urlscan.io logo urlscan.io
SecurityTrails logo

labs.vipre.com Open in urlscan Pro
3.219.223.49  Public Scan

Go To Rescan Add Verdict Report
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Submission: On December 07 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 39 IPs in 7 countries across 34 domains to perform 84 HTTP transactions. The main IP is 3.219.223.49, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is labs.vipre.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on June 3rd 2020. Valid for: a year.
This is the only time labs.vipre.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
13 3.219.223.49 14618 (AMAZON-AES)
1 2a02:26f0:170... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
5 104.16.96.80 13335 (CLOUDFLAR...)
2 2a04:4e42:3::622 54113 (FASTLY)
4 2600:9000:206... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 216.58.212.162 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 5 104.111.214.206 16625 (AKAMAI-AS)
1 208.118.62.69 7296 (ALCHEMYNET)
1 2 172.217.16.134 15169 (GOOGLE)
2 2a02:26f0:eb:... 20940 (AKAMAI-ASN1)
2 104.111.236.192 16625 (AKAMAI-AS)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
2 185.43.144.18 199766 (SOVEREIGN)
1 151.101.113.131 54113 (FASTLY)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 4 35.227.244.1 15169 (GOOGLE)
3 65.9.73.43 16509 (AMAZON-02)
2 5 167.172.136.187 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a05:f500:11:... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 2 54.78.251.22 16509 (AMAZON-02)
1 65.9.73.52 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a03:2880:f11... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 192.28.147.68 15224 (OMNITURE)
1 34.234.23.30 14618 (AMAZON-AES)
1 52.216.147.108 16509 (AMAZON-02)
2 35.190.54.17 15169 (GOOGLE)
1 99.83.128.14 16509 (AMAZON-02)
1 2a03:2880:f01... 32934 (FACEBOOK)
84 39
13    3.219.223.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-219-223-49.compute-1.amazonaws.com
labs.vipre.com
1    2a02:26f0:1700:793::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
cdn.optimizely.com
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
5    104.16.96.80 (United States)

ASN13335 (CLOUDFLARENET, US)
app-sj08.marketo.com
2    2a04:4e42:3::622 (Ascension Island)

ASN54113 (FASTLY, US)
fast.wistia.com
4    2600:9000:206f:a400:4:41b4:a00:93a1 (United States)

ASN16509 (AMAZON-02, US)
ui.powerreviews.com
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
6    2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net
www.googleadservices.com
2    2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)
script.crazyegg.com
5    104.111.214.206 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-206.deploy.static.akamaitechnologies.com
s.adroll.com
1    208.118.62.69 (United States)

ASN7296 (ALCHEMYNET, US)
www.upsellit.com
2    172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net
10000302.fls.doubleclick.net
2    2a02:26f0:eb:3b4::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
snap.licdn.com
2    104.111.236.192 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-236-192.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
2    185.43.144.18 (Potters Bar, United Kingdom)

ASN199766 (SOVEREIGN, GB)
PTR: www.sovereign-plc.co.uk
app.whoisvisiting.com
dashboard.whoisvisiting.com
1    151.101.113.131 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    2606:4700:3036::681b:8757 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.useproof.com
4    35.227.244.1 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 1.244.227.35.bc.googleusercontent.com
shop.pe
3    65.9.73.43 (Seattle, United States)

ASN16509 (AMAZON-02, US)
d3rr3d0n31t48m.cloudfront.net
5    167.172.136.187 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: accessibeapp01.jetserver.net
acsbap.com
acsbapp.com
cdn.acsbapp.com
1    2a00:1450:4009:809::2002 (London, United Kingdom)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a05:f500:11:101::b93f:9005 (Ireland)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
2    54.78.251.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-251-22.eu-west-1.compute.amazonaws.com
d.adroll.mgr.consensu.org
d.adroll.com
1    65.9.73.52 (Seattle, United States)

ASN16509 (AMAZON-02, US)
assets.ubembed.com
1    2a00:1450:400c:c02::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
2    2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    192.28.147.68 (United States)

ASN15224 (OMNITURE, US)
395-qpj-712.mktoresp.com
1    34.234.23.30 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-234-23-30.compute-1.amazonaws.com
logx.optimizely.com
1    52.216.147.108 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
addshoppers.s3.amazonaws.com
2    35.190.54.17 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 17.54.190.35.bc.googleusercontent.com
shopper.shop.pe
1    99.83.128.14 (Seattle, United States)

ASN16509 (AMAZON-02, US)
pixel.voltn.com
1    2a03:2880:f01c:8004:face:b00c:0:8c (Ireland)

ASN32934 (FACEBOOK, US)
cx.atdmt.com
Apex Domain
Subdomains		 Transfer
13 vipre.com
labs.vipre.com
328 KB
6 shop.pe
shop.pe
shopper.shop.pe
27 KB
6 adroll.com
s.adroll.com
d.adroll.com
29 KB
6 gstatic.com
fonts.gstatic.com
69 KB
5 marketo.com
app-sj08.marketo.com
73 KB
4 acsbapp.com
acsbapp.com
cdn.acsbapp.com
104 KB
4 doubleclick.net
10000302.fls.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
2 KB
4 powerreviews.com
ui.powerreviews.com
172 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
2 KB
3 cloudfront.net
d3rr3d0n31t48m.cloudfront.net
49 KB
3 google-analytics.com
www.google-analytics.com
53 KB
2 google.de
www.google.de
215 B
2 google.com
www.google.com
217 B
2 facebook.com
www.facebook.com
542 B
2 useproof.com
cdn.useproof.com
487 KB
2 facebook.net
connect.facebook.net
92 KB
2 ubembed.com
a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com
assets.ubembed.com
47 KB
2 whoisvisiting.com
app.whoisvisiting.com
dashboard.whoisvisiting.com
2 KB
2 bing.com
bat.bing.com
9 KB
2 marketo.net
munchkin.marketo.net
7 KB
2 licdn.com
snap.licdn.com
3 KB
2 crazyegg.com
script.crazyegg.com
2 KB
2 wistia.com
fast.wistia.com
176 KB
2 optimizely.com
cdn.optimizely.com
logx.optimizely.com
92 KB
1 atdmt.com
cx.atdmt.com
344 B
1 voltn.com
pixel.voltn.com
513 B
1 amazonaws.com
addshoppers.s3.amazonaws.com
5 KB
1 mktoresp.com
395-qpj-712.mktoresp.com
311 B
1 consensu.org
d.adroll.mgr.consensu.org
137 B
1 acsbap.com
acsbap.com
85 B
1 upsellit.com
www.upsellit.com
10 KB
1 googleadservices.com
www.googleadservices.com
12 KB
1 googletagmanager.com
www.googletagmanager.com
58 KB
1 googleapis.com
fonts.googleapis.com
1 KB
84 34
Domain Requested by
13 labs.vipre.com labs.vipre.com
6 fonts.gstatic.com fonts.googleapis.com
5 s.adroll.com 1 redirects www.googletagmanager.com
labs.vipre.com
s.adroll.com
5 app-sj08.marketo.com labs.vipre.com
app-sj08.marketo.com
4 shop.pe 1 redirects d3rr3d0n31t48m.cloudfront.net
shopper.shop.pe
4 ui.powerreviews.com labs.vipre.com
ui.powerreviews.com
3 d3rr3d0n31t48m.cloudfront.net labs.vipre.com
shop.pe
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 shopper.shop.pe shop.pe
d3rr3d0n31t48m.cloudfront.net
2 cdn.acsbapp.com acsbap.com
2 www.google.de labs.vipre.com
2 www.google.com labs.vipre.com
2 www.facebook.com 1 redirects labs.vipre.com
2 px.ads.linkedin.com 1 redirects labs.vipre.com
2 acsbapp.com 1 redirects labs.vipre.com
2 cdn.useproof.com www.googletagmanager.com
cdn.useproof.com
2 connect.facebook.net labs.vipre.com
connect.facebook.net
2 bat.bing.com labs.vipre.com
2 munchkin.marketo.net labs.vipre.com
munchkin.marketo.net
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 10000302.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
2 fast.wistia.com labs.vipre.com
1 cx.atdmt.com
1 pixel.voltn.com
1 addshoppers.s3.amazonaws.com d3rr3d0n31t48m.cloudfront.net
1 logx.optimizely.com cdn.optimizely.com
1 395-qpj-712.mktoresp.com munchkin.marketo.net
1 stats.g.doubleclick.net www.google-analytics.com
1 assets.ubembed.com a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com
1 dashboard.whoisvisiting.com labs.vipre.com
1 d.adroll.com labs.vipre.com
1 d.adroll.mgr.consensu.org 1 redirects
1 www.linkedin.com 1 redirects
1 googleads.g.doubleclick.net www.googleadservices.com
1 acsbap.com 1 redirects
1 a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com www.googletagmanager.com
1 app.whoisvisiting.com labs.vipre.com
1 www.upsellit.com www.googletagmanager.com
1 www.googleadservices.com www.googletagmanager.com
1 www.googletagmanager.com labs.vipre.com
1 fonts.googleapis.com labs.vipre.com
1 cdn.optimizely.com labs.vipre.com
84 43

This site contains links to these domains. Also see Links.

