2018/03/ 152 KB
153 KB 852ms
733ms Image
image/png 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/Trickbot-image2.png
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 53d79af512578ab540434fc568f2ad0cd001cc06f35ab46522f25b5b03b7ac0e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:20 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "84a4177a42ac20fe5744faa4eba6d99c"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 156072
x-amz-cf-id: cSBuipuek6sBT3kBbKqEkd_WGMDOWg4RH-TfU5TQg4hOSWmjR7T0dA==
expires: Thu, 19 Mar 2020 21:11:19 GMT

GET
H2 200 Trickbot-image2b.png
blog-en.webroot.com/wp-content/uploads/2018/03/ 99 KB
99 KB 889ms
770ms Image
image/png 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/Trickbot-image2b.png
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c325a8eaf56b605afbb4e1884a9da751c45da7197286ba1af5111514ec94727e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:20 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "b9665a1cb2e03a210d05e89141a40ba0"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 101015
x-amz-cf-id: suUMw12zEHTSaQWvq9MsX3C3IRxtQYAPb6QRnEO_JE_7BfoIkLnrxA==
expires: Thu, 19 Mar 2020 21:11:19 GMT

GET
H2 200 Trickbot-image3.png
blog-en.webroot.com/wp-content/uploads/2018/03/ 29 KB
29 KB 732ms
732ms Image
image/png 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/Trickbot-image3.png
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 161a44c9fde67b6c519976d86a6d7d8ad1d1e05f2f18bdb38b4504b7c8eb8e6c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:20 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "ec802b97dfafee21701eb6112a9d2ca9"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 29265
x-amz-cf-id: _nedmo8WR2-ODtUnMnw99ZcCWlYUbWywWNkuLIBkH0dTN9OV6QgGaw==
expires: Thu, 19 Mar 2020 21:11:19 GMT

GET
H2 200 Trickbot-image4.png
blog-en.webroot.com/wp-content/uploads/2018/03/ 258 KB
259 KB 788ms
787ms Image
image/png 18.64.119.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog-en.webroot.com/wp-content/uploads/2018/03/Trickbot-image4.png
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.119.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-119-63.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42f91bdd78fa9f63c124413234e15ab318b12ef9fc9f2fc21b509ec6d483cd0a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:09 GMT
via: 1.1 9d638fe6fe3e82d4d1292fa9e998dfbe.cloudfront.net (CloudFront)
last-modified: Wed, 20 Mar 2019 21:11:20 GMT
server: AmazonS3
x-amz-cf-pop: TXL50-P4
etag: "4275f39dde25e399e232a62be18f0be3"
x-cache: Miss from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 264573
x-amz-cf-id: dDT-WTg0XFBeDnsoTTTMUI68JRpk0qcEacIZ3APNUrUwmqW7t7ThbA==
expires: Thu, 19 Mar 2020 21:11:19 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 99ms
40ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NPDZV9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: HNx4bdEmRgn5g09KulPi7w==
age: 82343
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Mon, 14 Nov 2022 03:33:57 GMT
server: cloudflare
etag: 0x8DAC5F10FDD1A08
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 19cac252-901e-0118-0b86-f8b326000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b392774d4ab78b-AMS

GET
H/1.1 200
OK webroot Show response
www.webroot.com/services/theme/ 162 KB
30 KB 911ms
911ms XHR
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/services/theme/webroot?callback=jQuery360016926149289994386_1668636787148&_=1668636787149

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d799dfefdc1d238ee7cecb7d7549b9610cbef2038af7b3b2b52ee41321d34c4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Expires: Fri, 16 Dec 2022 22:13:08 GMT
Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=2592000
Connection: Keep-Alive
Keep-Alive: timeout=5, max=246
RTSS: 1-2-84
Content-Length: 29579
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
941 B 1204ms
1203ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d404ea2527b7e94c798b686c4089e219c06dbfd907f4e49ab7f3c194903dcfcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-98
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Duration: D=645782
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=246
Expires: Fri, 20 May 2022 17:58:29 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
942 B 1169ms
1169ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

