www.trendmicro.com Open in urlscan Pro
23.56.162.160 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Submission: On October 24 via api (October 24th 2024, 12:57:37 pm UTC) from IN — Scanned from CA

Summary HTTP 238 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 50 IPs in 4 countries across 36 domains to perform 238 HTTP transactions. The main IP is 23.56.162.160, located in Secaucus, United States and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on June 10th 2024. Valid for: a year.

This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
49	23.56.162.160 23.56.162.160	16625 (AKAMAI-AS) (AKAMAI-AS)
8	104.18.86.42 104.18.86.42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.65.170 142.250.65.170	15169 (GOOGLE) (GOOGLE)
2	104.22.28.96 104.22.28.96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
28	3.168.102.45 3.168.102.45	16509 (AMAZON-02) (AMAZON-02)
10	23.44.201.149 23.44.201.149	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	142.250.81.238 142.250.81.238	15169 (GOOGLE) (GOOGLE)
1	35.201.125.192 35.201.125.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	104.18.32.137 104.18.32.137	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.111.194.12 34.111.194.12	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	23.39.36.184 23.39.36.184	16625 (AKAMAI-AS) (AKAMAI-AS)
4	142.251.35.163 142.251.35.163	15169 (GOOGLE) (GOOGLE)
12	142.250.65.200 142.250.65.200	15169 (GOOGLE) (GOOGLE)
2	23.204.6.193 23.204.6.193	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.239.22.30 23.239.22.30	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
2 2	142.251.32.98 142.251.32.98	15169 (GOOGLE) (GOOGLE)
3	34.230.99.111 34.230.99.111	14618 (AMAZON-AES) (AMAZON-AES)
18	23.33.42.75 23.33.42.75	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	142.251.40.238 142.251.40.238	15169 (GOOGLE) (GOOGLE)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
1	52.72.192.139 52.72.192.139	14618 (AMAZON-AES) (AMAZON-AES)
2	31.13.80.12 31.13.80.12	32934 (FACEBOOK) (FACEBOOK)
1	23.200.3.33 23.200.3.33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 11	138.199.40.58 138.199.40.58	60068 (CDN77 _) (CDN77 _)
2	108.139.29.47 108.139.29.47	16509 (AMAZON-02) (AMAZON-02)
2 4	172.217.165.134 172.217.165.134	15169 (GOOGLE) (GOOGLE)
2	104.22.70.197 104.22.70.197	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.225.63.116 13.225.63.116	16509 (AMAZON-02) (AMAZON-02)
1	104.96.84.186 104.96.84.186	16625 (AKAMAI-AS) (AKAMAI-AS)
3	172.253.122.156 172.253.122.156	15169 (GOOGLE) (GOOGLE)
1	68.67.179.166 68.67.179.166	29990 (ASN-APPNEX) (ASN-APPNEX)
1	23.33.42.88 23.33.42.88	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.251.40.228 142.251.40.228	15169 (GOOGLE) (GOOGLE)
2	142.250.80.34 142.250.80.34	15169 (GOOGLE) (GOOGLE)
2	142.250.64.99 142.250.64.99	15169 (GOOGLE) (GOOGLE)
2	31.13.80.36 31.13.80.36	32934 (FACEBOOK) (FACEBOOK)
2	99.83.231.3 99.83.231.3	16509 (AMAZON-02) (AMAZON-02)
1	172.67.39.148 172.67.39.148	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.162.178.190 139.162.178.190	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	139.177.182.128 139.177.182.128	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	18.173.219.106 18.173.219.106	16509 (AMAZON-02) (AMAZON-02)
3 6	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	172.66.0.227 172.66.0.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
12	54.149.48.201 54.149.48.201	16509 (AMAZON-02) (AMAZON-02)
1	18.238.49.96 18.238.49.96	16509 (AMAZON-02) (AMAZON-02)
2	52.28.215.114 52.28.215.114	16509 (AMAZON-02) (AMAZON-02)
4	35.171.10.243 35.171.10.243	14618 (AMAZON-AES) (AMAZON-AES)
238	50