Domain
www.vipre.com
partners.vipre.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
Subject Issuer Validity Valid
*.vipre.com
DigiCert SHA2 High Assurance Server CA		 2020-06-03 -
2021-06-07		 a year crt.sh
cdn.optimizely.com
DigiCert SHA2 Secure Server CA		 2020-01-20 -
2021-03-20		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
app-sj08.marketo.com
Cloudflare Inc ECC CA-3		 2020-07-04 -
2021-07-04		 a year crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-23 -
2021-05-07		 6 months crt.sh
*.powerreviews.com
Amazon		 2020-03-24 -
2021-04-24		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-06-09 -
2021-06-09		 a year crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2020-01-29 -
2021-04-29		 a year crt.sh
*.upsellit.com
Sectigo RSA Domain Validation Secure Server CA		 2020-07-30 -
2022-11-01		 2 years crt.sh
*.doubleclick.net
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2019-04-01 -
2021-05-07		 2 years crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2020-03-14 -
2021-04-13		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2020-10-27 -
2021-04-27		 6 months crt.sh
*.whoisvisiting.com
RapidSSL RSA CA 2018		 2020-05-21 -
2021-08-20		 a year crt.sh
z.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-09-02 -
2021-04-23		 8 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-11-02 -
2021-01-30		 3 months crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2020-05-26 -
2021-04-21		 a year crt.sh
*.acsbapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-10-05 -
2021-10-05		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2020-08-05 -
2021-02-05		 6 months crt.sh
adroll.mgr.consensu.org
Amazon		 2020-10-08 -
2021-11-07		 a year crt.sh
assets.ubembed.com
Amazon		 2020-04-04 -
2021-05-04		 a year crt.sh
www.google.com
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-11-03 -
2021-01-26		 3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh
logx.optimizely.com
Amazon		 2020-09-21 -
2021-10-21		 a year crt.sh
*.shop.pe
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-08-03 -
2021-10-02		 a year crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2019-11-09 -
2021-03-12		 a year crt.sh
*.voltn.com
Amazon		 2020-07-04 -
2021-08-04		 a year crt.sh
*.atlassolutions.com
DigiCert SHA2 High Assurance Server CA		 2020-10-10 -
2021-01-08		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Frame ID: 7BDB6CBA1B1B9CFE431E9EC133331652
Requests: 98 HTTP requests in this frame

Frame: https://10000302.fls.doubleclick.net/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F
Frame ID: 6C2025C00B2A213EE5347935EFD9345C
Requests: 1 HTTP requests in this frame

Frame: https://app-sj08.marketo.com/index.php/form/XDFrame
Frame ID: 4D8D509B6A12ADF84FF8B4F5A21D1AEF
Requests: 1 HTTP requests in this frame

Frame: https://cdn.useproof.com/proxy/index.html
Frame ID: 6A75E672F0CD0B576FFB03F505D525AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • script /ubembed\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
Overall confidence: 100%
Detected patterns
  • script /script\.crazyegg\.com\/pages\/scripts\/\d+\/\d+\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • script /munchkin\.marketo\.net\/munchkin\.js/i
Overall confidence: 100%
Detected patterns
  • script /optimizely\.com.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

84
Requests

100 %
HTTPS

51 %
IPv6

34
Domains

43
Subdomains

39
IPs

7
Countries

1909 kB
Transfer

5200 kB
Size

12
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50
  • https://10000302.fls.doubleclick.net/activityi;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F HTTP 302
  • https://10000302.fls.doubleclick.net/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F
Request Chain 58
  • https://shop.pe/widget/widget_async.js HTTP 301
  • https://d3rr3d0n31t48m.cloudfront.net/widget/widget_async.js
Request Chain 60
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/dist/js/app.js
Request Chain 69
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2063033%26time%3D1607375955108%26url%3Dhttps%253A%252F%252Flabs.vipre.com%252Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&liSync=true
Request Chain 70
  • https://s.adroll.com/j/exp/ESJ2X6GGN5HYFFSTTXOYYI/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 72
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/ESJ2X6GGN5HYFFSTTXOYYI?_s=23c4f33a126ce537143356cf8c1aba53&_b=2 HTTP 302
  • https://d.adroll.com/consent/check/ESJ2X6GGN5HYFFSTTXOYYI/?_s=23c4f33a126ce537143356cf8c1aba53&_b=2
Request Chain 98
  • https://www.facebook.com/tr/?id=512751002923851&ev=Microdata&dl=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&rl=&if=false&ts=1607375956824&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.29&r=stable&ec=1&o=30&fbp=fb.1.1607375955317.1609150967&it=1607375955056&coo=false&es=automatic&tm=3&rqm=GET HTTP 302
  • https://cx.atdmt.com/?c=10196739726377870998&f=AYwWhntzD91I51DnDH_md2fv1_qCTsCc90Zcrm44nIPsNJvBu49F_QpLpW04miEsJf4X0bSUMO5D6MebdYMN2PDU&id=512751002923851&l=3&v=0

84 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/ 		81 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx / WP Engine
Resource Hash
b04dd5b560e76bb97ad6f436281dcd18f043149cdea86a58739370771cdf5a69

Request headers

:method
GET
:authority
labs.vipre.com
:scheme
https
:path
/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx
date
Mon, 07 Dec 2020 21:19:13 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-pingback
https://labs.vipre.com/xmlrpc.php
link
<https://labs.vipre.com/wp-json/>; rel="https://api.w.org/" <https://labs.vipre.com/wp-json/wp/v2/posts/1654>; rel="alternate"; type="application/json" <https://labs.vipre.com/?p=1654>; rel=shortlink
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 1
x-cache-group
normal
content-encoding
br
8335380191.js
cdn.optimizely.com/js/ 		290 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.optimizely.com/js/8335380191.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:1700:793::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08f0faf5f17b15bfa9ff3c200a3940071eed877759930239429c66ca5c9f54f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-meta-pci_enabled
False
x-amz-version-id
5w7v3yunG9AOnTo_0N7CiF8xbISZAnGQ
content-encoding
gzip
etag
"02a2a67c36c81a1ab623bb67b3473399"
x-amz-request-id
E322044DBAAD086E
x-amz-meta-revision
121
x-amz-replication-status
COMPLETED
access-control-allow-methods
GET, HEAD
server-timing
cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="2a02:26f0:1700:793::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
vary
Accept-Encoding
content-length
92679
x-amz-id-2
KXzRtctbZCX0eg1yOfuIs3RUIzHbe26PQDMXgRJLEFBI0wMu7Hp1Jr0K5bRSKUgxMhNnNxRAIEI=
last-modified
Wed, 01 May 2019 16:07:50 GMT
server
AmazonS3
date
Mon, 07 Dec 2020 21:19:14 GMT
access-control-max-age
86400
strict-transport-security
max-age=15768000
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
x-amz-meta-revision
cache-control
max-age=120
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
*
autoptimize_096917493107f66a51c7a7e9df923a79.css
labs.vipre.com/wp-content/cache/autoptimize/css/ 		200 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
085da638271d8cd369f0c90b979ed7a1c3a507621fca7f075c82164b88246221

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Wed, 28 Oct 2020 21:59:52 GMT
server
nginx
etag
W/"5f99e9d8-31fe9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.js
labs.vipre.com/wp-includes/js/jquery/ 		95 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Fri, 17 May 2019 04:25:54 GMT
server
nginx
etag
W/"5cde37d2-17a69"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
css
fonts.googleapis.com/ 		14 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e61496657fc678ced466ebc453954193f1567f5ddc885d954c1c16e3aba7b259
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 07 Dec 2020 21:19:13 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
date
Mon, 07 Dec 2020 21:19:13 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Mon, 07 Dec 2020 21:19:13 GMT
forms2.min.js
app-sj08.marketo.com/js/forms2/js/ 		205 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app-sj08.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
age
5588
etag
"1a1061-33245-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
5fe148a148e9736f-CPH
cf-request-id
06e0abb8cc0000736f60085000000001
expires
Tue, 08 Dec 2020 01:19:14 GMT
popover-v1.js
fast.wistia.com/assets/external/ 		202 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fast.wistia.com/assets/external/popover-v1.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::622 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f4cc9128228efce67040a69f0f4eb3878e06ad6c46f1071f00f487e4d20f5188
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:13 GMT
content-encoding
br
vary
Accept-Encoding
age
2758
x-cache
HIT, HIT
content-length
57871
x-served-by
cache-dca17757-DCA, cache-fra19148-FRA
access-control-allow-origin
*
x-browser-version
83
last-modified
Fri, 04 Dec 2020 20:13:50 GMT
x-timer
S1607375954.978304,VS0,VE0
etag
"5fca987e-e20f"
strict-transport-security
max-age=0
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=3600
x-browser
chrome
x-ecma-v
modern
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 8
E-v1.js
fast.wistia.com/assets/external/ 		661 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fast.wistia.com/assets/external/E-v1.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::622 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
00701587779185984cb4a771f1e8f42235fce12820077aeb94d9d75111305e4c
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
vary
Accept-Encoding
age
2757
x-cache
HIT, HIT
content-length
121862
x-served-by
cache-dca17766-DCA, cache-fra19148-FRA
access-control-allow-origin
*
x-browser-version
83
last-modified
Fri, 04 Dec 2020 20:13:50 GMT
x-timer
S1607375954.201553,VS0,VE0
etag
"5fca987e-1dc06"
strict-transport-security
max-age=0
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=3600
x-browser
chrome
x-ecma-v
modern
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
1, 369
ui.js
ui.powerreviews.com/stable/4.0/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ui.powerreviews.com/stable/4.0/ui.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:a400:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
87e0e2f7898e1262a6e0293642329d4f31425279099a1cf01788b243e177ede8

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:13:36 GMT
content-encoding
gzip
age
338
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Mon, 07 Dec 2020 21:13:27 GMT
server
AmazonS3
etag
W/"1f59576d484bcb3b316454eeeeed96a1"
vary
Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
application/javascript
via
1.1 6def1f0ddc805dce17407cce01d5b32d.cloudfront.net (CloudFront)
access-control-expose-headers
x-amz-meta-unpublished-reviews
cache-control
max-age=1800,s-maxage=604800000
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
vgsJN0AdBkewYBpRHN0C68DRPQraw1Di1gV_X4Kz_rCXJMMfzlQ7kg==
lazysizes.min.js
labs.vipre.com/wp-content/plugins/autoptimize/classes/external/js/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/wp-content/plugins/autoptimize/classes/external/js/lazysizes.min.js?ao_version=2.7.8
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
57135994acd82a57e8341534e7056af792a0b3a82415e67846dc914a1727308b

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Wed, 28 Oct 2020 21:56:33 GMT
server
nginx
etag
W/"5f99e911-2532"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
autoptimize_881eccd761c86ba36903c315658685e5.js
labs.vipre.com/wp-content/cache/autoptimize/js/ 		182 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/wp-content/cache/autoptimize/js/autoptimize_881eccd761c86ba36903c315658685e5.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8d0622453e0c21720c18a3b1433fc9a1a31bb1ba551396e3bcadb7acf308ea8e