ad2d944d6430ca949072b031a10dcbf4cc52c4d4e0bbb3046c34e356e9e8aa25

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-159
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Duration: D=623894
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=244
Expires: Fri, 20 May 2022 18:06:38 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
919 B 1187ms
1187ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d404ea2527b7e94c798b686c4089e219c06dbfd907f4e49ab7f3c194903dcfcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-94
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=245
Expires: Fri, 20 May 2022 17:57:00 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
919 B 1199ms
1198ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d404ea2527b7e94c798b686c4089e219c06dbfd907f4e49ab7f3c194903dcfcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=245
Expires: Fri, 20 May 2022 17:48:14 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
942 B 1210ms
1210ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

ad2d944d6430ca949072b031a10dcbf4cc52c4d4e0bbb3046c34e356e9e8aa25

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:08 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-160
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Duration: D=649108
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=246
Expires: Fri, 20 May 2022 18:07:23 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
www.webroot.com/blog/wp-admin/ 62 B
919 B 2168ms
1151ms XHR
text/html 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/blog/wp-admin/admin-ajax.php

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

d404ea2527b7e94c798b686c4089e219c06dbfd907f4e49ab7f3c194903dcfcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Wed, 16 Nov 2022 22:13:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff, nosniff
Connection: Keep-Alive
RTSS: 1-2-84
Content-Length: 70
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0, proxy-revalidate
X-Robots-Tag: noindex
Keep-Alive: timeout=5, max=245
Expires: Fri, 20 May 2022 17:55:33 GMT

GET
H2 200 6a65b415-1182-47a8-a86d-95d8c1bee0ed.json Show response
cdn.cookielaw.org/consent/6a65b415-1182-47a8-a86d-95d8c1bee0ed/ 4 KB
2 KB 82ms
32ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6a65b415-1182-47a8-a86d-95d8c1bee0ed/6a65b415-1182-47a8-a86d-95d8c1bee0ed.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52742ff58dc6a55abfcbe885c916ed32e24e9b72cbf04fcb4f19b88a19e10f42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 23I/cDQAGCCpOVGKDcN4jQ==
age: 44288
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1638
x-ms-lease-status: unlocked
last-modified: Wed, 21 Sep 2022 17:37:06 GMT
server: cloudflare
etag: 0x8DA9BF7E70FE681
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 08b04ea9-a01e-0132-40e0-cdc663000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b39277dfb81c96-AMS
expires: Thu, 17 Nov 2022 22:13:08 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 74 B
322 B 110ms
50ms XHR
application/json 2606:4700::6812:1b55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1b55 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

498b9857c51790a045b6b127fe4f95ef72e86dffd41b71f1d14d149a33e11b28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.webroot.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 22:13:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 76b392787ca8b95c-AMS
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202209.1.0/ 376 KB
90 KB 135ms
135ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 229oLfugqvtMNLM3e0uPaA==
age: 71952
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 91423
x-ms-lease-status: unlocked
last-modified: Tue, 11 Oct 2022 04:36:30 GMT
server: cloudflare
etag: 0x8DAAB422B1E6529
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 65ffbfc2-d01e-0039-6a3d-dd9842000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b392792edcb78b-AMS

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/6a65b415-1182-47a8-a86d-95d8c1bee0ed/2de176ed-9569-402c-99a6-456c65bfa20c/ 183 KB
33 KB 54ms
53ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/6a65b415-1182-47a8-a86d-95d8c1bee0ed/2de176ed-9569-402c-99a6-456c65bfa20c/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85f49304bd763c4ef9f69c3d1dba413e1595632abbe02ef0f246c0542c286c70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: xJNtaGsh0IAyCicfqwCeiA==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 33314
x-ms-lease-status: unlocked
last-modified: Wed, 21 Sep 2022 17:37:09 GMT
server: cloudflare
etag: 0x8DA9BF7E8F182EF
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 8bdfb44a-101e-016f-09e0-cd3667000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b39279fa681c96-AMS
expires: Thu, 17 Nov 2022 22:13:08 GMT

