urlscan.io logo urlscan.io
SecurityTrails logo

www.trendmicro.com Open in urlscan Pro
104.84.86.114  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loa...
Effective URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Submission: On September 22 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 21 IPs in 5 countries across 20 domains to perform 76 HTTP transactions. The main IP is 104.84.86.114, located in United States and belongs to AKAMAI-ASN1, EU. The main domain is www.trendmicro.com.
TLS certificate: Issued by AffirmTrust Extended Validation CA - EV1 on March 25th 2020. Valid for: 2 years.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 184.30.214.55 20940 (AKAMAI-ASN1)
23 104.84.86.114 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
8 104.111.215.136 16625 (AKAMAI-AS)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
7 23.210.248.44 16625 (AKAMAI-AS)
7 34.96.102.137 15169 (GOOGLE)
2 2a01:4a0:1338... 201011 (NETZBETRI...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2.18.235.40 16625 (AKAMAI-AS)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 104.111.250.210 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 104.17.70.206 13335 (CLOUDFLAR...)
1 4 142.93.197.211 14061 (DIGITALOC...)
1 192.28.144.124 15224 (OMNITURE)
2 2a03:2880:f01... 32934 (FACEBOOK)
76 21
1    184.30.214.55 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a184-30-214-55.deploy.static.akamaitechnologies.com
blog.trendmicro.com
23    104.84.86.114 (United States)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-84-86-114.deploy.static.akamaitechnologies.com
www.trendmicro.com
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2606:4700:10::6814:7b67 (United States)

ASN13335 (CLOUDFLARENET, US)
customer.cludo.com
8    104.111.215.136 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-136.deploy.static.akamaitechnologies.com
tags.tiqcdn.com
2    2a02:26f0:6c00:291::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
s.go-mpulse.net
6852bd07.akstat.io
1    2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
7    23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
m.addthis.com
api-public.addthis.com
7    34.96.102.137 (United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com
dev.visualwebsiteoptimizer.com
2    2a01:4a0:1338:28::c38a:ff0b (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)
ds-aksb-a.akamaihd.net
4    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s.ytimg.com
1    2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
1    2a02:26f0:6c00:191::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
c.go-mpulse.net
2    104.111.250.210 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-250-210.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
4    2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    104.17.70.206 (United States)

ASN13335 (CLOUDFLARENET, US)
resources.trendmicro.com
4    142.93.197.211 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: accessibe-lb-nyc1.jetserver.net
acsbap.com
acsbapp.com
cdn.acsbapp.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
945-cxd-062.mktoresp.com
2    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)
graph.facebook.com
Domain Requested by
23 www.trendmicro.com www.trendmicro.com
8 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
7 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
dev.visualwebsiteoptimizer.com
www.trendmicro.com
s.go-mpulse.net
4 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
www.trendmicro.com
4 fonts.gstatic.com fonts.googleapis.com
3 s7.addthis.com www.trendmicro.com
s7.addthis.com
2 api-public.addthis.com s7.addthis.com
2 graph.facebook.com s7.addthis.com
2 acsbapp.com www.trendmicro.com
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 ds-aksb-a.akamaihd.net www.trendmicro.com
2 customer.cludo.com www.trendmicro.com
1 cdn.acsbapp.com s.go-mpulse.net
1 6852bd07.akstat.io s.go-mpulse.net
1 945-cxd-062.mktoresp.com s.go-mpulse.net
1 acsbap.com 1 redirects
1 resources.trendmicro.com tags.tiqcdn.com
1 c.go-mpulse.net s.go-mpulse.net
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 s.ytimg.com www.youtube.com
1 www.youtube.com www.trendmicro.com
1 s.go-mpulse.net www.trendmicro.com
1 fonts.googleapis.com www.trendmicro.com
1 blog.trendmicro.com 1 redirects
76 27
Subject Issuer Validity Valid
www.trendmicro.com
AffirmTrust Extended Validation CA - EV1		 2020-03-25 -
2022-03-26		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-05 -
2021-08-05		 a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2020-03-16 -
2021-06-15		 a year crt.sh
akstat.io
DigiCert Secure Site ECC CA-1		 2020-05-06 -
2021-08-05		 a year crt.sh
*.google.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
odc-prod-01.oracle.com
DigiCert Secure Site ECC CA-1		 2020-07-22 -
2021-10-13		 a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2020-06-19 -
2022-07-06		 2 years crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1		 2020-07-15 -
2021-09-13		 a year crt.sh
*.gstatic.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2020-03-14 -
2021-04-13		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-08-26 -
2020-11-18		 3 months crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3		 2020-07-25 -
2021-07-25		 a year crt.sh
acsbap.com
Let's Encrypt Authority X3		 2020-08-16 -
2020-11-14		 3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-09-11 -
2020-12-10		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Frame ID: 91E303E4746F1E990317DEA8CA3FC098
Requests: 72 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Frame ID: 81A489DEC42456054416A54CA3957B4D
Requests: 2 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: F66011B2ECE0AAE56D27B1C906212BEE
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: F727529C7406FC0C38359EFBFC80CF9F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-lin... HTTP 301
    https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-sim... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

76
Requests

99 %
HTTPS

52 %
IPv6

20
Domains

27
Subdomains

21
IPs

5
Countries

2749 kB
Transfer

5194 kB
Size

21
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/ HTTP 301
    https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js