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Wed, 02 Dec 2020 15:30:53 GMT
server
nginx
etag
W/"5fc7b32d-2d826"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
gtm.js
www.googletagmanager.com/ 		187 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
140f954c04037e14199dee6a54f59f7f12c5cdf8cd9c81a00729cb709c81539a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59534
x-xss-protection
0
last-modified
Mon, 07 Dec 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 07 Dec 2020 21:19:14 GMT
wp-emoji-release.min.js
labs.vipre.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://labs.vipre.com/wp-includes/js/wp-emoji-release.min.js?ver=5.5.3
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Mon, 15 Jun 2020 18:04:26 GMT
server
nginx
etag
W/"5ee7b82a-37a6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Dec 2020 20:05:05 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
522849
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11180
x-xss-protection
0
expires
Wed, 01 Dec 2021 20:05:05 GMT
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
32089c6aa880034ed6988ac3bab0ad5d8c0bd35db7625087d3f961834c551072

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
900c0cd798c079cdd52466a463dfc9b9246d9812636acf9f484a6d7b17634304

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2a0aa1f4590fc175eda4227b646d4b633fdab4b3a5c9918026c13a3783770aa

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
255c2972228b5228aed30839328ba2dfc92efc81d2e0714fff22b3e3b3835771

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
47c5813a078b3be8d09a4b1ed252250d33af26aea3da8dc6d882f93eade568be

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		67 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9e3b38d88a59a026857eea336e09870e67903f2d86116a0300ba79274553486a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ea091d055be1ad53ef15f646982266b36289effe2db2a8b5571e9a77e1f705e8

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		67 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34a88dc83dd8962a9a843eb78397c2c6b7a649f0e9c56e4c83e6213b9aa10172

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6400401ab417128e44a90138effb24a370c40e16514aa44ff411a0c4fdb114be

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b62ee7e5b5842b34374f49f945adb5aa9a5391856279df528dfb87e304a37e06

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
774075868ec171a5e9c551d2d20b88f0e8ac8854f9bc68d453dc706180f43fb9

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0da8612888212ee4fabca7bb0ffc47a8cf4119ee0cd3b1de359379f18fcadbd2

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76fe7821b32e9181245808c9502fd73dab42ae3199fd7ce3a9b32e8c55bc2b6a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
253d988f1fd4575f10e577e74e5b0983b4ebc5cdd5a16d86bd5cd1621d994c65

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
604c6bc37d067dd4659947fb36e21a49f88183e17340bdf434e21d51f6290e6a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
icn-close-2x.png
labs.vipre.com/wp-content/themes/vipre/img/icons/ 		634 B
835 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/themes/vipre/img/icons/icn-close-2x.png
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
d8abdaa133e093b8eda13b82bb9965d67b69dff79163137c8e35c965fa887bfc

Request headers

Referer
https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
last-modified
Wed, 19 Dec 2018 06:37:31 GMT
server
nginx
etag
"5c19e72b-27a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
634
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5620fd3acd4874ee2d86b7cc4ac77997940fb53e8faf51aa640573805c71cfce

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
icn-text-grey-2x.png
labs.vipre.com/wp-content/themes/vipre/img/icons/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/themes/vipre/img/icons/icn-text-grey-2x.png
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3da8fa46e703d4318a9b59be4bfbaca7380614373eebadb4c6e3d31276ca016f

Request headers

Referer
https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
last-modified
Wed, 19 Dec 2018 06:37:31 GMT
server
nginx
etag
"5c19e72b-70e"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
1806
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 02 Dec 2020 21:21:15 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
431879
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11016
x-xss-protection
0
expires
Thu, 02 Dec 2021 21:21:15 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Dec 2020 11:20:38 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
age
208716
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11056
x-xss-protection
0
expires
Sun, 05 Dec 2021 11:20:38 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 20:01:12 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
350282
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11020
x-xss-protection
0
expires
Fri, 03 Dec 2021 20:01:12 GMT
KFOjCnqEu92Fr1Mu51TjASc6CsTYl4BO.woff2
fonts.gstatic.com/s/roboto/v20/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TjASc6CsTYl4BO.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4c575d67f22342308c6bdc002dce3d2bf2eb03c3434846dd8aeb4b2b74b43d43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Dec 2020 11:22:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:39 GMT
server
sffe
age
208634
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12824
x-xss-protection
0
expires
Sun, 05 Dec 2021 11:22:00 GMT
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://labs.vipre.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,700,700i
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Dec 2020 11:20:45 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
age
208709
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12680
x-xss-protection
0
expires
Sun, 05 Dec 2021 11:20:45 GMT
stable-4.0-version.json
ui.powerreviews.com/ 		11 B
612 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ui.powerreviews.com/stable-4.0-version.json
Requested by
Host: ui.powerreviews.com
URL: https://ui.powerreviews.com/stable/4.0/ui.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:a400:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2526a17a054b49558a4e09ebb89751a57c96db462bbf6e1e547cc44dad956053

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
via
1.1 d947c3ab534102b2c9a7f0a4541d2ed9.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-amz-meta-unpublished-reviews
227370833,227338221,220779200,275853368
content-length
11
last-modified
Mon, 07 Dec 2020 21:13:34 GMT
server
AmazonS3
etag
"0b3ed6c82de14b6dd2559e9002dea93c"
vary
Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-amz-meta-unpublished-reviews
cache-control
max-age=1800,s-maxage=0
accept-ranges
bytes
x-amz-cf-id
hpV3Y4mp5x5Glsku4iKlUeJRDB8EVLPHt78nHXPyzLSYcmavtMDqNA==
getForm
app-sj08.marketo.com/index.php/form/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app-sj08.marketo.com/index.php/form/getForm?munchkinId=395-QPJ-712&form=1355&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&callback=jQuery112409966421305161461_1607375954452&_=1607375954453
Requested by
Host: app-sj08.marketo.com
URL: https://app-sj08.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e53f75975af7b4603afb5f458599e99ecc1139da6a44252133faf29d4d98ca77

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-request-id
06e0abbb600000736fc8b04000000001
content-encoding
gzip
server
cloudflare
date
Mon, 07 Dec 2020 21:19:14 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
5fe148a56e10736f-CPH
cached
true
icn-select-arrows.svg
labs.vipre.com/wp-content/themes/vipre/img/icons/ 		2 KB
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/themes/vipre/img/icons/icn-select-arrows.svg
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4c6fdf6aa944c9d4da9e125526554e997ed88eab41f777f3b23f368771c6cbf1

Request headers

Referer
https://labs.vipre.com/wp-content/cache/autoptimize/css/autoptimize_096917493107f66a51c7a7e9df923a79.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
last-modified
Wed, 19 Dec 2018 06:37:31 GMT
server
nginx
etag
W/"5c19e72b-80e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
styles.css
ui.powerreviews.com/tag-builds/10107/4.0/ 		391 KB
52 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ui.powerreviews.com/tag-builds/10107/4.0/styles.css
Requested by
Host: ui.powerreviews.com
URL: https://ui.powerreviews.com/stable/4.0/ui.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:a400:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06be348681ad1ebe5bc5f417c57b8a22b9d02fda686a9bdfcd759c6cec06a36e

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:13:36 GMT
content-encoding
gzip
age
338
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Mon, 07 Dec 2020 21:13:22 GMT
server
AmazonS3
etag
W/"7780c74888d500f8dcf8a4521930f4e3"
vary
Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
text/css
via
1.1 6def1f0ddc805dce17407cce01d5b32d.cloudfront.net (CloudFront)
access-control-expose-headers
x-amz-meta-unpublished-reviews
cache-control
max-age=604800000
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
lFOLUMfrQ_Fy6LS47r4dyEO_TFtrnTIhpUBkXw3Ptsu39SiqelXQBw==
category.engine.js
ui.powerreviews.com/tag-builds/10107/4.0/ 		378 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ui.powerreviews.com/tag-builds/10107/4.0/category.engine.js
Requested by
Host: ui.powerreviews.com
URL: https://ui.powerreviews.com/stable/4.0/ui.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:a400:4:41b4:a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bfd7b2f9a3a44bc1b4add2306a9a70b9f328cb03b461c3588706b15ca8299e2a

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:13:37 GMT
content-encoding
gzip
age
338
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Mon, 07 Dec 2020 21:13:22 GMT
server
AmazonS3
etag
W/"40e057ef974454af79916914f072610c"
vary
Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET, PUT, POST, DELETE, HEAD
content-type
application/javascript
via
1.1 6def1f0ddc805dce17407cce01d5b32d.cloudfront.net (CloudFront)
access-control-expose-headers
x-amz-meta-unpublished-reviews
cache-control
max-age=604800000
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
9oqztqRYEiqeDtow3phid8gK9i0eUvzP7JcE_jDSKHKkrNkoUcS5aQ==
vipre-logo-white-2x.png
labs.vipre.com/wp-content/themes/vipre/img/layout/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/themes/vipre/img/layout/vipre-logo-white-2x.png
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a4908c453b78e1eee958010159fa9d2ed53092bb5e889d2299d17a5815d50973

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
last-modified
Wed, 19 Dec 2018 06:37:32 GMT
server
nginx
etag
"5c19e72c-7ff"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
2047
AdobeStock_377527359-1980x1005.jpeg
labs.vipre.com/wp-content/uploads/2020/12/ 		97 KB
98 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/uploads/2020/12/AdobeStock_377527359-1980x1005.jpeg
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
891254e3a92096e153262505de507b2ba0bfe3721eadcce2bf6e64b4a2070e3c

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
last-modified
Wed, 02 Dec 2020 15:24:42 GMT
server
nginx
etag
"5fc7b1ba-1854c"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
99660
1.png
labs.vipre.com/wp-content/uploads/2020/12/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/uploads/2020/12/1.png
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0e5357f8586b85978df0adf186b55dd1a4b05fdd20fb7bd366d84d5c2714e448

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
last-modified
Wed, 02 Dec 2020 11:32:03 GMT
server
nginx
etag
"5fc77b33-27c9"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10185
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
1764
date
Mon, 07 Dec 2020 20:49:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 07 Dec 2020 22:49:50 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f162.1e100.net
Software
cafe /
Resource Hash
5fb46ad88af0181f8aa600691dadedc2d6dd1946603b69bc36385f68efdd01a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
12174
x-xss-protection
0
server
cafe
etag
1959326039972715456
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 07 Dec 2020 21:19:14 GMT
3221.js
script.crazyegg.com/pages/scripts/0018/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0018/3221.js?446493
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee88faa9bcae7fdb37831ea89db4d289957aada4ae14dbf66d6fc06fbfc2cf3d