49 23.56.162.160 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-56-162-160.deploy.static.akamaitechnologies.com

www.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.18.86.42 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.170 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.22.28.96 (None, )

ASN13335 (CLOUDFLARENET, US)

customer.cludo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 3.168.102.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-168-102-45.jfk52.r.cloudfront.net

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.44.201.149 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-201-149.deploy.static.akamaitechnologies.com

trendmicro.scene7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.81.238 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f14.1e100.net

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.125.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.125.201.35.bc.googleusercontent.com

cdn.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.32.137 (None, )

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.194.12 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 12.194.111.34.bc.googleusercontent.com

ixfd2-api.bc0a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.39.36.184 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-36-184.deploy.static.akamaitechnologies.com

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.35.163 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.65.200 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.204.6.193 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-204-6-193.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.239.22.30 (Fremont, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li743-30.members.linode.com

script.opentracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.32.98 (Queens, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.230.99.111 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-99-111.compute-1.amazonaws.com

datacloud.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 23.33.42.75 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-33-42-75.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

resources.trendmicro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 142.251.40.238 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.72.192.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-192-139.compute-1.amazonaws.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.80.12 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-yyz1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.3.33 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-3-33.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 138.199.40.58 (New York, United States) 1 redirects

ASN60068 (CDN77 _, GB)
PTR: 138-199-40-58.bunnyinfra.net

load.sumome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
media.sumome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.139.29.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-47.jfk50.r.cloudfront.net

widget.equally.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.165.134 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s70-in-f6.1e100.net

6240125.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.22.70.197 (None, )

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.63.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-116.ewr53.r.cloudfront.net

cdn.veritonic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.96.84.186 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-84-186.deploy.static.akamaitechnologies.com

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.122.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.179.166 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.33.42.88 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-33-42-88.deploy.static.akamaitechnologies.com

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.228 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.80.34 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.64.99 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f3.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.80.36 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-yyz1.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.231.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.162.178.190 (Frankfurt am Main, Germany)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 139-162-178-190.ip.linodeusercontent.com

log.opentracker.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.177.182.128 (Frankfurt am Main, Germany)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li2247-128.members.linode.com

log.leadboxer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

945-cxd-062.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.219.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-219-106.jfk52.r.cloudfront.net

v.eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.66.0.227 (United States)

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 54.149.48.201 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-48-201.us-west-2.compute.amazonaws.com

sumome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.49.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-96.jfk52.r.cloudfront.net

ip.veritonicmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.215.114 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-215-114.eu-central-1.compute.amazonaws.com

atr-eu.veritonicmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.171.10.243 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-10-243.compute-1.amazonaws.com