76 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
www.trendmicro.com/en_us/research/18/l/
Redirect Chain
  • https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/
  • https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
82 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4c39aa96617a31c37c217450ac531e621c137fba7b4fe501193c7bfcab247942
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:method
GET
:authority
www.trendmicro.com
:scheme
https
:path
/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
content-type
text/html;charset=utf-8
x-prod-a-01
Yes
strict-transport-security
max-age=15552000; preload
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1;mode=block
x-prod-n-02
Yes
content-encoding
gzip
vary
Accept-Encoding
x-akamai-transformed
9 - 0 pmb=mRUM,1
date
Tue, 22 Sep 2020 22:45:02 GMT
content-length
17112
set-cookie
trendMicroVisitorContextIsBusiness=true; path=/

Redirect headers

Server
nginx
Content-Type
text/html
Content-Length
178
Location
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Strict-Transport-Security
max-age=15552000; preload
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
X-XSS-Protection
1;mode=block
X-BlogDispatch
Yes
Date
Tue, 22 Sep 2020 22:45:02 GMT
Connection
keep-alive
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 		111 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6068e194fbcc63e770a21498d0c7a8bf6ac91c75aea4325772d2b71aadd46ff8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Fri, 03 Jul 2020 21:01:33 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:02 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
38334
x-xss-protection
1;mode=block
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Fri, 21 Jun 2019 19:39:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:02 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
3706
x-xss-protection
1;mode=block
css
fonts.googleapis.com/ 		12 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 22 Sep 2020 22:45:02 GMT
server
ESF
date
Tue, 22 Sep 2020 22:45:02 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 22 Sep 2020 22:45:02 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/ 		16 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7b67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 21 Sep 2020 08:25:54 GMT
server
cloudflare
age
52822
etag
W/"0d577d2f08fd61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=300
cf-ray
5d6f8dd529bb97ea-FRA
cf-request-id
055996f93b000097eaafa35200000001
x-lb
4
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 		238 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
766742132efd34c32b19346a9ae991e13bd05969694404f2705c050b3bbbb177
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 13 Aug 2020 17:04:21 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
34619
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a77cfbb63e71a7ffe2f7b827a8b67b7893a20b74e17afb9a1c0b8e9573f6fd95

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:02 GMT
content-encoding
gzip
last-modified
Thu, 17 Sep 2020 16:37:36 GMT
server
AkamaiNetStorage
etag
"89f0c2942f278eab06bcaf7e1af29049:1600360656.97186"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
916
expires
Tue, 22 Sep 2020 22:50:02 GMT
icn_facebook.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_facebook.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
status
200
x-prod-n-01
Yes
content-length
810
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:22:38 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
max-age=496
etag
"5e2-5afee67942f44"
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 22:53:19 GMT
icn_twitter.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		394 B
680 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_twitter.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
status
200
x-prod-n-01
Yes
content-length
394
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:24:45 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
x-prod-a-02
Yes
content-type
image/png
cache-control
max-age=539
etag
W/"18a-5afee6f253a47"
accept-ranges
bytes
expires
Tue, 22 Sep 2020 22:54:02 GMT
icn_linkedin.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		970 B
889 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_linkedin.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
status
200
x-prod-n-01
Yes
content-length
579
x-xss-protection
1;mode=block
x-frame-options
SAMEORIGIN
last-modified
Tue, 22 Sep 2020 22:23:19 GMT
server
nginx
x-prod-a-02
Yes
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=510
etag
W/"3ca-5afee6a007ab1"
accept-ranges
bytes
expires
Tue, 22 Sep 2020 22:53:33 GMT
icn_youtube.svg
www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/ 		870 B
837 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/icons/social/icn_youtube.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
status
200
content-length
528
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:29:43 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=998
etag
"366-5afee80e45539"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:01:41 GMT
logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
content-length
13089
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:20:48 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=675
etag
"3321-5afee610ac986"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 22:56:18 GMT
search-script.js
customer.cludo.com/scripts/bundles/ 		217 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:7b67 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9191ef1ba868c010ec64bdc6025f716ca8e43e9d2495ede02874b52bff62a48e