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
cf-cache-status
HIT
age
274556
cf-polished
origSize=2833
ce-version
11.1.167
cf-request-id
06e0abbbfa000024842a1aa000000001
last-modified
Fri, 04 Dec 2020 17:03:18 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
cf-ray
5fe148a65e2e2484-FRA
cf-bgj
minify
roundtrip.js
s.adroll.com/j/ 		39 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
383e5f611a5c1637137d721c623842d4ad37fbb609e726a0a086b8fdd4c481cb

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
yT2i2LUnffbkUbjAt0k2siAlAt3lg4XR
Content-Encoding
gzip
ETag
"28571dc94738b2d5c8135d1bc9804d74"
x-amz-request-id
D8CA31517EEFF851
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
12463
x-amz-id-2
PkdqUa7SG6Ah0SpKR1grFBRfosBP1h3P1ltrX3Wcyf1SBZYz90A7rCkQce7e5vNXvQZTeFm3u8g=
Last-Modified
Wed, 02 Dec 2020 20:32:00 GMT
Server
AmazonS3
Date
Mon, 07 Dec 2020 21:19:15 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
vipre2.jsp
www.upsellit.com/active/ 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.upsellit.com/active/vipre2.jsp
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.118.62.69 , United States, ASN7296 (ALCHEMYNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ad26a680f19316aa0091fe6acd6c564e04a28c91311a9918532faacef298ce14

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-encoding
gzip
expires
Tue, 08 Dec 2020 21:19:15 GMT
server
nginx
cache-control
max-age=86400
content-type
application/x-javascript;charset=ISO-8859-1
activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccin...
10000302.fls.doubleclick.net/ Frame 6C20
Redirect Chain
  • https://10000302.fls.doubleclick.net/activityi;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vac...
  • https://10000302.fls.doubleclick.net/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs....
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://10000302.fls.doubleclick.net/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
10000302.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 07 Dec 2020 21:19:15 GMT
expires
Mon, 07 Dec 2020 21:19:15 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
782
x-xss-protection
0
set-cookie
IDE=AHWqTUkjij8yXjG3Y9MtsHKpkzoEVng-AxsfBTdW8LHCR2zqniv8IB9_FSli712U; expires=Sat, 01-Jan-2022 21:19:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 07 Dec 2020 21:19:15 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://10000302.fls.doubleclick.net/activityi;dc_pre=CN3fy4bmvO0CFQviuwgd4cEIRw;src=10000302;type=counter;cat=vipre0;ord=9664367328119;gtm=2wgb41;auiddc=386525121.1607375955;u1=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F;~oref=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
insight.min.js
snap.licdn.com/li.lms-analytics/ 		965 B
761 B 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:3b4::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Sep 2020 22:01:48 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=66867
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
448
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.236.192 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-236-192.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Aug 2020 03:11:00 GMT
Server
AkamaiNetStorage
ETag
"a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
bat.js
bat.bing.com/ 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
last-modified
Tue, 20 Oct 2020 22:19:32 GMT
x-msedge-ref
Ref A: 412738CDA257410A94C8D1E817410EA3 Ref B: FRAEDGE1408 Ref C: 2020-12-07T21:19:14Z
etag
"0b27f152fa7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8454
who.js
app.whoisvisiting.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.whoisvisiting.com/who.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.43.144.18 Potters Bar, United Kingdom, ASN199766 (SOVEREIGN, GB),
Reverse DNS
www.sovereign-plc.co.uk
Software
Microsoft-IIS/10.0 / ASP.NET, ARR/3.0, ASP.NET
Resource Hash
ec640474b4d3e2fde3ed0313aa5cd0f180cbf721220df37f4c009c8e4851d848

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
last-modified
Wed, 29 Apr 2020 13:29:28 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET, ARR/3.0, ASP.NET
vary
Accept-Encoding
content-type
application/javascript
content-length
1140
/
a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com/ 		478 B
614 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com/
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.131 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
068e8764f6d16aeee8879cd61430fd0682ba4c8984503cbe5d0f9870a3d80b4e

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-encoding
br
x-backend-region
eu_west_1
age
0
etag
8f1ef2662b6501c35fd611273416d017-v0.178.1
vary
Accept-Encoding, Referer
x-cache
Miss from cloudfront, MISS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate
x-amz-cf-pop
FRA2-C1
accept-ranges
none
x-amz-apigw-id
XM1c_Gh5joEFS5w=
fbevents.js
connect.facebook.net/en_US/ 		89 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23320
x-xss-protection
0
pragma
public
x-fb-debug
DarVfGXBQ68I6jsTIBxhyauqPOtmz6EcaOnm2MJW0B0cjbhZSw15itq45ALAOpHWMn7C4ifVcXTOxxAhEHFfpQ==
x-fb-trip-id
603378373
x-frame-options
DENY
date
Mon, 07 Dec 2020 21:19:14 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
proof.js
cdn.useproof.com/ 		486 KB
487 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.useproof.com/proof.js?acc=jssB2vsshsRv3xk6vcXe7DJAWqg2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TG6TP7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::681b:8757 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
418614329e831c01f8232ddf31feefe6f63c6b52b9c6cbdd5bd5ac314540cfaf

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1496562
cf-ray
5fe148a6ac8efca9-VIE
content-length
497733
x-amz-id-2
eM9YBYd20gImhKXw0mws4eYQKfNBpWBCEeSGdUUkXu9FaL40y7g8cG3J5DS8wWVvCgKV3pwFZ8A=
last-modified
Mon, 29 Jun 2020 14:15:25 GMT
server
cloudflare
etag
"0426397a9b31146729ac86c5be8595d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GvyKt0nFRD%2FGujfYqIK8n%2FrovJSae6%2BYHgGZXtQ6SCd4hiGQ9g68UFj6gSYSIjEcSvuC2IlEJ3JjGmKOWZ%2FpnZ%2BuvDLNX4hdP8W8UtqD9Vam1Y%2BGYYauJHpofkWC"}],"group":"cf-nel","max_age":604800}
x-amz-request-id
32E7C0843006D981
cache-control
public, max-age=315360000, no-transform
x-amz-version-id
F0WxJo6k6ZqSk5t4_qZ.mqlg1RkwiqAq
cf-request-id
06e0abbc2c0000fca9508fb000000001
accept-ranges
bytes
content-type
application/javascript
widget_async.js
d3rr3d0n31t48m.cloudfront.net/widget/
Redirect Chain
  • https://shop.pe/widget/widget_async.js
  • https://d3rr3d0n31t48m.cloudfront.net/widget/widget_async.js
2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d3rr3d0n31t48m.cloudfront.net/widget/widget_async.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.43 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dd51ded0357742a058927c3bff47e4f9fbc3fa66befa33e5ed2eb92bc0ea0859

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:15:22 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 04:13:35 GMT
server
AmazonS3
age
234
etag
"1b21b8846edb6a4f2c2a7473e8efb685"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 b75b06741e5146585057681bd60737b3.cloudfront.net (CloudFront)
cache-control
max-age=3600, public
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
898
x-amz-cf-id
UijeE44FZfVY95oxQZ3cP64q39Arkrc8vqx1n48FnlERrZOlLaWx8Q==
x-amz-meta-mtime
1605068014.04

Redirect headers

content-security-policy
frame-ancestors none;
via
1.1 google
referrer-policy
no-referrer-when-downgrade
server
nginx
date
Mon, 07 Dec 2020 21:19:15 GMT
x-frame-options
deny
content-type
text/html
location
https://d3rr3d0n31t48m.cloudfront.net/widget/widget_async.js
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
clear
content-length
178
roundtrip.js
s.adroll.com/j/ESJ2X6GGN5HYFFSTTXOYYI/ 		44 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/ESJ2X6GGN5HYFFSTTXOYYI/roundtrip.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e1b579c9ab7a15e830328fa75ade297d181144a174a617b0690b64723f0dde56

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
y1Y.0gwGLnB3iOY6xY_a8fc4bVbERMXp
Content-Encoding
gzip
ETag
"b763f9f6b7644483febcdd134c2fd8d4"
x-amz-request-id
FC0824F56E7260B7
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
13351
x-amz-id-2
g811TpbV0AzrXkRfOjdod/XgEoIwuxhPjxEFDbeNF3c1wUeO5XgBIAETrYeidBaLdeXZcj2mFZo=
Last-Modified
Sun, 06 Dec 2020 21:00:37 GMT
Server
AmazonS3
Date
Mon, 07 Dec 2020 21:19:15 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
app.js
acsbapp.com/apps/app/dist/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/dist/js/app.js
460 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acsbapp.com/apps/app/dist/js/app.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.172.136.187 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibeapp01.jetserver.net
Software
/
Resource Hash
36075450538c95fbd0aa9211ee15de5ea0c2d24373e14cc10bff02bb48739725

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-encoding
br
last-modified
Mon, 07 Dec 2020 20:58:04 GMT
etag
"72fb3-5fce975c-19541f7cf5059876;br"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
105538
expires
Tue, 08 Dec 2020 21:19:15 GMT