api.equally.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	trendmicro.com www.trendmicro.com resources.trendmicro.com	3 MB
28	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1314	137 KB
23	sumome.com 1 redirects load.sumome.com — Cisco Umbrella Rank: 21660 sumome.com — Cisco Umbrella Rank: 19912 media.sumome.com — Cisco Umbrella Rank: 56321	445 KB
23	6sc.co j.6sc.co — Cisco Umbrella Rank: 5626 c.6sc.co — Cisco Umbrella Rank: 6951 ipv6.6sc.co — Cisco Umbrella Rank: 5794 eps.6sc.co — Cisco Umbrella Rank: 11869 b.6sc.co — Cisco Umbrella Rank: 3611 v.eps.6sc.co — Cisco Umbrella Rank: 16729	24 KB
18	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34	22 KB
12	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
11	doubleclick.net 4 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 283 6240125.fls.doubleclick.net Failed stats.g.doubleclick.net — Cisco Umbrella Rank: 136 td.doubleclick.net — Cisco Umbrella Rank: 192	3 KB
10	scene7.com trendmicro.scene7.com	220 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 326	203 KB
6	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 321 www.linkedin.com — Cisco Umbrella Rank: 646	4 KB
6	equally.ai widget.equally.ai — Cisco Umbrella Rank: 114500 api.equally.ai — Cisco Umbrella Rank: 113672	122 KB
4	gstatic.com fonts.gstatic.com	96 KB
3	veritonicmetrics.com ip.veritonicmetrics.com — Cisco Umbrella Rank: 33633 atr-eu.veritonicmetrics.com — Cisco Umbrella Rank: 293646	592 B
3	google.com www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 147
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 4352	28 KB
3	tealiumiq.com datacloud.tealiumiq.com — Cisco Umbrella Rank: 7575	2 KB
3	go-mpulse.net s.go-mpulse.net — Cisco Umbrella Rank: 1607 c.go-mpulse.net — Cisco Umbrella Rank: 772	41 KB
3	youtube.com www.youtube.com — Cisco Umbrella Rank: 77	13 KB
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 962	609 B
2	t.co t.co — Cisco Umbrella Rank: 859	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	3 KB
2	google.ca www.google.ca — Cisco Umbrella Rank: 12143	126 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	73 KB
2	opentracker.net script.opentracker.net — Cisco Umbrella Rank: 215397 log.opentracker.net — Cisco Umbrella Rank: 196892	7 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3657	7 KB
2	bc0a.com cdn.bc0a.com — Cisco Umbrella Rank: 13075 ixfd2-api.bc0a.com — Cisco Umbrella Rank: 15940	15 KB
2	cludo.com customer.cludo.com — Cisco Umbrella Rank: 15342	80 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	5 KB
1	mktoresp.com 945-cxd-062.mktoresp.com — Cisco Umbrella Rank: 682729	318 B
1	leadboxer.com log.leadboxer.com — Cisco Umbrella Rank: 180418	216 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 479	701 B
1	veritonic.com cdn.veritonic.com — Cisco Umbrella Rank: 32355	3 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 784	14 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1568	676 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 960	15 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 498	306 B
238	36

	Domain	Requested by
49	www.trendmicro.com	www.trendmicro.com
28	tags.tiqcdn.com	www.trendmicro.com
18	www.google-analytics.com	tags.tiqcdn.com www.trendmicro.com www.googletagmanager.com
16	b.6sc.co	www.trendmicro.com
12	sumome.com	load.sumome.com www.trendmicro.com
12	www.googletagmanager.com	tags.tiqcdn.com www.googletagmanager.com www.google-analytics.com
10	trendmicro.scene7.com	www.trendmicro.com
8	load.sumome.com	1 redirects www.trendmicro.com
8	cdn.cookielaw.org	www.trendmicro.com cdn.cookielaw.org
5	px.ads.linkedin.com	2 redirects www.trendmicro.com
4	api.equally.ai	www.trendmicro.com
4	6240125.fls.doubleclick.net	www.trendmicro.com tags.tiqcdn.com
4	fonts.gstatic.com	fonts.googleapis.com
3	media.sumome.com	www.trendmicro.com
3	stats.g.doubleclick.net	www.trendmicro.com www.googletagmanager.com
3	static.addtoany.com	tags.tiqcdn.com static.addtoany.com www.trendmicro.com
3	datacloud.tealiumiq.com	www.trendmicro.com tags.tiqcdn.com
3	www.youtube.com	www.trendmicro.com www.youtube.com
2	atr-eu.veritonicmetrics.com	www.trendmicro.com
2	analytics.twitter.com	www.trendmicro.com
2	t.co	www.trendmicro.com
2	v.eps.6sc.co	www.trendmicro.com
2	eps.6sc.co	www.trendmicro.com
2	www.facebook.com	www.trendmicro.com
2	www.google.ca	www.trendmicro.com
2	td.doubleclick.net	www.googletagmanager.com
2	analytics.google.com	www.googletagmanager.com
2	widget.equally.ai	tags.tiqcdn.com widget.equally.ai
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	cm.g.doubleclick.net	2 redirects
2	munchkin.marketo.net	www.trendmicro.com munchkin.marketo.net
2	s.go-mpulse.net	www.trendmicro.com
2	customer.cludo.com	www.trendmicro.com
2	fonts.googleapis.com	www.trendmicro.com
1	ip.veritonicmetrics.com	www.trendmicro.com
1	www.linkedin.com	1 redirects
1	945-cxd-062.mktoresp.com	munchkin.marketo.net
1	log.leadboxer.com	www.trendmicro.com
1	log.opentracker.net	www.trendmicro.com
1	www.google.com	www.googletagmanager.com
1	ipv6.6sc.co	www.trendmicro.com
1	c.6sc.co	www.trendmicro.com
1	secure.adnxs.com	www.trendmicro.com
1	c.go-mpulse.net	www.trendmicro.com
1	cdn.veritonic.com	tags.tiqcdn.com
1	snap.licdn.com	tags.tiqcdn.com
1	sp.analytics.yahoo.com	www.trendmicro.com
1	static.ads-twitter.com	tags.tiqcdn.com
1	resources.trendmicro.com	tags.tiqcdn.com
1	j.6sc.co	tags.tiqcdn.com
1	script.opentracker.net	tags.tiqcdn.com
1	ixfd2-api.bc0a.com	cdn.bc0a.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdn.bc0a.com	tags.tiqcdn.com
238	54