GET
H/1.1 200
OK jquery.min.js Show response
www.webroot.com/application/javascript/libraries/jquery/ 84 KB
30 KB 514ms
514ms Script
application/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/application/javascript/libraries/jquery/jquery.min.js

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-98
Content-Length: 29822
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Last-Modified: Wed, 12 Oct 2022 21:26:51 GMT
Server: Apache
ETag: "14e4a-5eadd0d0d5f11-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Accept-Ranges: bytes
X-Duration: D=4891
Keep-Alive: timeout=5, max=245
Expires: Fri, 16 Dec 2022 22:13:09 GMT

GET
H/1.1 200
OK ard.png Show response
www.webroot.com/__ssobj/ 0
495 B 725ms
27ms XHR
text/javascript 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL: https://www.webroot.com/__ssobj/ard.png?7166740412554814162_1-526-1668636783&n=1
Requested by: Host: www.webroot.com
URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 16 Nov 2022 22:13:09 GMT
Last-Modified: Tue, 26 Apr 2022 09:09:20 GMT
Server: Apache
Content-Type: text/javascript
Cache-Control: private, no-store, no-cache, max-age=0, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=244
RTSS: 1-2-94
Content-Length: 0
SBSS: 1
Expires: -1

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/ 13 KB
3 KB 29ms
29ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: wG3T8rT9wA5w2UbDdvkxcQ==
age: 29192
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Tue, 11 Oct 2022 04:36:21 GMT
server: cloudflare
etag: 0x8DAAB42258FDE79
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 5da09246-b01e-006d-4049-dd72c8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b3927a5b081c96-AMS

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/v2/ 62 KB
13 KB 30ms
30ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: eeLeQFlL9c7wmvR8bYV+Vw==
age: 41100
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13334
x-ms-lease-status: unlocked
last-modified: Tue, 11 Oct 2022 04:36:23 GMT
server: cloudflare
etag: 0x8DAAB4226FAD215
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: ceef9baa-801e-0080-553d-dd7b4c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b3927a6b091c96-AMS

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/ 22 KB
5 KB 33ms
33ms Fetch
text/css 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: B55i3ZY9miZIaUrwjufy0w==
age: 41100
x-ms-lease-status: unlocked
last-modified: Tue, 11 Oct 2022 04:36:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 4fec501f-f01e-0103-753d-dd9db4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 76b3927a6b0b1c96-AMS

GET
H2 200 webroot-opentext-logo-black.png
cdn.cookielaw.org/logos/b22adc29-a371-4aaa-a82b-043f0024fdb4/6a65b415-1182-47a8-a86d-95d8c1bee0ed/cfc04707-f38d-4586-90ef-521cfc4538a4/ 20 KB
20 KB 29ms
29ms Image
image/png 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/b22adc29-a371-4aaa-a82b-043f0024fdb4/6a65b415-1182-47a8-a86d-95d8c1bee0ed/cfc04707-f38d-4586-90ef-521cfc4538a4/webroot-opentext-logo-black.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6199b6a55bb44cedc24d0f0f44b32bf6f04cc8a1ea5d7e672ca00467479634a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: d1YUO/Uj0nTRKSMwHPGrKg==
age: 50091
content-length: 20435
x-ms-lease-status: unlocked
last-modified: Wed, 20 Apr 2022 20:27:55 GMT
server: cloudflare
etag: 0x8DA230C40354130
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 4003d939-001e-0134-450c-5b311b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 76b3927ae854b78b-AMS

GET
H2 200 poweredBy_ot_logo.svg
cdn.cookielaw.org/logos/static/ 3 KB
2 KB 34ms
33ms Image
image/svg+xml 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Nov 2022 22:13:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: LpuayL42jB78xRllx0vkOw==
age: 80169
x-ms-lease-status: unlocked
last-modified: Mon, 14 Nov 2022 03:33:58 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6c0b8d14-301e-0173-7f8d-f8ee70000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 76b3927ae856b78b-AMS