Redirect headers

location
https://acsbapp.com/apps/app/dist/js/app.js
date
Mon, 07 Dec 2020 21:19:15 GMT
content-length
706
content-type
text/html
forms2.css
app-sj08.marketo.com/js/forms2/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app-sj08.marketo.com/js/forms2/css/forms2.css
Requested by
Host: app-sj08.marketo.com
URL: https://app-sj08.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1401
content-length
2623
cf-request-id
06e0abbc210000736f600b2000000001
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
etag
"1a1053-3437-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5fe148a69f7f736f-CPH
expires
Tue, 08 Dec 2020 01:19:14 GMT
forms2-theme-simple.css
app-sj08.marketo.com/js/forms2/css/ 		826 B
368 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app-sj08.marketo.com/js/forms2/css/forms2-theme-simple.css
Requested by
Host: app-sj08.marketo.com
URL: https://app-sj08.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2762
content-length
242
cf-request-id
06e0abbc210000736f5f920000000001
last-modified
Mon, 12 Oct 2020 17:13:35 GMT
server
cloudflare
etag
"204c9-33a-5b17c6b21edc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5fe148a69f80736f-CPH
expires
Tue, 08 Dec 2020 01:19:14 GMT
insight.beta.min.js
snap.licdn.com/li.lms-analytics/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:3b4::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Sep 2020 22:01:48 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=33367
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1799
js
www.google-analytics.com/gtm/ 		87 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-5ZZL6CQ&t=gtm2&cid=1751551015.1607375955
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ace3cdafd2069d2603d2fa7c522da3773f6d88d77803ec40873b3d94e1b5601e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:14 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34930
x-xss-protection
0
expires
Mon, 07 Dec 2020 21:19:14 GMT
0
bat.bing.com/action/ 		0
148 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=5060757&Ver=2&mid=775b34ef-a453-4c44-a45e-3ab35f680f67&sid=dbb62e5038d111eb9d7a93a0340f9f84&vid=dbb6530038d111eb8ba447f692ea680c&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&p=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&r=&lt=1438&evt=pageLoad&msclkid=N&sv=1&rn=644410
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Mon, 07 Dec 2020 21:19:14 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 3125526DD34C41F7884CFCFFEC058327 Ref B: FRAEDGE1408 Ref C: 2020-12-07T21:19:15Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
512751002923851
connect.facebook.net/signals/config/ 		241 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/512751002923851?v=2.9.29&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a1cc8631454e856c4f8764e4dc659a31437de48f98b0de45c5a56ad08362c38c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
yf1SlH4Cu9CA0sUQdyi9jEyZ4PoRkSJIGaCed5J2DZfuDrXEQu4fR2HNbs1CJlTw6DY7KkAcSQFE7fQ9RodH2Q==
x-fb-trip-id
603378373
x-frame-options
DENY
date
Mon, 07 Dec 2020 21:19:15 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-content-id
1637178716
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/997035993/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/997035993/?random=1607375955104&cv=9&fst=1607375955104&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&tiba=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4009:809::2002 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c7fd14e5d979c014ad04543e5d24aa9bb198180e181194eca5781fd1effd2463
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1085
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
3221.json
script.crazyegg.com/pages/data-scripts/0018/ 		558 B
587 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/data-scripts/0018/3221.json?t=5357919
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0018/3221.js?446493
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d4020e8836d5f24cd11641fc99c6efb46b2d523f585840a4445ebe2c6ede5f3

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-encoding
gzip
cf-cache-status
HIT
age
274557
ce-version
11.1.167
content-length
225
cf-request-id
06e0abbcb50000d6e964814000000001
last-modified
Fri, 04 Dec 2020 17:03:18 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
5fe148a78a2cd6e9-FRA
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2063033%26time%3D1607375955108%26url%3Dhttps%253A%252F%252Flabs.vipre.com%252Fmal...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&liSync=true
0
57 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&liSync=true
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-tln1
content-type
application/javascript
content-length
0
x-li-uuid
ZKlMUuqLThaw2m2KPysAAA==

Redirect headers

content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options
nosniff
linkedin-action
1
content-length
0
x-li-uuid
5DhqSuqLThagifl+VCsAAA==
pragma
no-cache
x-li-pop
afd-prod-esv5
x-msedge-ref
Ref A: 8D458E3BB10F45D88C418151CB20DF76 Ref B: FRAEDGE1512 Ref C: 2020-12-07T21:19:15Z
x-frame-options
sameorigin
date
Mon, 07 Dec 2020 21:19:15 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2063033&time=1607375955108&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ESJ2X6GGN5HYFFSTTXOYYI/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
NRd5BJy3mTVGILCcmBdUI4KKHh2sq935
Content-Encoding
gzip
ETag
"5816cced8568d223aa09d889f300692b"
x-amz-request-id
7W9WAWDN1PDJ9K6T
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
48
x-amz-id-2
NBvratIHE//44TPOypShMaCv/9QzRoRblXgrQhIlv+9B2ymzS7rKcZPf7Q+NJ4aV6oOIl9m1JcE=
Last-Modified
Wed, 02 Dec 2020 20:19:48 GMT
Server
AmazonS3
Date
Mon, 07 Dec 2020 21:19:15 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*

Redirect headers

Date
Mon, 07 Dec 2020 21:19:15 GMT
Server
AkamaiGHost
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
0
index.js
s.adroll.com/j/pre/ESJ2X6GGN5HYFFSTTXOYYI/OUMY2VLQDFDJ7KNSOR3PWX/ 		0
773 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/ESJ2X6GGN5HYFFSTTXOYYI/OUMY2VLQDFDJ7KNSOR3PWX/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
LYZ59h9r0x4qiak2rczMOLKs6HPU1bJF
Content-Encoding
gzip
ETag
"d41d8cd98f00b204e9800998ecf8427e"
x-amz-request-id
50780FD8CDA2FD2D
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
20
x-amz-id-2
a3Drc4DzU5xfRwV0Fh9ZQZXZHt/TL5JfNeQn3sJEALLcOXANkKFKgkH0CIobZbiwFCfnXRDzH9g=
Last-Modified
Sun, 06 Dec 2020 20:43:20 GMT
Server
AmazonS3
Date
Mon, 07 Dec 2020 21:19:15 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
/
d.adroll.com/consent/check/ESJ2X6GGN5HYFFSTTXOYYI/
Redirect Chain
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/ESJ2X6GGN5HYFFSTTXOYYI?_s=23c4f33a126ce537143356cf8c1aba53&_b=2
  • https://d.adroll.com/consent/check/ESJ2X6GGN5HYFFSTTXOYYI/?_s=23c4f33a126ce537143356cf8c1aba53&_b=2
394 B
863 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/ESJ2X6GGN5HYFFSTTXOYYI/?_s=23c4f33a126ce537143356cf8c1aba53&_b=2
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.78.251.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-78-251-22.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
ccf73fc3fa55f8e40d14ac672da6fc9477fb9d68678ae1f61e5920fe19cbdab3

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.18.0
content-type
application/javascript
content-length
394
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Redirect headers

location
https://d.adroll.com/consent/check/ESJ2X6GGN5HYFFSTTXOYYI/?_s=23c4f33a126ce537143356cf8c1aba53&_b=2
date
Mon, 07 Dec 2020 21:19:15 GMT
server
nginx/1.18.0
content-length
105
who.ashx
dashboard.whoisvisiting.com/ 		631 B
835 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dashboard.whoisvisiting.com/who.ashx?Type=Hit&Data=1600|1200||2e809c36a6da4039967f34172bbca1e5|https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.43.144.18 Potters Bar, United Kingdom, ASN199766 (SOVEREIGN, GB),
Reverse DNS
www.sovereign-plc.co.uk
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
592940666137da705db11558b5601579abf2e044ff4a62c81f1f386bbce6e101