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 20 Aug 2020 11:15:56 GMT
server
cloudflare
age
112
etag
W/"07e1d46e376d61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=300
cf-ray
5d6f8dd589da97ea-FRA
cf-request-id
055996f977000097eaafa37200000001
x-lb
4
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 		648 B
912 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
max-age=726
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
648
x-xss-protection
1;mode=block
expires
Tue, 22 Sep 2020 22:57:09 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 		409 B
673 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
cache-control
max-age=726
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
409
x-xss-protection
1;mode=block
expires
Tue, 22 Sep 2020 22:57:09 GMT
TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
s.go-mpulse.net/boomerang/ Frame 81A4 		202 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:02 GMT
content-encoding
br
last-modified
Sun, 13 Sep 2020 14:05:27 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
51580
emotet-ursnif-dridex-bitpaymer-linked-codes_4-1024x801.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/ 		432 KB
434 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/emotet-ursnif-dridex-bitpaymer-linked-codes_4-1024x801.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4ff4479b4c710affc1759bd991f2a3b4b99fc4fc0b4f54e611a5c22042433b3c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
content-length
442834
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:45:03 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
etag
W/"6c1d2-5afeeb7c100c7"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:15:03 GMT
emotet-ursnif-dridex-bitpaymer-linked-codes_1-1024x615.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/ 		443 KB
444 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/emotet-ursnif-dridex-bitpaymer-linked-codes_1-1024x615.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3003928277cf78b907a9ee45dd4997a4a0fc0bbfa0325ecce770507061b09ce2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
content-length
453153
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:45:03 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:04 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=1800
etag
W/"6ea21-5afeeb7c7f60a"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:15:04 GMT
emotet-ursnif-dridex-bitpaymer-linked-codes_2-1024x596.png
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/ 		687 KB
689 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/emotet-ursnif-dridex-bitpaymer-linked-codes_2-1024x596.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
58066afc214ec9becbaa9e26054dd8c7487e0f6d3ca5e923517067dd8ee89b8b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
status
200
content-length
703504
x-prod-n-02
Yes
last-modified
Tue, 22 Sep 2020 22:45:03 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
x-prod-a-02
Yes
content-type
image/png
x-xss-protection
1;mode=block
cache-control
max-age=1718
etag
W/"abc10-5afeeb7c1aad2"
accept-ranges
bytes
expires
Tue, 22 Sep 2020 23:13:41 GMT
emotet-ursnif-dridex-bitpaymer-linked-codes_3.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/ 		119 KB
120 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/migrated/security-intelligence-migration-spreadsheet/trendlabs-security-intelligence/2018/12/emotet-ursnif-dridex-bitpaymer-linked-codes_3.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2fffe4d71d13580d4a818db25a4e781c497eddf52f217f9c017586aa65af86e2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
status
200
content-length
121738
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:45:09 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:09 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=1745
etag
W/"1db8a-5afeeb8153b6f"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:14:14 GMT
sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-check-cacheable
YES
status
200
x-prod-n-01
Yes
content-length
7185
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:30:10 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-serial
13292
x-frame-options
SAMEORIGIN
content-type
application/javascript
vary
Accept-Encoding
cache-control
max-age=1313
etag
"48de-5afee8285e482"
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:06:56 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 		81 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-check-cacheable
YES
status
200
content-length
26353
x-xss-protection
1;mode=block
last-modified
Tue, 22 Sep 2020 22:30:39 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
x-serial
13292
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1422
etag
"1457a-5afee843f7846"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Tue, 22 Sep 2020 23:08:45 GMT
iframe_api
www.youtube.com/ 		859 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
13b74daf64144214316c5d848e2689ce07fb9ec8062454078a8660ca9cf0da6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status
200
cache-control
no-cache
content-type
application/javascript
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 		379 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1f733e0217b0a53c84553bd264434c5e807faabcd0d877c294fb970d0c619b1c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 10 Sep 2020 17:13:51 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
114969
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
"5ed917ff-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
status
200
cache-control
public, max-age=600
date
Tue, 22 Sep 2020 22:45:03 GMT
x-host
s7.addthis.com
content-length
116324
j.php
dev.visualwebsiteoptimizer.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&f=1&r=0.2158250004413904
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
9e91c58dffbaa4badfd833bf2f137b9c52af8455856c2f5f542e29f02d99cfc4

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
server
gfra1
content-type
application/javascript; charset=UTF-8
status
200
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
aksb.min.js
ds-aksb-a.akamaihd.net/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ds-aksb-a.akamaihd.net/aksb.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a01:4a0:1338:28::c38a:ff0b , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
Apache /
Resource Hash
7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:45:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Aug 2018 18:25:26 GMT
Server
Apache
ETag
"15de19f42b35806faf815298644157e0:1535653526"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=43200
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
4826
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		95 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4608eb9cf4c14276dc289a21c5318007a9212fc8d6f380869c2464009521e68d