GET
H/1.1 200
OK fontawesome-webfont.woff2
www.webroot.com/application/fonts/ 70 KB
71 KB 668ms
548ms Font
font/woff2 159.255.219.5
EQUINIX

General

Check archive.org

Show headers Download Go to

Full URL

https://www.webroot.com/application/fonts/fontawesome-webfont.woff2?v=4.6.3

Requested by

Host: www.webroot.com
URL: https://www.webroot.com/application/css/libraries/webroot.libraries.min.css?ver=5.8.6

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

159.255.219.5 , Netherlands, ASN15830 (EQUINIX, GB),

Reverse DNS

Software

Apache /

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.webroot.com/application/css/libraries/webroot.libraries.min.css?ver=5.8.6
Origin: https://www.webroot.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 16 Nov 2022 22:13:09 GMT
Content-Encoding: br
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: Keep-Alive
RTSS: 1-2-159
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Pragma: no-cache
Last-Modified: Wed, 12 Oct 2022 21:26:50 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: font/woff2
Cache-Control: must-revalidate, proxy-revalidate, max-age=0
Accept-Ranges: bytes
X-Duration: D=545
Keep-Alive: timeout=5, max=243
Expires: Wed, 12 Oct 2022 21:26:50 GMT

GET
H2 200 Webroot-logo-global-icon-color.svg
www-cdn.webroot.com/8116/4908/4550/ 3 KB
2 KB 35ms
34ms Image
image/svg+xml 52.222.214.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www-cdn.webroot.com/8116/4908/4550/Webroot-logo-global-icon-color.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-110.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ec9b7cefe7f3e6af4d90f1534754cdc18a8698acbb33940f060897f522eeec04

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 16 Nov 2022 08:22:47 GMT
content-encoding: gzip
via: 1.1 740769d10d5ef217a54d33b1ec64faf4.cloudfront.net (CloudFront)
last-modified: Mon, 04 Apr 2022 15:02:32 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 49823
etag: W/"2d9f20f9e64f5325b9fb6b76be852339"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: NFZNt0SfcXXQKH-aoKvZNPEotEPkYThO6HC4ekYiPH-tNTwA4hY8_w==

GET
H2

200

Webroot-logo-global-icon-color-inverted.svg
www-cdn.webroot.com/8416/4909/6290/
Redirect Chain

https://www.webroot.com/download_file/4685
https://www-cdn.webroot.com/8416/4909/6290/Webroot-logo-global-icon-color-inverted.svg

3 KB
2 KB

34ms
33ms

Image
image/svg+xml

52.222.214.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www-cdn.webroot.com/8416/4909/6290/Webroot-logo-global-icon-color-inverted.svg
Protocol: H2
Server: 52.222.214.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-110.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 97703f997bfeda010bea99628c8e2a77c3149f47d4aa224cb8627168cc0b2364

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.webroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 22:15:23 GMT
content-encoding: gzip
via: 1.1 740769d10d5ef217a54d33b1ec64faf4.cloudfront.net (CloudFront)
last-modified: Mon, 04 Apr 2022 18:18:11 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 86268
etag: W/"69e271cbd0b645f238b2b54ca7ac1a23"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: SUx_86x0YwqvQsxKPfRzduUosYXdsC9QlOwRmq_CLvoyTL7PMzpvRQ==

Redirect headers

Date: Wed, 16 Nov 2022 22:13:10 GMT
Content-Encoding: br
X-Content-Type-Options: nosniff
Connection: Keep-Alive
RTSS: 1-2-65
Content-Length: 364
X-XSS-Protection: 1; mode=block
X-Client-IP: 31.204.152.216
Pragma: no-cache
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Location: https://www-cdn.webroot.com/8416/4909/6290/Webroot-logo-global-icon-color-inverted.svg
Cache-Control: private, max-age=0, proxy-revalidate, no-store, no-cache, must-revalidate
Keep-Alive: timeout=5, max=244
Expires: Fri, 20 May 2022 17:48:14 GMT