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:14 GMT
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
access-control-allow-methods
GET,POST,PUT,DELETE,OPTIONS
content-type
image/jpg
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
631
expires
-1
XDFrame
app-sj08.marketo.com/index.php/form/ Frame 4D8D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://app-sj08.marketo.com/index.php/form/XDFrame
Requested by
Host: app-sj08.marketo.com
URL: https://app-sj08.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
app-sj08.marketo.com
:scheme
https
:path
/index.php/form/XDFrame
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cf_bm=2bb1f9c12ca9c50332075ca5c57297a969d723c9-1607375954-1800-Aeml8q2WN1QtOiH+HSymUfkjQp/HtCoDL651Tq3b+6g4DDO44wyDkqaFjU22z7545B7OjpYc80XaSsgNF05+5do=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-type
text/html; charset=utf-8
content-length
652
set-cookie
__cfduid=dd63a2a581e295635d75402b239db4e511607375955; expires=Wed, 06-Jan-21 21:19:15 GMT; path=/; domain=.app-sj08.marketo.com; HttpOnly; SameSite=Lax BIGipServersj08web-nginx-app_https=!1FFrqkEaJl/Xs1nInuzRy4alk/3R/gEjfhbiCIpCrNSgb4coLW1RAC7/OeEHYwS9PHqIElZ0nDzv5w==;Path=/;Version=1;Secure;Httponly
cache-control
max-age=3600
strict-transport-security
max-age=63113904
x-content-type-options
nosniff
vary
Accept-Encoding
content-encoding
gzip
cf-cache-status
DYNAMIC
cf-request-id
06e0abbd030000736f7d253000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5fe148a8091d736f-CPH
collect
www.google-analytics.com/j/ 		2 B
65 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1787304666&t=pageview&_s=1&dl=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&ul=en-us&de=UTF-8&dt=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEADQAAAAC~&jid=296809952&gjid=1186094284&cid=1751551015.1607375955&tid=UA-42673557-1&_gid=1869804502.1607375955&_r=1&gtm=2wgb41TG6TP7&z=1189221872
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://labs.vipre.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
bundle.js
assets.ubembed.com/universalscript/releases/v0.178.1/ 		162 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.ubembed.com/universalscript/releases/v0.178.1/bundle.js
Requested by
Host: a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com
URL: https://a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.52 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 04:25:46 GMT
content-encoding
gzip
last-modified
Wed, 11 Dec 2019 22:14:50 GMT
server
AmazonS3
age
1270409
etag
W/"2c662c7609e2ae1af50939453dcb717e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 e13e8f228afcbd0862f27c6ebd714879.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
3NYmR4qYVQlD_J-vK5zdNn66Y2-n0MUIOSXcWfWbQ22CpoXW4xTioA==
index.html
cdn.useproof.com/proxy/ Frame 6A75 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.useproof.com/proxy/index.html
Requested by
Host: cdn.useproof.com
URL: https://cdn.useproof.com/proof.js?acc=jssB2vsshsRv3xk6vcXe7DJAWqg2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::681b:8757 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.useproof.com
:scheme
https
:path
/proxy/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
content-type
text/html
content-length
325
set-cookie
__cfduid=df69b0a32e0498192273235afc1f7c3c71607375955; expires=Wed, 06-Jan-21 21:19:15 GMT; path=/; domain=.useproof.com; HttpOnly; SameSite=Lax; Secure
x-amz-id-2
2lMB46zvA/9iOBARsbcTcyoTOUg1QaNNDd813yVR5ia9AtwMznDBpnBK10npb51l+C5HKBBT6Ys=
x-amz-request-id
590A90A1ED834159
last-modified
Mon, 29 Jun 2020 14:15:25 GMT
etag
"f92252b1f21fd30ac52b59395971ecdb"
cache-control
max-age=315360000, no-transform, public
x-amz-version-id
6OysE9MvUGgGn.qn_BXpeYijOLHR8713
accept-ranges
bytes
cf-cache-status
DYNAMIC
cf-request-id
06e0abbd160000fca94b1ae000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lMNoiI3h%2FgEMAqKBhcqLmcWhwQbDFepF%2FlZLOzJvuVzjT%2FTRZZ%2FcpYX2TLtxXmNNzuazTKrMF0D6RuICPLDJC5ew8DF306BZNZoc3WP8j3mzVrQW0%2FuZs1gSjAke"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5fe148a82eecfca9-VIE
collect
stats.g.doubleclick.net/j/ 		4 B
87 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-42673557-1&cid=1751551015.1607375955&jid=296809952&gjid=1186094284&_gid=1869804502.1607375955&_u=aGDAAEACQAAAAC~&z=1944817993
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 07 Dec 2020 21:19:15 GMT
content-type
text/plain
access-control-allow-origin
https://labs.vipre.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
257 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=512751002923851&ev=PageView&dl=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&rl=&if=false&ts=1607375955321&sw=1600&sh=1200&v=2.9.29&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%22951662988644778%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%221047223312360728%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[2]=%7B%22extractorID%22%3A%22626170321425968%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[3]=%7B%22extractorID%22%3A%222894287910792331%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[4]=%7B%22extractorID%22%3A%221407564906098057%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[5]=%7B%22extractorID%22%3A%22998287813962871%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[6]=%7B%22extractorID%22%3A%22425963228365189%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[7]=%7B%22extractorID%22%3A%22325457815191983%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1607375955317.1609150967&it=1607375955056&coo=false&rqm=GET
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:15 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 07 Dec 2020 21:19:15 GMT
/
www.google.com/pagead/1p-user-list/997035993/ 		42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/997035993/?random=1607375955104&cv=9&fst=1607374800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&frm=0&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&tiba=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&async=1&fmt=3&is_vtc=1&random=2243143923&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/997035993/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/997035993/?random=1607375955104&cv=9&fst=1607374800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgb41&sendb=1&frm=0&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&tiba=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&async=1&fmt=3&is_vtc=1&random=2243143923&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-42673557-1&cid=1751551015.1607375955&jid=296809952&_u=aGDAAEACQAAAAC~&z=714390079
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-42673557-1&cid=1751551015.1607375955&jid=296809952&_u=aGDAAEACQAAAAC~&z=714390079
Requested by
Host: labs.vipre.com
URL: https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
munchkin.js
munchkin.marketo.net/159/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/159/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.236.192 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-236-192.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:15 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 May 2020 02:24:14 GMT
Server
AkamaiNetStorage
ETag
"79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4810
Expires
Wed, 17 Mar 2021 21:19:15 GMT
visitWebPage
395-qpj-712.mktoresp.com/webevents/ 		2 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://395-qpj-712.mktoresp.com/webevents/visitWebPage?_mchNc=1607375955388&_mchCn=&_mchId=395-QPJ-712&_mchTk=_mch-vipre.com-1607375955388-95904&_mchHo=labs.vipre.com&_mchPo=&_mchRu=%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/159/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:16 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
e5013cb5-b6d7-480c-9b7b-09171eaedf18
events
logx.optimizely.com/v1/ 		0
359 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://logx.optimizely.com/v1/events
Requested by
Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/8335380191.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.234.23.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-234-23-30.compute-1.amazonaws.com
Software
nginx/1.17.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Mon, 07 Dec 2020 21:19:15 GMT
Server
nginx/1.17.2
Content-Type
text/plain
Access-Control-Allow-Origin
https://labs.vipre.com
Access-Control-Expose-Headers
X-Results-Data-Source
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-Request-Id
3fd21dea-ae98-4a59-84a6-db12d29a42a2
triggerRunner.js
d3rr3d0n31t48m.cloudfront.net/widget/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d3rr3d0n31t48m.cloudfront.net/widget/triggerRunner.js?v=3fd6e3d
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.43 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eded84476468672f7d4a8a437b4926e632905a06c3ca97664b9d25f3d0460861

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 04:39:48 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 04:13:37 GMT
server
AmazonS3
age
664768
etag
"9e09ed8075df167ed570f0d74083d19d"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 b75b06741e5146585057681bd60737b3.cloudfront.net (CloudFront)
cache-control
max-age=2592000, public
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
3281
x-amz-cf-id
4HnV-98aFgAPvzvlSyWRipzAW0iADMLOQTj4o-UCH5SrIIwtgAvROA==
x-amz-meta-mtime
1605068014.02
widget.js
d3rr3d0n31t48m.cloudfront.net/widget/ 		172 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.43 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0dfaac45c26915a421d467319dbc696015467c9b247b0e2be2dedd623e4f76d0

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 11 Nov 2020 04:14:17 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 04:13:36 GMT
server
AmazonS3
age
2307899
etag
"6e40c0e4d5f8de90df8c47e845b69f88"
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 b75b06741e5146585057681bd60737b3.cloudfront.net (CloudFront)
cache-control
max-age=2592000, public
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
45166
x-amz-cf-id
ySfmt3-WGXCDgd8Uf1nYRFJ-Qxbn16Yb192_dbguUZ9QKXSlZg-96Q==
x-amz-meta-mtime
1605068011.67
params
shop.pe/widget/main/init/ 		239 B
742 B 		Script
General
Check archive.org
Download Go to
Full URL
https://shop.pe/widget/main/init/params?siteid=5e8b6e35d559301a4ce5841a&product=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&product_url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&callback=AddShoppersWidget.load_widget&no_cookie_callback=AddShoppersWidget.load_no_cookie&rand=59685&cookie=&referer=
Requested by
Host: d3rr3d0n31t48m.cloudfront.net
URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f897e2ead548d6ae96a67c91a34ccbb58d827031dd0ec488bb819b0f27d9b2d2
Security Headers
Name Value
Content-Security-Policy frame-ancestors none;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:16 GMT
content-encoding
gzip
access-control-allow-origin
https://my.addshoppers.com
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
backend-version
47
alt-svc
clear
data-regulation-gdpr-enforced
true
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
deny
etag
W/"62940ef7287ad9cade9aec110843d11dc0682354"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
content-type
text/javascript
via
1.1 google
access-control-allow-credentials
true
content-security-policy
frame-ancestors none;
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
config.json
cdn.acsbapp.com/cache/app/labs.vipre.com/ 		0
81 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.acsbapp.com/cache/app/labs.vipre.com/config.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.172.136.187 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibeapp01.jetserver.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 07 Dec 2020 21:19:16 GMT
cache-control
no-cache
access-control-allow-headers
*
content-length
0
2_censored_censored.jpg
labs.vipre.com/wp-content/uploads/2020/12/ 		73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://labs.vipre.com/wp-content/uploads/2020/12/2_censored_censored.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.219.223.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-223-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b11f6b30ab52b8a9a9651d8639bf6537085a02298660e7cf74649dd98e10a2

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:16 GMT
last-modified
Wed, 02 Dec 2020 11:32:07 GMT
server
nginx
etag
"5fc77b37-12206"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
74246
params
shop.pe/widget/main/init/ 		1 KB
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://shop.pe/widget/main/init/params?siteid=5e8b6e35d559301a4ce5841a&product=Malicious%20COVID-19%20Vaccine%20Email%20Contains%20Remote%20Access%20Trojan%20%E2%80%93%20VIPRE%20Labs&product_url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&image=&price=&currency=undefined&rating=0&rating_count=0&review_count=0&stock_status=&description=&update_product=true&subcategory=&url=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&callback=AddShoppersWidget.load_widget&rand=89859&cookie=2%7C1%3A0%7C10%3A1607375956%7C15%3Aaddshoppers.com%7C44%3AN2ZlODcyYzFlNzU5NGNlMzg3YzJkMGU4OGFjMzNjZDE%3D%7C43e232698668110a81673518424389b8613628749fb734358521775fd4109a2e&referer=
Requested by
Host: d3rr3d0n31t48m.cloudfront.net
URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
87f1b387540013795dd4b2dfbd155a78cfd19cde5e52d56de736bea33302d2d5
Security Headers
Name Value
Content-Security-Policy frame-ancestors none;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:16 GMT
content-encoding
gzip
access-control-allow-origin
https://my.addshoppers.com
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
backend-version
47
alt-svc
clear
data-regulation-gdpr-enforced
true
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
deny
etag
W/"4e911674316359903ae5974fb94197393306fef6"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
POST, GET, OPTIONS, DELETE, PATCH
content-type
text/javascript
via
1.1 google
access-control-allow-credentials
true
content-security-policy
frame-ancestors none;
access-control-allow-headers
X-Requested-With, Content-Type, X-XSRFToken
A.js
addshoppers.s3.amazonaws.com/5e8b6e35d559301a4ce5841a/5eac36fdbbddbd500169bc55/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://addshoppers.s3.amazonaws.com/5e8b6e35d559301a4ce5841a/5eac36fdbbddbd500169bc55/A.js?_t=1606246975
Requested by
Host: d3rr3d0n31t48m.cloudfront.net
URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.147.108 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
77b98666d2fa97d98ec7851e487aa95a2a011bd201eb7586f7d4f4a47f957ae4

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 07 Dec 2020 21:19:17 GMT
Content-Encoding
gzip
Last-Modified
Tue, 24 Nov 2020 19:42:57 GMT
Server
AmazonS3
x-amz-request-id
811A2D2947A230B4
ETag
"30bf75a281aefc4abfba04b781abce01"
x-amz-version-id
OUAPRjUz8.ht3Cx6sJ66dIdlgC8CBNf_
Cache-Control
max-age=2592000, public
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
4232
x-amz-id-2
CfWv+RB6bmb1UXlG5qmkMAAK0il+GDgE5wGKuCsBZ8fONn9F/FOot148KEqsT2KblL9RJZEbg1Q=
input.js
shopper.shop.pe/ 		23 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://shopper.shop.pe/input.js
Requested by
Host: shop.pe
URL: https://shop.pe/widget/widget_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.54.17 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
17.54.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
0a91f7cf777ed986216313f29f443456315f50bf1428eb17ba275df87c468280