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Thu, 17 Sep 2020 16:37:38 GMT
server
AkamaiNetStorage
etag
"b19bc83145924aa9a7af0b241db00b90:1600360658.015069"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
23940
expires
Tue, 22 Sep 2020 22:50:03 GMT
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/ 		23 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4ae33b96315a8726404109e3a9d79fdbc89149b8ff68b724023ac7318cd4ad02
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 16 Jul 2020 17:11:57 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:45:03 GMT
x-prod-n-01
Yes
x-prod-a-02
Yes
content-type
application/x-font-ttf
status
200
cache-control
public, max-age=1730
vary
Accept-Encoding
content-length
13436
x-xss-protection
1;mode=block
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 18:23:18 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
15705
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Wed, 22 Sep 2021 18:23:18 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 18:23:48 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:49 GMT
server
sffe
age
15675
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9180
x-xss-protection
0
expires
Wed, 22 Sep 2021 18:23:48 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vfloQ445V/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vfloQ445V/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1a6ef58fe27ab9ef4331c8c88c8a45709340815e767b317113be77dd03e05c27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 19 Sep 2020 03:45:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
327598
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34415
x-xss-protection
0
last-modified
Fri, 18 Sep 2020 20:41:50 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Sun, 27 Sep 2020 03:45:05 GMT
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Tue, 22 Sep 2020 22:45:03 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
status
200
cache-control
public, max-age=1
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
73259
x-xss-protection
1;mode=block
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 18:25:30 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:16 GMT
server
sffe
age
15573
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9016
x-xss-protection
0
expires
Wed, 22 Sep 2021 18:25:30 GMT
memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v18/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.trendmicro.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 18:37:29 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
14854
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9744
x-xss-protection
0
expires
Wed, 22 Sep 2021 18:37:29 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=52699
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
dict.en_us.json
www.trendmicro.com/libs/cq/i18n/ 		13 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en_us.json
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bd59500def7de45cb7a70ca41442373e9253b3b98ef03b32ac023a49ca685c96
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
server
nginx
etag
"26557aa78bc7e3ddc0a6b26766a2aca2"
x-frame-options
SAMEORIGIN
content-type
application/json;charset=utf-8
status
200
cache-control
public, max-age=151
date
Tue, 22 Sep 2020 22:45:03 GMT
x-prod-n-01
Yes
content-length
13492
x-xss-protection
1;mode=block
x-prod-a-04
Yes
ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.disruptor.html
www.trendmicro.com/en_us/research/18/l/ 		779 B
681 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.disruptor.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
52f939d386a6479c2c9bca0eb302070e82dbca0551ae573a62c7c511e6eb99d1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
server
nginx
date
Tue, 22 Sep 2020 22:45:04 GMT
x-frame-options
SAMEORIGIN
content-type
text/html;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
422
x-xss-protection
1;mode=block
x-akamai-transformed
9 - 0 pmb=mRUM,1
ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.notifications.html
www.trendmicro.com/en_us/research/18/l/ 		2 KB
887 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.notifications.html
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.84.86.114 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-84-86-114.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0c9c53cb33cad7577b381d121f810288bf0820d5b39723e34e562c0b9b970d3f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
server
nginx
date
Tue, 22 Sep 2020 22:45:04 GMT
x-frame-options
SAMEORIGIN
content-type
text/html;charset=utf-8
status
200
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
658
x-xss-protection
1;mode=block
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
etag
1901189993--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
public, max-age=59, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
1129
300lo.json
m.addthis.com/live/red_lojson/ 		89 B
249 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=5f6a7e6fd026d906&bkl=0&bl=1&pdt=1060&sid=5f6a7e6fd026d906&pub=ra-57bc9d0c3028a052&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.trendmicro.com&fp=en_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=cyber%20crime%2Ccyber%20threats%2Cresearch%2Cmalware&colc=1600814703627&jsl=1&uvs=5f6a7e6fa10ef42a000&skipb=1&callback=addthis.cbs.jsonp__81762457408002280
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1e8e35d10576e62bd9928b27dd46e95efc3141ba8cc018e56250db0e7bb2042a

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Tue, 22 Sep 2020 22:45:03 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
89
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame F660 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame F727 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html

Response headers

status
200
server
nginx/1.15.8
content-type
text/html
last-modified
Mon, 09 Sep 2019 15:34:57 GMT
etag
W/"5d767121-1115f"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
25412
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
va-6d175cbcdf2332145443de20b5cf15fc.js
dev.visualwebsiteoptimizer.com/6.0/ 		197 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/6.0/va-6d175cbcdf2332145443de20b5cf15fc.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&f=1&r=0.2158250004413904
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
b3bc67189db38c75aa6746e209528e5eef95beb5d62dfe1e38545d8707d07feb

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
br
last-modified
Fri, 18 Sep 2020 05:31:47 GMT
server
gfra1
status
200
etag
"5f644643-e4a1"
vary
Accept-Encoding, User-Agent
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
58529
via
1.1 google
track-6d175cbcdf2332145443de20b5cf15fc.js
dev.visualwebsiteoptimizer.com/6.0/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/6.0/track-6d175cbcdf2332145443de20b5cf15fc.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&f=1&r=0.2158250004413904
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
116db9abd383483638608cba331abe520926c2564c796f700baa43f56e15f74f

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
br
last-modified
Fri, 18 Sep 2020 05:31:47 GMT
server
gfra1
status
200
etag
"5f644643-e10"
vary
Accept-Encoding, User-Agent
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3600
via
1.1 google
opa-a4111607dc5ce718c2993c75e25e5d78.js
dev.visualwebsiteoptimizer.com/analysis/3.0/ 		82 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/3.0/opa-a4111607dc5ce718c2993c75e25e5d78.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&f=1&r=0.2158250004413904
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
9d1d20907ba83d3f3470e59e4304e94a093514d204330dde7afea7056c13febd