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: IFDIEGBGMDJCFIADCAPEBHLLKIALCKFJGHNBKCALPFNMKGIMPMKNOLPGDNBHMBMFBAGDLLDHFAMAJICIAACAJJHECGICLCKHBENLGNGGDECNKKGIBIOPDNGHLIPHJLKE
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/css	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: IMEHPOOPHJEGEOOKFLIOANLGENPKADJMIFPKDOIJILOOJPLOMDHNPODPAOJOPKHLNAADENJLGAEIBBAHCOGABJBFCGHBNMDHFFPIDHBLCPKMPFHANMOMLCMLBFKAACKI
www.webroot.com/blog/wp-content/plugins/wordpress-carousel-pro/assets/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: FDAKICFKMHHABILCAHCPKFKKIDNLBHLNNKHPJEIKOAMLKLBOMGCJBDMLIKJMBLBFLMMDLAMIIANLEFPLEOOAKEFDCGJODMCBOBHHGPBEAOPKJAHAAIBCLNOEIHAJDCGP
www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/css	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: BIIOEPJMKDDMEGGLGFNKNNOKOPGNNDHEFAFDPCOEDKENCDAKAKJHPFPENAOPFLIEFJKDLLIFGAEAMGLFKLFAOJINCGMALENEHDKHFILIDPFFDFNMMEJMJJAGKOGPKOCD
www.webroot.com/blog/wp-content/plugins/monarch/core/admin/fonts	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: EKIJOKFDBJPIMMAHLOJAKCEANDKJHMGACDPAKLHDECJOMBLIPLEKJFMNNCGBDCGOEGADNNHOIADANGOGHNJAJPHGCGHNGAMIKKFFFMIKOCILDDOLBAILGEIDGPFKBMNF
www.webroot.com/blog/wp-content/plugins/custom-twitter-feeds/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: KOHLDMCPLAGNJHLNBDKEABFBLHEAGMPOFDCOLPBBDIJMBLALHCMNIKLHFJGDJFOBCEIDFKDAJAIHBJEFAIGAHPPDCGELKFLBLDEHDGIGOBCPMCJEFIFODAFIJMMCBKOF
www.webroot.com/blog/wp-content/plugins/monarch/core/admin/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: INJMOMEIOGNIJIGFMGDOGCMCAKBDKIFOLGDFMJFLBPIEBHKBPCEAHGCMICFGMEPLIMGDNPKLIAGMPIBICLOAHJDICGLIHHKLAIAMBFHCFAGGHAGLEBOLIAIADOGPCGDK
www.webroot.com/blog/wp-includes/css/dist/block-library	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: ODIOCIAAPAJCEMEHCDOMGIBKFGOENAGMGICMOOEBEBBAAMBIPCONEIJCEAGKJOOHAKODPBGOGAFGGEJCFOLAEJAKCGIKGDPJNPNMNCNBDOBDLCHHHGMMPGOEGEOPDMAF
www.webroot.com/application/javascript/libraries/jquery	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: CPAANJJEJAEHCIGFKCHHLLODCAKFEPGKGCCKFOKKJKEPOLCLFCGJBIOHBBOCKLNIMBKDFMMOKAAMIKBMEELAJCMLCGGAMBGNNGJDEDNNNBMMMOKCJHFLAECBFBEAMBDI
www.webroot.com/blog/wp-content/themes/Divi-Child/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: OIDFOBFHKKLMOLHENEANGGFOPAMEGCOEHEFJJAEMLBADLGIAOAEFMJNLDLMHFLHOMKMDGICAHAICHFADMGKAPENPCGEKFEHNJKJCKOPFPPJKFBKJCEAPNNKBIGIOCAAB
www.webroot.com/blog/wp-content/plugins/wp-pagenavi	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: HNBHILBJOEOANDMODIIFPAEFEBKINDEBDIGDIBNCBGDFPGFNNBBMJABDLLADKEEBMGKDMPGLGAODKJLIGKEAIOBNCGCIGMIKAEOJFMLHCOMBFBFKMBIFBKIMGIPBNEPA
www.webroot.com/blog/wp-content/plugins/monarch/css	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: MGDKNNBLPNLMEHMFHNDNFAOEBOONFHNAFDHILNOACGFAJBBKLNCGHMOIAFAJMBCBJLCDMIJLHANJFFKCIPGANBMPCGKDLNCIHHJDEHDGNIGHKIPAIIEAFDIFIIOFJAND