This site contains links to these domains. Also see Links.

Domain
vicone.com
www.zerodayinitiative.com
community-trendmicro.force.com
trendmicro.my.site.com
newsroom.trendmicro.com
resources.trendmicro.com
success.trendmicro.com
signin.v1.trendmicro.com
cloudone.trendmicro.com
tm.login.trendmicro.com
signup.cj.com
www.addtoany.com
www.cybereason.com
blog.talosintelligence.com
portal.xdr.trendmicro.com
documents.trendmicro.com
www.linkedin.com
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
www.trendmicro.cz

Subject Issuer	Validity	Valid
www.trendmicro.com Entrust Certification Authority - L1M	`2024-06-10` - `2025-07-09`	a year	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
customer.cludo.com WE1	`2024-08-26` - `2024-11-24`	3 months	crt.sh
tags.tiqcdn.com Amazon RSA 2048 M02	`2024-03-19` - `2025-04-17`	a year	crt.sh
*.scene7.com DigiCert TLS RSA SHA256 2020 CA1	`2024-10-09` - `2025-10-11`	a year	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
cdn.bc0a.com WR3	`2024-09-06` - `2024-12-05`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
ixfd-api.bc0a.com WR3	`2024-10-17` - `2025-01-15`	3 months	crt.sh
akstat.io DigiCert TLS RSA SHA256 2020 CA1	`2024-07-31` - `2025-07-31`	a year	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.opentracker.net Sectigo RSA Domain Validation Secure Server CA	`2024-03-11` - `2025-04-11`	a year	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
resources.trendmicro.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
*.tealiumiq.com Amazon RSA 2048 M03	`2024-06-25` - `2025-07-23`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-07-30` - `2025-01-22`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-02` - `2024-10-31`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
equally.ai Amazon RSA 2048 M03	`2024-04-05` - `2025-05-03`	a year	crt.sh
*.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
static.addtoany.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
cdn.veritonic.com Amazon RSA 2048 M02	`2024-07-25` - `2025-08-23`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.google.ca WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh
*.leadboxer.com Sectigo RSA Organization Validation Secure Server CA	`2024-08-13` - `2025-09-12`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
v.eps.6sc.co Amazon RSA 2048 M03	`2024-09-06` - `2025-10-05`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
load.sumome.com R11	`2024-09-12` - `2024-12-11`	3 months	crt.sh
*.sumome.com Amazon RSA 2048 M03	`2024-01-18` - `2025-02-15`	a year	crt.sh
media.sumome.com R10	`2024-10-17` - `2025-01-15`	3 months	crt.sh
*.veritonicmetrics.com Amazon RSA 2048 M03	`2024-08-26` - `2025-09-24`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Frame ID: 571D00B381795939BDF243FCB8ACE294
Requests: 226 HTTP requests in this frame

Frame: https://6240125.fls.doubleclick.net/activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545
Frame ID: F8517018F2CFE6BFF0DF0189F8786373
Requests: 2 HTTP requests in this frame