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
br
last-modified
Tue, 21 Jul 2020 12:27:40 GMT
server
gfra1
status
200
etag
"5f16df3c-5558"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21848
via
1.1 google
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
301 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=D31E4810C4EF4CCB8DB92AFEF591396C0&h=ef383a96e3f2f0605c170d1a9c290fa3&t=false&r=0.0364997088099277
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv3c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Sep 2020 22:45:02 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv3c
content-type
image/gif
status
200
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.42.202002262042
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Wed, 26 Feb 2020 20:41:18 GMT
server
AkamaiNetStorage
etag
"76e9ea9a97ed91d0c8a5d6014b090bf2:1582749678.346226"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
5819
expires
Wed, 07 Oct 2020 22:45:03 GMT
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:02 GMT
server
AkamaiNetStorage
etag
"7b0575b394704ec7f76bef0f68cfc059:1486318442"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1706
expires
Wed, 07 Oct 2020 22:45:03 GMT
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.42.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:01 GMT
server
AkamaiNetStorage
etag
"15598bba639efba2403d00ec82947e93:1486318441"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1024
expires
Wed, 07 Oct 2020 22:45:03 GMT
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.42.201608171750
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Sun, 05 Feb 2017 18:14:03 GMT
server
AkamaiNetStorage
etag
"afbbd577745f63042227302506a07e1a:1486318443"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1454
expires
Wed, 07 Oct 2020 22:45:03 GMT
utag.124.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.124.js?utv=ut4.42.202009171637
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 17:52:13 GMT
server
AkamaiNetStorage
etag
"9d323f92c46f9880077c1b57db99e5f7:1591293133.081481"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1216
expires
Wed, 07 Oct 2020 22:45:03 GMT
config.json
c.go-mpulse.net/api/ Frame 81A4 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=TU3LW-WPX5W-YK52N-GNWRK-Z5B9X&d=www.trendmicro.com&t=5336049&v=1.632.0&if=&sl=0&si=parhe3tppv-qh30j3&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:191::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
16f6d28d737c78ed2e36019d70bfdda4bb3f65d3c0362d645e5bebb275dc6796

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:45:03 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
949
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.250.210 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-250-210.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:45:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 05 Aug 2020 03:11:00 GMT
Server
AkamaiNetStorage
ETag
"a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.42.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
1266
date
Tue, 22 Sep 2020 22:23:57 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Wed, 23 Sep 2020 00:23:57 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
5363
date
Tue, 22 Sep 2020 21:15:40 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Tue, 22 Sep 2020 23:15:40 GMT
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
EXPIRED
status
200
content-length
695
cf-request-id
055996fc9b00001ec68a176200000001
last-modified
Sat, 05 Sep 2020 01:52:55 GMT
server
cloudflare
etag
"4c2175-6f3-5ae873e735006"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
5d6f8dda9c661ec6-AMS
expires
Tue, 22 Sep 2020 22:46:03 GMT
acsb.js
acsbapp.com/apps/app/assets/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
390 KB
104 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acsbapp.com/apps/app/assets/js/acsb.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.93.197.211 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc1.jetserver.net
Software
nginx /
Resource Hash
2565fbdd5701203460acd22212f14325b82ed3cb45379955f418654db66c46b6

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:04 GMT
content-encoding
br
last-modified
Mon, 21 Sep 2020 21:13:29 GMT
server
nginx
status
200
etag
"6199f-5f691779-71b3b7fb84061f29;br"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
105960
expires
Wed, 23 Sep 2020 22:45:04 GMT

Redirect headers

status
301
date
Tue, 22 Sep 2020 22:45:03 GMT
server
nginx
content-length
162
location
https://acsbapp.com/apps/app/assets/js/acsb.js
content-type
text/html
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
202 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202009171637&cb=1600814703721
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Tue, 22 Sep 2020 22:55:03 GMT
ec.js
www.google-analytics.com/plugins/ua/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 21:47:24 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
3459
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2779
x-xss-protection
0
expires
Tue, 22 Sep 2020 22:47:24 GMT
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
941 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 21:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
3450
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 22 Sep 2020 22:47:33 GMT
collect
www.google-analytics.com/ 		35 B
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j86&a=1717779385&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&ul=en-us&de=UTF-8&dt=URSNIF%2C%20EMOTET%2C%20DRIDEX%20and%20BitPayme%20Linked%20by%20Loader&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBACAIrB~&cid=810249981.1600814704&tid=UA-44592531-1&_gid=181926506.1600814704&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&z=1085982893
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Sep 2020 14:27:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
29846
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
__utm.gif
ssl.google-analytics.com/r/ 		35 B
386 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=141220965&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=URSNIF%2C%20EMOTET%2C%20DRIDEX%20and%20BitPayme%20Linked%20by%20Loader&utmhid=1717779385&utmr=-&utmp=%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&utmht=1600814703793&utmac=UA-29051577-12&utmcc=__utma%3D44797537.810249981.1600814704.1600814704.1600814704.1%3B%2B__utmz%3D44797537.1600814704.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=259092604&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAABAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 22 Sep 2020 22:45:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
worker-1acd6955248e984d8c16ea37afb8cbb7.js
dev.visualwebsiteoptimizer.com/analysis/ 		47 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/worker-1acd6955248e984d8c16ea37afb8cbb7.js
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
br
last-modified
Mon, 16 Mar 2020 04:40:32 GMT
server
gfra1
status
200
etag
"5e6f0340-351f"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13599
via
1.1 google
settings.js
dev.visualwebsiteoptimizer.com/ 		27 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=6.0&r=0.34055739974512567&exc=69|95
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/6.0/va-6d175cbcdf2332145443de20b5cf15fc.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
2f08463299dbb3182f9e798d6d633245dff95e7ea83352797bc181cdd5de2752