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:15:32 GMT
age
224
x-guploader-uploadid
ABg5-UyiD8GEvj3vmtiXlF6yYnXalLryKlZ2SN72cekbfSRRQXe4YjnTk7tKv6ngeigggTHP6ceWi7qPTw_CDKqnlkzo4EaN-A
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
clear
content-length
23672
last-modified
Wed, 27 Nov 2019 19:23:40 GMT
server
UploadServer
etag
"f960052c25dea0d4308c30fe905fc391"
x-goog-hash
crc32c=xBt02w==, md5=+WAFLCXeoNQwjDD+kF/DkQ==
x-goog-generation
1574882620474968
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public, max-age=3600
x-goog-stored-content-length
23672
accept-ranges
bytes
content-type
text/javascript
expires
Mon, 07 Dec 2020 22:15:32 GMT
pixel.gif
pixel.voltn.com/ 		38 B
513 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.voltn.com/pixel.gif?vcp=4dd5h0np&as_id=7fe872c1e7594ce387c2d0e88ac33cd1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.83.128.14 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
gunicorn/19.9.0 /
Resource Hash
adeeb15ca55d545ee510a420af993b1c90e13e844c9e31e26fdf3b91f66e1105

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:17 GMT
cache-control
public, max-age=43200, no-cache
content-type
image/gif
server
gunicorn/19.9.0
p3p
CP="NOI OUR BUS UNI COM NAV"
expires
Tue, 08 Dec 2020 09:19:17 GMT, Mon, 07 Dec 2020 21:19:18 GMT
wildcards.json
cdn.acsbapp.com/cache/app/ 		286 B
296 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.acsbapp.com/cache/app/wildcards.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.172.136.187 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibeapp01.jetserver.net
Software
/
Resource Hash
3ca2a9bc676c5e2736e8de773cc075efd823408e7d43170e61ac369dab04aa12

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:16 GMT
content-encoding
br
last-modified
Fri, 04 Dec 2020 12:00:29 GMT
etag
"11e-5fca24dd-7ebb7b28f2f013c5;br"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
141
expires
Tue, 08 Dec 2020 21:19:16 GMT
consent
shop.pe/query/datareg/ 		0
650 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://shop.pe/query/datareg/consent
Requested by
Host: shopper.shop.pe
URL: https://shopper.shop.pe/input.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.244.1 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
1.244.227.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors none;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options deny

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 21:19:16 GMT
via
1.1 google
p3p
policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
backend-version
47
alt-svc
clear
content-length
0
data-regulation-gdpr-enforced
true
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
deny
etag
"da39a3ee5e6b4b0d3255bfef95601890afd80709"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
HEAD, GET, POST
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
Data-Regulation-Gdpr-Enforced
content-security-policy
frame-ancestors none;
access-control-allow-headers
X-Requested-With, Content-Type, Data-Regulation-Gdpr-Enforced
/
cx.atdmt.com/
Redirect Chain
  • https://www.facebook.com/tr/?id=512751002923851&ev=Microdata&dl=https%3A%2F%2Flabs.vipre.com%2Fmalicious-covid-19-vaccine-email-contains-remote-access-trojan%2F&rl=&if=false&ts=1607375956824&cd[Dat...
  • https://cx.atdmt.com/?c=10196739726377870998&f=AYwWhntzD91I51DnDH_md2fv1_qCTsCc90Zcrm44nIPsNJvBu49F_QpLpW04miEsJf4X0bSUMO5D6MebdYMN2PDU&id=512751002923851&l=3&v=0
43 B
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cx.atdmt.com/?c=10196739726377870998&f=AYwWhntzD91I51DnDH_md2fv1_qCTsCc90Zcrm44nIPsNJvBu49F_QpLpW04miEsJf4X0bSUMO5D6MebdYMN2PDU&id=512751002923851&l=3&v=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
public
x-fb-debug
wtk7dWCMXjQH6rGcUzjRurHQ063LX304muqoTLkhVhcO+GYeEyhf98MlpEHzNnuugxsOwtYrJf8cx1WZrzz6Nw==
content-encoding
br
x-content-type-options
nosniff
date
Mon, 07 Dec 2020 13:19:16 PST
x-frame-options
DENY
content-type
image/gif
cache-control
public, max-age=0
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
expires
Mon, 07 Dec 2020 13:19:16 PST

Redirect headers

pragma
no-cache
date
Mon, 07 Dec 2020 21:19:16 GMT
server
proxygen-bolt
content-type
text/plain
location
https://cx.atdmt.com/?c=10196739726377870998&f=AYwWhntzD91I51DnDH_md2fv1_qCTsCc90Zcrm44nIPsNJvBu49F_QpLpW04miEsJf4X0bSUMO5D6MebdYMN2PDU&id=512751002923851&l=3&v=0
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
expires
0
pixel.png
shopper.shop.pe/ 		609 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://shopper.shop.pe/pixel.png?data=eyJhY3RpdmVfY2FydCI6dHJ1ZSwiY3VzdG9tX3ZhbHVlcyI6eyJhc19uZXR3b3JrIjp0cnVlfSwiaWRzaG9wcGVyIjoiNWU4YjZlMzVkNTU5MzAxYTRjZTU4NDFhIiwic2Vzc2lvbl9pZCI6IjdmZTg3MmMxZTc1OTRjZTM4N2MyZDBlODhhYzMzY2QxIiwiZGF0YXJlZ19nZHByX2NvbnNlbnRlZCI6ZmFsc2V9
Requested by
Host: d3rr3d0n31t48m.cloudfront.net
URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.54.17 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
17.54.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
0b960c8f9b3fb4ca1d0b1f43e40b5defd11dbf0fd60ebad49ad50ecc06119170

Request headers

Referer
https://labs.vipre.com/malicious-covid-19-vaccine-email-contains-remote-access-trojan/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 07 Dec 2020 20:31:48 GMT
age
2849
x-guploader-uploadid
ABg5-UzZKNADhfsBW560y-vI05paTYP656AmgTI-pcJE1aaUzFoLV8Y4gRakLV7TmoBHy6qsFdnQHZq9xv-Tm9e33nvhh_PQnA
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
clear
content-length
609
last-modified
Wed, 20 Sep 2017 16:12:07 GMT
server
UploadServer
etag
"6802175f61adc40617e8ba87a30aa6bd"
x-goog-hash
crc32c=Yf0PfA==, md5=aAIXX2GtxAYX6LqHowqmvQ==
x-goog-generation
1505923927946539
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-stored-content-length
609
accept-ranges
bytes
content-type
image/png
expires
Mon, 07 Dec 2020 21:31:48 GMT

Verdicts & Comments Add Verdict or Comment

146 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated undefined| _ object| optimizely object| dataLayer object| _wpemojiSettings undefined| $ function| jQuery object| MktoForms2 function| wistiaJQuery function| rebindWistiaFancyBoxes object| POWERREVIEWS object| lazySizesConfig object| jQuery112408294140591331491 object| scrollMonitor object| lggInfiniteScroller object| $awards_slider object| awards_slider_settings object| $features_slider object| features_slider_settings object| $currentSliderJumperDropdown object| addComment object| wp boolean| wistiaEv1AsyncLoad object| Wistia string| _wistiaElemId object| _wq object| wistiaEmbeds object| lazySizes object| google_tag_manager function| postscribe object| twemoji object| google_tag_data string| GoogleAnalyticsObject function| ga string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _linkedin_data_partner_id object| uetq object| whoistrack_params object| t function| fbq function| _fbq object| AddShoppersWidgetOptions undefined| domain undefined| daysToRemember undefined| cookieName undefined| url_string undefined| url undefined| clickref undefined| d undefined| expires undefined| nameValue string| adroll_version object| adroll object| gaplugins object| gaGlobal object| gaData function| UET function| showSmallPopup function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| CE2 string| CE_USER_DATA_URL function| lintrk boolean| _already_called_lintrk object| jQuery112409966421305161461 string| adroll_sid object| __adroll boolean| adroll_optout function| __adroll__ undefined| adroll_tpc_callback number| adroll_xavier_called number| __adroll_xid_ch function| wiv object| google_optimize function| setImmediate function| clearImmediate boolean| proofInitialized function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| ube object| adroll_exp_list boolean| __adroll_consent boolean| __adroll_consent_is_gdpr object| __adroll_consent_data string| __adroll_consent_user_country string| __adroll_consent_adv_country object| MunchkinTracker object| AddShoppersLoader function| AddShoppersTriggerRunner function| as_cleanse_field function| as_detect_cc function| as_gaPageView function| as_gaSocial function| as_gaEvent function| as_gaSet object| _mag object| AddShoppersWidget function| AddShoppersWidget_plus_one object| SchemaParser object| _add number| ieVer object| obj number| AddShoppersWidgetLoaded object| AddShoppersWidgetLang function| hasOwnProperty object| usi_commons object| usi_cookies object| usi_dom object| usi_url boolean| usi_cookieless object| usi_app object| _0x4515 function| _defineProperty function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray function| _typeof function| _instanceof object| EJS object| AccessiBe object| acsb object| acsbJS object| result boolean| _iml boolean| is_mocked object| addshopSettings function| addshopNetwork object| addshopReadyEvent function| addshopValidateEmail string| stringified string| cleansed

12 Cookies

Domain/Path Name / Value
.app-sj08.marketo.com/ Name: __cf_bm
Value: 2bb1f9c12ca9c50332075ca5c57297a969d723c9-1607375954-1800-Aeml8q2WN1QtOiH+HSymUfkjQp/HtCoDL651Tq3b+6g4DDO44wyDkqaFjU22z7545B7OjpYc80XaSsgNF05+5do=
.vipre.com/ Name: _uetvid
Value: dbb6530038d111eb8ba447f692ea680c
.vipre.com/ Name: _fbp
Value: fb.1.1607375955317.1609150967
.vipre.com/ Name: _uetsid
Value: dbb62e5038d111eb9d7a93a0340f9f84
.doubleclick.net/ Name: IDE
Value: AHWqTUkjij8yXjG3Y9MtsHKpkzoEVng-AxsfBTdW8LHCR2zqniv8IB9_FSli712U
.labs.vipre.com/ Name: __adroll_fpc
Value: fa440ff0792d027a7f1aa00097ac2c01-1607375955377
.vipre.com/ Name: _gid
Value: GA1.2.1869804502.1607375955
.vipre.com/ Name: _gat_UA-42673557-1
Value: 1
.vipre.com/ Name: _gcl_au
Value: 1.1.386525121.1607375955
.vipre.com/ Name: _mkto_trk
Value: id:395-QPJ-712&token:_mch-vipre.com-1607375955388-95904
.vipre.com/ Name: _ga
Value: GA1.2.1751551015.1607375955
.vipre.com/ Name: optimizelyEndUserId
Value: oeu1607375954395r0.010743579556712568