Frame: https://6240125.fls.doubleclick.net/activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478
Frame ID: DC6BE9651ED0ED03D288A97C29126CB2
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-PCCSVH5M9H&gacid=1237141721.1729774637&gtm=45je4al0v888878635za200&dma=0&gcs=G111&gcd=13t3t3t3t5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101794737~101823847&z=1492525928
Frame ID: 2FF70798C1CC597BFADA1ED6E448A01C
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.trendmicro.com
Frame ID: 847B0DDB1D5577EFF887A7705A67514C
Requests: 1 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: E44E3D67023A102D28BEA3671D0A5330
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-GBTVB6FHY4&gacid=1237141721.1729774637&gtm=45je4al0v9126309663za200&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101794737~101823847&z=1959490810
Frame ID: F82002BC7A801EC84B101D51850B7B12
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unmasking Prometei A Deep Dive Into Our MXDR Findings | Trend Micro (DE)

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

SumoMe (Widgets) Expand

Overall confidence: 100%
Detected patterns

load\.sumome\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

238
Requests

98 %
HTTPS

0 %
IPv6

36
Domains

54
Subdomains

50
IPs

4
Countries

6145 kB
Transfer

14595 kB
Size

56
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://vicone.com/en
Title: Automobilbranche

Search URL Search Domain Scan URL

URL: https://www.zerodayinitiative.com/about/
Title: Zero-Day-Initiative (ZDI)

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Gpartner/s/
Title: Anmeldung für Partner

Search URL Search Domain Scan URL

URL: https://trendmicro.my.site.com/Gpartner/s/partner-locator?language=en_US
Title: Partner suchen

Search URL Search Domain Scan URL

URL: https://newsroom.trendmicro.com/
Title: Kontakt aufnehmen

Search URL Search Domain Scan URL

URL: https://resources.trendmicro.com/Under-Attack-Form-de.html
Title: Sie werden angegriffen?

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/dcx/s/?language=en_US
Title: Support-Portal für Unternehmen

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/virus-and-threat-help
Title: Hilfe zu Malware und Bedrohungen

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/renewals-and-registration
Title: Hilfe zu Malware und Bedrohungen

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/contact-support-europe
Title: Kontakt mit dem Support

Search URL Search Domain Scan URL

URL: https://signin.v1.trendmicro.com/
Title: Vision One

Search URL Search Domain Scan URL

URL: https://community-trendmicro.force.com/Gpartner/s/login/?language=en_US&ec=302&startURL=%2FGpartner%2Fs%2F
Title: Partnerportal

Search URL Search Domain Scan URL

URL: https://cloudone.trendmicro.com/
Title: Cloud One

Search URL Search Domain Scan URL

URL: https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php
Title: Produktaktivierung und -management

Search URL Search Domain Scan URL

URL: https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t
Title: Referenzpartner

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&title=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)

Search URL Search Domain Scan URL

URL: https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
Title: as far back as 2016

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/prometei-botnet-improves/
Title: in late 2022

Search URL Search Domain Scan URL

URL: https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence_insights?name=Unmasking%20Prometei:%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings
Title: Unmasking Prometei: A Deep Dive Into Our MXDR Findings

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/assets/txt/Prometei_IOCSwMrOESw.txt
Title: here

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/trend-micro-europe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/TrendMicroEurope

Search URL Search Domain Scan URL

URL: https://twitter.com/TrendMicroDACH

Search URL Search Domain Scan URL

URL: https://www.instagram.com/trendmicro/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/TrendMicroEurope

Search URL Search Domain Scan URL

URL: https://success.trendmicro.com/en-US/
Title: Support-Portal für Unternehmen

Search URL Search Domain Scan URL

URL: http://www.trendmicro.cz/
Title: Tschechische Republik

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 108

https://cm.g.doubleclick.net/pixel?google_nid=tealium_dmp&google_cm&tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tealium_dmp&google_cm=&tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_tc= HTTP 302
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_gid=CAESEA_Gig00nISR51oAl6BCXjc&google_cver=1