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 22 Sep 2020 22:45:03 GMT
content-encoding
gzip
server
gfra1
alt-svc
h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
via
1.1 google
content-type
application/javascript; charset=UTF-8
munchkin.js
munchkin.marketo.net/159/ 		11 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/159/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.250.210 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-250-210.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:45:03 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 May 2020 02:24:14 GMT
Server
AkamaiNetStorage
ETag
"79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4810
Expires
Thu, 31 Dec 2020 22:45:03 GMT
layers.33f5b85045a5f2308467.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
W/"5ed917ff-41b9f"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86313600
date
Tue, 22 Sep 2020 22:45:03 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77540
visitWebPage
945-cxd-062.mktoresp.com/webevents/ 		2 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1600814703888&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1600814703887-89163&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:45:04 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
8568eaac-1e9a-4189-bc87-4d135f915f11
/
graph.facebook.com/ 		228 B
324 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_7xie0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
fe77e34f1764a618356ef7ddf559033d1bc7ea10f39e3348c0b7b1f187cfd518
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status
200
x-fb-rev
1002705516
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
172
pragma
no-cache
x-fb-debug
izIAK0d9lrK84nVQHHauTnMIonaz7BZ+Q2ve8Uz2/4UDr7o3d2r98DZ00Z93AYcYgKWQJs88hqZzjelLlCKb8w==
x-fb-trace-id
Dv80nn2nqoy
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
ApJ6p59cFXqvG--LYUQkA_b
cache-control
no-store
facebook-api-version
v3.1
expires
Sat, 01 Jan 2000 00:00:00 GMT
shares.json
api-public.addthis.com/url/ 		33 B
349 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&callback=_ate.cbs.rcb_6dex0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
2e1c79fdeee73e9ca425544063ec088d0fc931b92a299da7105aab794945f34e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
last-modified
Tue, 22 Sep 2020 22:45:04 GMT
server
nginx/1.15.8
date
Tue, 22 Sep 2020 22:45:04 GMT
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
/
graph.facebook.com/ 		228 B
621 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_k47p0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c90432fe2da4723ba3cbd7b08019c67661c1e2b02ed40e062c78e531b2dc44bb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status
200
x-fb-rev
1002705516
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
173
pragma
no-cache
x-fb-debug
d+GVmXg1z7GO4LMFiYeIC3UxbyGYrn7vLFvovW370ngnFGX+jOWPXsFSifJpB2OcnmD6mHjaVhWpdPeNjbcHlg==
x-fb-trace-id
EqL5Eh6J6MP
date
Tue, 22 Sep 2020 22:45:03 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AqQZNsO07FjXA-TqjVmQXzI
cache-control
no-store
facebook-api-version
v3.1
expires
Sat, 01 Jan 2000 00:00:00 GMT
shares.json
api-public.addthis.com/url/ 		33 B
349 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F18%2Fl%2Fursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&callback=_ate.cbs.rcb_ckr70
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
91b7359595c8f1d6a72df149aa605ae5f74d500172e389a149f8d1c5ba942bdc
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
last-modified
Tue, 22 Sep 2020 22:45:04 GMT
server
nginx/1.15.8
date
Tue, 22 Sep 2020 22:45:04 GMT
vary
Accept-Encoding
content-type
application/json
status
200
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
53
b
ds-aksb-a.akamaihd.net/2/530147/ 		0
269 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ds-aksb-a.akamaihd.net/2/530147/b?dE=7&cS=7&cE=76&rqS=76&rsS=704&rsE=714&sS=21&dl=708&di=1341&fp=1874&dlS=1342&dlE=1461&dc=7379&leS=7381&leE=7385&to=&ol=0&cr=13&mt=&mb=&b=131329&u=https%3A//www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html&ua=Mozilla/5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/83.0.4103.61%20Safari/537.36&pl=Linux%20x86_64&us=&gh=95.100.93.30&t=&rid=7150669&r=38749&akM=g&akN=ae&vc=14:17&bpcip=b9d4ab00&akTX=1&akTI=7150669&ai=354244&pmgn=&pmgi=&pmp=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a01:4a0:1338:28::c38a:ff0b , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 22 Sep 2020 22:45:09 GMT
Content-Type
text/html
Cache-Control
max-age=0, no-cache, no-store, private
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
0
Expires
Tue, 22 Sep 2020 22:45:09 GMT
/
6852bd07.akstat.io/ 		0
204 B 		Other
General
Check archive.org
Download Go to
Full URL
https://6852bd07.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Tue, 22 Sep 2020 22:45:10 GMT
status
204
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Tue, 22 Sep 2020 22:45:10 GMT
en.build.json
cdn.acsbapp.com/cache/app/trendmicro.com/ 		233 KB
25 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.acsbapp.com/cache/app/trendmicro.com/en.build.json
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.93.197.211 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc1.jetserver.net
Software
nginx /
Resource Hash
bc21faa61299c103daad43d39c6064a4c9feec3a9446b1e1e87b09595cfdd07c

Request headers

Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 22 Sep 2020 22:45:10 GMT
content-encoding
br
last-modified
Tue, 22 Sep 2020 22:44:28 GMT
server
nginx
status
200
etag
"3a4db-5f6a7e4c-e9674e0b97460d66;br"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
25684
expires
Wed, 23 Sep 2020 22:45:10 GMT
acsbi.ttf
acsbapp.com/apps/app/assets/fonts/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://acsbapp.com/apps/app/assets/fonts/acsbi.ttf?qj8z5u
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.93.197.211 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
accessibe-lb-nyc1.jetserver.net
Software
nginx /
Resource Hash
9abdb3b3eb61358ec6439f8588ba57d83b46137d500ccf3afbe62470f8f2cd46