www.webroot.com/blog/wp-content/plugins/monarch/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: NIDEHJHLBLDADACNKKECFLDBBOIIAKABIJPBCCNJELOJBOBGGCMONIMGEMKMOGKFOKODOANPIAKNODOKIFHAKHJLCGEDFCAELLKNNIGBDEKFDLNFGEADMNKBKFNIMHCF
www.webroot.com/blog/wp-content/themes/Divi-Child	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: NDKADJPDAJLODIBPEHHAMOAAOPBIHDBDGLGCCFCPKNKAJOBLAIKEMEENNALMMHKADFIDJBIJHACNFIIBADPADOJBCGNCHNPJEDEGIGGCDACMOEONEDDAHHOFIKBEBLCL
www.webroot.com/blog/wp-content/et-cache/global	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: JNJKNJLOAMIDIBIFGJNBKIKPBKNPDKOHADKAENEMGPBJGNFEJAIFCDGJAPOFPMLKEGMDKMNLHALDJHDEHOJAECGFCGDHHFPBJAHNNLJDKKMAICMADBMFECPFCNKCKGDM
www.webroot.com/blog/wp-content/themes/Divi	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: CHCEPFEFHJANEMICHDHPPEOJHDABJCLAEKBPOKBGNBJKPHFHNHPGAHIMLGNAKOMJCAIDINOPHAJJEEJNGGFAAKEHCGOBODACPNNNIODFANAPEFMMMGLNODKKKHLEGHAB
www.webroot.com/blog/wp-includes/js/jquery	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: DCBHILBLOEOANDMOCOJFPAEFEBKINDEBDIGDIBNCBGDFPGFNNBBMJABDLLADKEEBMGKDMPGLHAODJJLIGKEAIOBNCGCIGMIKAEOJFMLHCOMBFBEFMBIFBKIMGIPBNEBG
www.webroot.com/application/css/libraries	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: EIOIDLABHAIPEDCPMPHEEJHJJHFCELBIFFONKBJEDPDLCCOBLCPONHDHNEIJOKPPCGMDMAGEHAGHMHBEHJAAAPLKCGKMFIEBLCEFENJHMMCPOAHCADGOKJFHONBMHBBO
www.webroot.com/blog/wp-includes/css	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: IGKAGFKLPCABPNOAEGIDFAGHFKAGFBLEMIIMNHEMELBEDGAJHFIACDCICJAIHNLBNEADMKNLHAJIELJEFBPAPHKFCGMBFBMCCEDPMHMADNEGDFFFNEFPHHIKBICIGNOM
www.webroot.com/blog/wp-includes/js	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: AICPLMILALCMINIJPCLAJMIFBOOCBGLKOJGCJDIMFDIMHLJCLEDOEGMBCBKLPIBIEKMDLDOLJACFOOKPGMFAONKPCGFLFLANIFPBJHNOLFKCBDOGCLJHBGIDHDPHMBHN
www.webroot.com/application/fonts	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: BEFLNNBIPNLMEHMFPPMNFAOEBOONFHNAFDHILNOACGFAJBBKLNCGHMOIAFAJMBCBJLCDMIJLKANJKFKCIPGANBMPCGKDINCIHHJDEHDGNIGHKIOAIIEAFDIFIIOFJAEH
www.webroot.com/services/theme	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: KJIGPOOPHJEGEOOKAEGOANLGENPKADJMIFPKDOIJILOOJPLOMDHNPODPAOJOPKHLNAADENJLJAEIMBAHCOGABJBFCGHBOMDHFFPIDHBLCPKMPFHPNMOMLCMLBFKAACNM
www.webroot.com/download_file	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: IMHFPAMIAMPOFGDHNMLHMGLPMPFKKBCLANAFNLGNFFKEPCMNBBKNBBIAKFJGBLKJJEGDCMICKAFOMCAOCFPAOAGKCGCMHBBIAFCOAILGOGKNIGONJAMKCELMJFCLANHE
www.webroot.com/blog/wp-admin	1969-12-31 23:59:59	Name: f5avraaaaaaaaaaaaaaaa_session_ Value: KCNIICHCCIBDPLEJNPMFPNAJLHMOAJNGJIAONHIGAJGJCGMELDNHDCJABKMCKKONMNMDNLAPKAHANGJGILCAPHLKCGOGKABKPMDMDLDDFJMHPJPPJDENGNOHIKJCEICC
.webroot.com/	1969-12-31 23:59:59	Name: SSLB Value: 1