5 Console Messages

Source Level URL
Text
console-api debug URL: https://s.adroll.com/j/roundtrip.js(Line 84)
Message:
Both the NextRoll v1 and v2 pixel detected?
console-api log URL: https://cdn.useproof.com/proof.js?acc=jssB2vsshsRv3xk6vcXe7DJAWqg2(Line 1)
Message:
Proof v3.1.13
console-api log URL: https://acsbap.com/apps/app/assets/js/acsb.js(Line 1)
Message:
acsb: this website is not registered or its license is expired.
console-api log URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722(Line 315)
Message:
Requesting with this data:
console-api log URL: https://d3rr3d0n31t48m.cloudfront.net/widget/widget.js?v=7ba3722(Line 315)
Message:
[object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10000302.fls.doubleclick.net
395-qpj-712.mktoresp.com
a7c9b6f5d4504e3f813d023ec3cd3ec2.js.ubembed.com
acsbap.com
acsbapp.com
addshoppers.s3.amazonaws.com
app-sj08.marketo.com
app.whoisvisiting.com
assets.ubembed.com
bat.bing.com
cdn.acsbapp.com
cdn.optimizely.com
cdn.useproof.com
connect.facebook.net
cx.atdmt.com
d.adroll.com
d.adroll.mgr.consensu.org
d3rr3d0n31t48m.cloudfront.net
dashboard.whoisvisiting.com
fast.wistia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
labs.vipre.com
logx.optimizely.com
munchkin.marketo.net
pixel.voltn.com
px.ads.linkedin.com
s.adroll.com
script.crazyegg.com
shop.pe
shopper.shop.pe
snap.licdn.com
stats.g.doubleclick.net
ui.powerreviews.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.upsellit.com
104.111.214.206
104.111.236.192
104.16.96.80
151.101.113.131
167.172.136.187
172.217.16.134
185.43.144.18
192.28.147.68
208.118.62.69
216.58.212.162
2600:9000:206f:a400:4:41b4:a00:93a1
2606:4700:3036::681b:8757
2606:4700::6813:9308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:802::2004
2a00:1450:4001:806::2008
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a00:1450:4001:820::2003
2a00:1450:4001:824::200e
2a00:1450:4009:809::2002
2a00:1450:400c:c02::9b
2a02:26f0:1700:793::13b8
2a02:26f0:eb:3b4::25ea
2a03:2880:f01c:8004:face:b00c:0:8c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:3::622
2a05:f500:11:101::b93f:9005
3.219.223.49
34.234.23.30
35.190.54.17
35.227.244.1
52.216.147.108
54.78.251.22
65.9.73.43
65.9.73.52
99.83.128.14
00701587779185984cb4a771f1e8f42235fce12820077aeb94d9d75111305e4c
068e8764f6d16aeee8879cd61430fd0682ba4c8984503cbe5d0f9870a3d80b4e
06be348681ad1ebe5bc5f417c57b8a22b9d02fda686a9bdfcd759c6cec06a36e
085da638271d8cd369f0c90b979ed7a1c3a507621fca7f075c82164b88246221
0a91f7cf777ed986216313f29f443456315f50bf1428eb17ba275df87c468280
0b960c8f9b3fb4ca1d0b1f43e40b5defd11dbf0fd60ebad49ad50ecc06119170
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0da8612888212ee4fabca7bb0ffc47a8cf4119ee0cd3b1de359379f18fcadbd2
0dfaac45c26915a421d467319dbc696015467c9b247b0e2be2dedd623e4f76d0
0e49c2b4e86d3fda1dda93eb1210a47712f7b091181b4e7c6da2b3e6f8e86396
0e5357f8586b85978df0adf186b55dd1a4b05fdd20fb7bd366d84d5c2714e448
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
140f954c04037e14199dee6a54f59f7f12c5cdf8cd9c81a00729cb709c81539a
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1d4020e8836d5f24cd11641fc99c6efb46b2d523f585840a4445ebe2c6ede5f3
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2526a17a054b49558a4e09ebb89751a57c96db462bbf6e1e547cc44dad956053
253d988f1fd4575f10e577e74e5b0983b4ebc5cdd5a16d86bd5cd1621d994c65
255c2972228b5228aed30839328ba2dfc92efc81d2e0714fff22b3e3b3835771
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
32089c6aa880034ed6988ac3bab0ad5d8c0bd35db7625087d3f961834c551072
34a88dc83dd8962a9a843eb78397c2c6b7a649f0e9c56e4c83e6213b9aa10172
36075450538c95fbd0aa9211ee15de5ea0c2d24373e14cc10bff02bb48739725
383e5f611a5c1637137d721c623842d4ad37fbb609e726a0a086b8fdd4c481cb
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
3ca2a9bc676c5e2736e8de773cc075efd823408e7d43170e61ac369dab04aa12
3da8fa46e703d4318a9b59be4bfbaca7380614373eebadb4c6e3d31276ca016f
418614329e831c01f8232ddf31feefe6f63c6b52b9c6cbdd5bd5ac314540cfaf
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
47c5813a078b3be8d09a4b1ed252250d33af26aea3da8dc6d882f93eade568be
4c575d67f22342308c6bdc002dce3d2bf2eb03c3434846dd8aeb4b2b74b43d43
4c6fdf6aa944c9d4da9e125526554e997ed88eab41f777f3b23f368771c6cbf1
4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5620fd3acd4874ee2d86b7cc4ac77997940fb53e8faf51aa640573805c71cfce
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57135994acd82a57e8341534e7056af792a0b3a82415e67846dc914a1727308b
592940666137da705db11558b5601579abf2e044ff4a62c81f1f386bbce6e101
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5fb46ad88af0181f8aa600691dadedc2d6dd1946603b69bc36385f68efdd01a3
604c6bc37d067dd4659947fb36e21a49f88183e17340bdf434e21d51f6290e6a
6400401ab417128e44a90138effb24a370c40e16514aa44ff411a0c4fdb114be
76fe7821b32e9181245808c9502fd73dab42ae3199fd7ce3a9b32e8c55bc2b6a
774075868ec171a5e9c551d2d20b88f0e8ac8854f9bc68d453dc706180f43fb9
77b98666d2fa97d98ec7851e487aa95a2a011bd201eb7586f7d4f4a47f957ae4
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87e0e2f7898e1262a6e0293642329d4f31425279099a1cf01788b243e177ede8
87f1b387540013795dd4b2dfbd155a78cfd19cde5e52d56de736bea33302d2d5
891254e3a92096e153262505de507b2ba0bfe3721eadcce2bf6e64b4a2070e3c
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
8d0622453e0c21720c18a3b1433fc9a1a31bb1ba551396e3bcadb7acf308ea8e
900c0cd798c079cdd52466a463dfc9b9246d9812636acf9f484a6d7b17634304
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
9e3b38d88a59a026857eea336e09870e67903f2d86116a0300ba79274553486a
a1cc8631454e856c4f8764e4dc659a31437de48f98b0de45c5a56ad08362c38c
a4908c453b78e1eee958010159fa9d2ed53092bb5e889d2299d17a5815d50973
a7ae4f4e313e150000175511c29ca19ae2948eb663987253d19a9372cc20e3fe
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ace3cdafd2069d2603d2fa7c522da3773f6d88d77803ec40873b3d94e1b5601e
ad26a680f19316aa0091fe6acd6c564e04a28c91311a9918532faacef298ce14
adeeb15ca55d545ee510a420af993b1c90e13e844c9e31e26fdf3b91f66e1105
b04dd5b560e76bb97ad6f436281dcd18f043149cdea86a58739370771cdf5a69
b2a0aa1f4590fc175eda4227b646d4b633fdab4b3a5c9918026c13a3783770aa
b62ee7e5b5842b34374f49f945adb5aa9a5391856279df528dfb87e304a37e06
bfd7b2f9a3a44bc1b4add2306a9a70b9f328cb03b461c3588706b15ca8299e2a
c7fd14e5d979c014ad04543e5d24aa9bb198180e181194eca5781fd1effd2463
ccf73fc3fa55f8e40d14ac672da6fc9477fb9d68678ae1f61e5920fe19cbdab3
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d8abdaa133e093b8eda13b82bb9965d67b69dff79163137c8e35c965fa887bfc
dd51ded0357742a058927c3bff47e4f9fbc3fa66befa33e5ed2eb92bc0ea0859
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df25786bc3951d78d0f763a2a75a1f33b01b8ae2a5157831d2cf4d0348c2ede7
e08f0faf5f17b15bfa9ff3c200a3940071eed877759930239429c66ca5c9f54f
e1b579c9ab7a15e830328fa75ade297d181144a174a617b0690b64723f0dde56
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b11f6b30ab52b8a9a9651d8639bf6537085a02298660e7cf74649dd98e10a2
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e53f75975af7b4603afb5f458599e99ecc1139da6a44252133faf29d4d98ca77
e61496657fc678ced466ebc453954193f1567f5ddc885d954c1c16e3aba7b259
ea091d055be1ad53ef15f646982266b36289effe2db2a8b5571e9a77e1f705e8
ec640474b4d3e2fde3ed0313aa5cd0f180cbf721220df37f4c009c8e4851d848
eded84476468672f7d4a8a437b4926e632905a06c3ca97664b9d25f3d0460861
ee88faa9bcae7fdb37831ea89db4d289957aada4ae14dbf66d6fc06fbfc2cf3d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f4cc9128228efce67040a69f0f4eb3878e06ad6c46f1071f00f487e4d20f5188
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f897e2ead548d6ae96a67c91a34ccbb58d827031dd0ec488bb819b0f27d9b2d2