Request headers

Origin
https://www.trendmicro.com
Referer
https://www.trendmicro.com/en_us/research/18/l/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 22:45:10 GMT
last-modified
Thu, 09 Jul 2020 12:08:22 GMT
server
nginx
etag
"4404-5f0708b6-aef24ea8278f0dc7;;;"
status
200
content-type
application/x-font-ttf
access-control-allow-origin
*
cache-control
max-age=864000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
17412
expires
Wed, 22 Sep 2021 22:45:10 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

217 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| BOOMR number| BOOMR_lstart object| BOOMR_mq function| $ function| jQuery object| matched object| browser object| Granite object| maxy_pathnames number| settings_timer number| _vwo_settings_timer object| _vwo_code object| w object| d object| AKSB object| utag_data object| base64 function| Cludo object| CludoSearch string| cludo_language function| Sly function| webpackJsonpjwplayer function| jwplayer object| YT object| YTConfig function| onYTReady function| id function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| disruptorPanel object| folioMessage number| globalBodyScroll function| toggleFilterListNav function| hideSearchBar function| setFocus object| searchButton object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight function| jumpScroll object| promotionalContent object| savedArticles object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| researchUtilityMenu object| bsModal function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| CludoSearchInstances object| $navSticky object| addthis_share object| addthis_config object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href number| len undefined| linkName object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange number| _vwo_acc_id object| _vwo_style string| _vwo_css string| _vwo_cookieDomain string| _vwo_uuid string| _vis_opt_file number| _vwo_library_timer string| _vis_opt_lib undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| VWO object| vwo_iehack_queue object| _vwo_exp_ids object| _vwo_exp object| _vwo_pa string| _vwo_opa_cb string| _vwo_worker_cb object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportLogPayloadsQueue_ object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ boolean| __@@##MUH string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData boolean| IS_SAFARI_ITP number| BOOMR_configt object| _bmrEvents object| _gat function| Sa function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev object| _vwo_t object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath number| _vis_opt_experiment_id boolean| _vwo_settings_timed_out boolean| DISABLE_NATIVE_CONSTANTS object| __nls object| oattr function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin number| ___vwo number| c_start object| MunchkinTracker object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| _vwo_geo object| EJS object| acsb object| acsbJS object| AccessiBe object| _0xeec8 boolean| acsbInited boolean| acsbPendingLoad number| BOOMR_onload object| whichUl object| RT object| EJSEventListeners object| acsbActiveLang function| acsbIframeActionReporter boolean| acsbFramerBound function| acsbFireAlert