.webroot.com/	1970-01-20 16:16:12	Name: SSID Value: CQBofx1GAAAAAABvYHVj0iLEJ29gdWMBAAAAAAAAAAAAb2B1YwAUgLfUAAFSBB4Ab2B1YwEAlhYBAZ1DJABvYHVjAQCN2gABYqceAG9gdWMBACbeAAFm6R4Ab2B1YwEAr80AAepaHABvYHVjAQA
.webroot.com/	1969-12-31 23:59:59	Name: SSSC Value: 526.G7166740412554814162.1\|52655.1858282:54455.1967186:55949.2008930:56870.2025830:71318.2376605
.webroot.com/	1970-01-20 16:16:12	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Nov+16+2022+22%3A13%3A08+GMT%2B0000+(GMT)&version=202209.1.0&isIABGlobal=false&hosts=&consentId=3c5f4b71-caf6-4a85-8e4c-44d9a285caeb&interactionCount=0&landingPath=https%3A%2F%2Fwww.webroot.com%2Fblog%2F2018%2F03%2F21%2Ftrickbot-banking-trojan-adapts-new-module%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0%2CC0005%3A0
www.webroot.com/	1969-12-31 23:59:59	Name: CONCRETE5 Value: 9b098b9d4f6a7b447c1dde6f0f4117ff
.webroot.com/	1970-01-20 16:16:12	Name: SSRT Value: dWB1YwADAA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://script.crazyegg.com/pages/scripts/0021/1464.js?463510 Message: Failed to load resource: the server responded with a status of 410 ()
javascript	warning	URL: https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/ Message: The resource https://www.webroot.com/blog/wp-content/plugins/monarch/core/admin/fonts/modules.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog-en.webroot.com
cdn.cookielaw.org
embed.typeform.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
pbs.twimg.com
script.crazyegg.com
use.fontawesome.com
www-cdn.webroot.com
www.googletagmanager.com
www.webroot.com
159.255.219.5
18.64.119.63
2600:9000:214f:9e00:2:c605:29c0:93a1
2606:4700::6810:9440
2606:4700::6812:1b55
2606:4700::6813:9308
2606:4700:e2::ac40:840f
2a00:1450:4001:80b::2008
2a00:1450:4001:828::2003
2a00:1450:4001:831::200a
2a04:4e42:62::159
52.222.214.110
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0a878fcdd35bae8e91925e0fca9780fa67aefa19aad3d3976b59926e7e076d79
0f3177a35320166dbe9145941c74c6a35b6c906540d05f35260400734f84f894
10d4b59f1c0d027af121c5f9ed20a564bdaab824683b4f29725302f3f6037a3e
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
161a44c9fde67b6c519976d86a6d7d8ad1d1e05f2f18bdb38b4504b7c8eb8e6c
1a91e0a02f091ba91cd4ed3ac451b81b5ac81cd2d4e9f004e730a539c64627fb
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
30abf0df9c871c063eca357bae588ea9975ed5354fbb22cb44868a0675b65117
3d26dcaaf67dc0f3c16207c4ad3169b20106013522cfa8db487a9326fcb62277
42f91bdd78fa9f63c124413234e15ab318b12ef9fc9f2fc21b509ec6d483cd0a
43b5c9ad80f0a5d1c63568583e9cf6cd5ca8454a680f4ee80d5d63d00b15a360
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
498b9857c51790a045b6b127fe4f95ef72e86dffd41b71f1d14d149a33e11b28
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
5106a1bf65945ce87340006a1ac052b277bcbd933678683c58cbf98ece2f0989
52742ff58dc6a55abfcbe885c916ed32e24e9b72cbf04fcb4f19b88a19e10f42
53d79af512578ab540434fc568f2ad0cd001cc06f35ab46522f25b5b03b7ac0e
5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5fa1ba6c3cabb6402b9b8df1930a6f90950bf6b90f09b31b80acfaf4d9f138aa
6189a4dd3c23d3f65c33204ed8083642eb820a2257352145f999308a665538ad
6199b6a55bb44cedc24d0f0f44b32bf6f04cc8a1ea5d7e672ca00467479634a5
66d9dcb1b94c15b910852839de75c1db1632ca3b5f54e6119d529f20532452a5
6a360fb959551957e70a7cd4da97893c04b98d9a8378fc548aee38adac30ac97
6a601e465ad7d2f84b43aaafa7f3bc75c4454b26d6c5bd74b0bd12b6698ea6fd
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
80fa756dda143f69fb3ce750e905cc8188150dc4c6b7539bf3627fe26530b405
85f49304bd763c4ef9f69c3d1dba413e1595632abbe02ef0f246c0542c286c70
88e83545208250959661a3df52b21e6b7cd0f9d36d9c95e61812b79add9c6aa5
8c102baea959329be23bb8a5d6bc268ce1668484995f0d23c2f88b46d7653c4f
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
96332da8932c72d133812013c6e2445b94fb14d4d8c4a79306a37907313d96c4
97703f997bfeda010bea99628c8e2a77c3149f47d4aa224cb8627168cc0b2364
9c9f5165567dad7b43aaf0b82ec7ab3a978fb9ce9e8da3ddfba5e5faec4d856f
ad2d944d6430ca949072b031a10dcbf4cc52c4d4e0bbb3046c34e356e9e8aa25
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
c325a8eaf56b605afbb4e1884a9da751c45da7197286ba1af5111514ec94727e
cccbd0110d003c5dd6b1aa53a31a63f72626088f85bb1f686252e7a778c8925f
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
d261cba562e13ad40fb85bc3671d6ffc4fb9f1ae07da994b287de02005ab1b08
d404ea2527b7e94c798b686c4089e219c06dbfd907f4e49ab7f3c194903dcfcb
d714f6dbeb37f1dd1919e9567223ee3023d92f41ab13f502aca043593375a4c9
d799dfefdc1d238ee7cecb7d7549b9610cbef2038af7b3b2b52ee41321d34c4b
d917660c3d6f7aad32ebc4b0012c6d0bb84a13e201a012e334bcca4b9f4686c9
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e02af7df9a190d88380e2dcec2050ecaa493ae2d23526dbeec67f6907df3a752
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c
ea838cefb95ad4291003ceeb9f1172739820daaeadf3c378f3353401e2cf4d67
ec9b7cefe7f3e6af4d90f1534754cdc18a8698acbb33940f060897f522eeec04
ee9812a8e5a77479bd85ac07993b6b221fbe17c670eac77b8bee49ee7c5acfb2
f3579d05fcc963a07f7841aaa521939dd505f50f3020a3bd8b7d8949fc9c26d4
f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

www.webroot.com Open in urlscan Pro 159.255.219.5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

66 Requests

98 %HTTPS

75 %IPv6

10 Domains

12 Subdomains

13 IPs

3 Countries

2429 kBTransfer

5423 kBSize

30 Cookies

55 Outgoing links

Redirected requests

66 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.webroot.com Open in urlscan Pro
159.255.219.5 Public Scan

Screenshot
Live screenshot

Full Image

66
Requests

98 %
HTTPS

75 %
IPv6

10
Domains

12
Subdomains

13
IPs

3
Countries

2429 kB
Transfer

5423 kB
Size

30
Cookies

66 HTTP transactions
1 data transactions