21 Cookies

Domain/Path Name / Value
.trendmicro.com/ Name: RT
Value: "z=1&dm=trendmicro.com&si=0f6f1768-225f-480f-8359-57eb65c36588&ss=kfejqp6x&sl=1&tt=5yk&bcn=%2F%2F6852bd07.akstat.io%2F&ld=5yo"
.addthis.com/ Name: loc
Value: MDAwMDBFVU5MWkgyMzIwMTg0NDAwMDAwMDBDSA==
.trendmicro.com/ Name: _vwo_uuid
Value: D31E4810C4EF4CCB8DB92AFEF591396C0
.trendmicro.com/ Name: _mkto_trk
Value: id:945-CXD-062&token:_mch-trendmicro.com-1600814703887-89163
.trendmicro.com/ Name: _vis_opt_s
Value: 1%7C
.trendmicro.com/ Name: _vwo_uuid_v2
Value: D31E4810C4EF4CCB8DB92AFEF591396C0|ef383a96e3f2f0605c170d1a9c290fa3
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: _vis_opt_test_cookie
Value: 1
.trendmicro.com/ Name: __utma
Value: 44797537.810249981.1600814704.1600814704.1600814704.1
.trendmicro.com/ Name: _gid
Value: GA1.2.181926506.1600814704
.trendmicro.com/ Name: __utmz
Value: 44797537.1600814704.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.trendmicro.com/ Name: _vwo_sn
Value: 0%3A1
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1600814704
.trendmicro.com/ Name: _ga
Value: GA1.2.810249981.1600814704
.trendmicro.com/ Name: utag_main
Value: v_id:0174b7fde42700180e97531dcf4100078007707000b08$_sn:1$_ss:1$_st:1600816503656$ses_id:1600814703656%3Bexp-session$_pn:1%3Bexp-session
www.trendmicro.com/ Name: __atuvc
Value: 1%7C39
www.trendmicro.com/ Name: trendMicroVisitorContextIsBusiness
Value: true
.addthis.com/ Name: uvc
Value: 1%7C39
.trendmicro.com/ Name: _vwo_ds
Value: 3%3Aa_0%2Ct_0%3A0%241600814703%3A75.32255421%3A%3A%3A95_0%2C69_0%3A0
www.trendmicro.com/ Name: __atuvs
Value: 5f6a7e6fa10ef42a000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6852bd07.akstat.io
945-cxd-062.mktoresp.com
acsbap.com
acsbapp.com
api-public.addthis.com
blog.trendmicro.com
c.go-mpulse.net
cdn.acsbapp.com
customer.cludo.com
dev.visualwebsiteoptimizer.com
ds-aksb-a.akamaihd.net
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
m.addthis.com
munchkin.marketo.net
resources.trendmicro.com
s.go-mpulse.net
s.ytimg.com
s7.addthis.com
ssl.google-analytics.com
tags.tiqcdn.com
v1.addthisedge.com
www.google-analytics.com
www.trendmicro.com
www.youtube.com
z.moatads.com
s7.addthis.com
104.111.215.136
104.111.250.210
104.17.70.206
104.84.86.114
142.93.197.211
184.30.214.55
192.28.144.124
2.18.235.40
23.210.248.44
2606:4700:10::6814:7b67
2a00:1450:4001:801::200e
2a00:1450:4001:802::200a
2a00:1450:4001:808::2008
2a00:1450:4001:821::200e
2a00:1450:4001:825::2003
2a00:1450:4001:825::200e
2a01:4a0:1338:28::c38a:ff0b
2a02:26f0:6c00:191::11a6
2a02:26f0:6c00:291::11a6
2a03:2880:f01c:800e:face:b00c:0:2
34.96.102.137
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
0c9c53cb33cad7577b381d121f810288bf0820d5b39723e34e562c0b9b970d3f
116db9abd383483638608cba331abe520926c2564c796f700baa43f56e15f74f
11e4bbc1b693180f808f5cf7efd686a3ce9fc7585dc1806185f7084424162173
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
13b74daf64144214316c5d848e2689ce07fb9ec8062454078a8660ca9cf0da6b
16f6d28d737c78ed2e36019d70bfdda4bb3f65d3c0362d645e5bebb275dc6796
179bace0273000f2f62b6195b3d04bd903c864344f23318a3a92a41e06628b1b
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
1a6ef58fe27ab9ef4331c8c88c8a45709340815e767b317113be77dd03e05c27
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1e8e35d10576e62bd9928b27dd46e95efc3141ba8cc018e56250db0e7bb2042a
1f733e0217b0a53c84553bd264434c5e807faabcd0d877c294fb970d0c619b1c
2565fbdd5701203460acd22212f14325b82ed3cb45379955f418654db66c46b6
2e1c79fdeee73e9ca425544063ec088d0fc931b92a299da7105aab794945f34e
2f08463299dbb3182f9e798d6d633245dff95e7ea83352797bc181cdd5de2752
2fffe4d71d13580d4a818db25a4e781c497eddf52f217f9c017586aa65af86e2
3003928277cf78b907a9ee45dd4997a4a0fc0bbfa0325ecce770507061b09ce2
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
417a7f6679abf7c3a5f185f363b211d44c08c90bc9fe85517c561ca7c621b2a9
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
426a653fa40f5497328c28f14875b51903dd317fb27ea5e05c23a76739e5ad35
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
4608eb9cf4c14276dc289a21c5318007a9212fc8d6f380869c2464009521e68d
4ae33b96315a8726404109e3a9d79fdbc89149b8ff68b724023ac7318cd4ad02
4c39aa96617a31c37c217450ac531e621c137fba7b4fe501193c7bfcab247942
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96
4e87d403169e5c9f9c706b28ff3c4c9fd9f30d3a4fd6c5e10298a0f56b0f3120
4ff4479b4c710affc1759bd991f2a3b4b99fc4fc0b4f54e611a5c22042433b3c
52f939d386a6479c2c9bca0eb302070e82dbca0551ae573a62c7c511e6eb99d1
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58066afc214ec9becbaa9e26054dd8c7487e0f6d3ca5e923517067dd8ee89b8b
596d9525c639fc53fbc787d74c10127fce8f011a0d056d3e9f1cd0a795030261
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
6068e194fbcc63e770a21498d0c7a8bf6ac91c75aea4325772d2b71aadd46ff8
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
766742132efd34c32b19346a9ae991e13bd05969694404f2705c050b3bbbb177
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8f2b07aa1e9189e9045c376ea6d936c29cc68820aedefc98a044aff4a03344d9
9191ef1ba868c010ec64bdc6025f716ca8e43e9d2495ede02874b52bff62a48e
91b7359595c8f1d6a72df149aa605ae5f74d500172e389a149f8d1c5ba942bdc
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
9abdb3b3eb61358ec6439f8588ba57d83b46137d500ccf3afbe62470f8f2cd46
9b9458aa62ea4fe933b616dcaca27830b30d9bd1610ee2f7563dc9289b782ff9
9d1d20907ba83d3f3470e59e4304e94a093514d204330dde7afea7056c13febd
9e91c58dffbaa4badfd833bf2f137b9c52af8455856c2f5f542e29f02d99cfc4
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a77cfbb63e71a7ffe2f7b827a8b67b7893a20b74e17afb9a1c0b8e9573f6fd95
b3bc67189db38c75aa6746e209528e5eef95beb5d62dfe1e38545d8707d07feb
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bc21faa61299c103daad43d39c6064a4c9feec3a9446b1e1e87b09595cfdd07c
bd59500def7de45cb7a70ca41442373e9253b3b98ef03b32ac023a49ca685c96
c90432fe2da4723ba3cbd7b08019c67661c1e2b02ed40e062c78e531b2dc44bb
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
e071be5dfd0660da71a9572d8726495c1ff99ac18f2f3ced3325941c2ec9a39d
e3acf1d915300db6e211f88441a43adef9e7bce778a267bc0ed987bbefc0c726
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ecf6782050f36bebc7a3abbf6af9141be8238e21252f90ea08221006bc4aad10
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
fe77e34f1764a618356ef7ddf559033d1bc7ea10f39e3348c0b7b1f187cfd518