Request Chain 113

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186 HTTP 302
https://6240125.fls.doubleclick.net/activityi;dc_pre=CKedqNaIp4kDFXUn-QAddUArPA;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186

Request Chain 118

https://load.sumome.com/ HTTP 301
https://load.sumome.com/sumome.js

Request Chain 122

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478 HTTP 302
https://6240125.fls.doubleclick.net/activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478

Request Chain 168

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545 HTTP 302
https://6240125.fls.doubleclick.net/activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545

Request Chain 186

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2908409%26time%3D1729774638234%26li_adsId%3Dd077d95d-a2f2-447b-8797-610eca3465a9%26url%3Dhttps%253A%252F%252Fwww.trendmicro.com%252Fde_de%252Fresearch%252F24%252Fj%252Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&cookiesTest=true&liSync=true

238 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html Show response
www.trendmicro.com/de_de/research/24/j/ 199 KB
37 KB 232ms
88ms Document
text/html 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6c04d9bf543d950d0a664dcf8927022d547b28227d31c34b631b87de46ab120e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 36994
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
content-type: text/html;charset=utf-8
date: Thu, 24 Oct 2024 12:57:15 GMT
server: nginx
server-timing: cdn-cache; desc=HIT edge; dur=1 ak_p; desc="1729774635265_398664804_842639735_27_7215_36_98_255";dur=1
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,2
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-prod-n-02: Yes
x-xss-protection: 1;mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 339 KB
49 KB 113ms
46ms Script
application/javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ec6e60eccd6b2d3ff7edf499b388216646cd18d1341bef9ddb6b66148bec3f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: eyeKvIW5tqB8G5ZfBpfOTA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE8A808848BAB
age: 52966
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 25 Oct 2024 12:57:15 GMT
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 21:19:17 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: f33b4053-101e-00b9-7c90-1a7084000000
cf-ray: 8d7a21aff9efac25-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 49679
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 108ms
42ms Script
application/javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: qVqAwzZMp5y69q24H0KNhg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF32853A75668
x-ms-lease-status: unlocked
age: 71413
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 17:07:02 GMT
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Wed, 23 Oct 2024 06:02:50 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f70f5524-b01e-0073-3367-25e349000000
cf-ray: 8d7a21aff9ecac25-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 jquery.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 111 KB
34 KB 116ms
112ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640448_410_9604_37_0_219";dur=1
content-length: 34015
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 11:31:39 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 utils.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 137ms
133ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640449_404_9390_37_0_219";dur=1
content-length: 3224
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 14:02:09 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 css
fonts.googleapis.com/ 28 KB
2 KB 168ms
60ms Stylesheet
text/css 142.250.65.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.170 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f10.1e100.net

Software

ESF /

Resource Hash

87f3c566fded467082953eef2a96ae49cce26e2ee4d5f7dde84d95f6da5858e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 24 Oct 2024 12:56:45 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 cludo-search.min.css
customer.cludo.com/css/296/1798/ 16 KB
3 KB 109ms
51ms Stylesheet
text/css 104.22.28.96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.22.28.96 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=300
content-encoding: br
cf-cache-status: HIT
etag: W/"0238c4e6e55d81:0"
age: 84590
cf-ray: 8d7a21afed6cac2e-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: text/css
last-modified: Thu, 21 Apr 2022 10:55:26 GMT
vary: Accept-Encoding
server: cloudflare
x-lb: 2

GET
H2 200 clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 445 KB
41 KB 87ms
84ms Stylesheet
text/css 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

fccc0c93601e70e152b4337e6448f90fe3771495da1c42c703a8181347b479b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640446_402_9932_37_0_255";dur=1
content-length: 41746
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: text/css;charset=utf-8
last-modified: Mon, 21 Oct 2024 19:43:27 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 header-footer.min.css
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 77 KB
7 KB 110ms
108ms Stylesheet
text/css 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

b8217635d6b5c4c2041a155603a487da7b6fab112152e8095b23b660a32ee5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640447_408_9630_37_0_255";dur=1
content-length: 7003
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: text/css;charset=utf-8
last-modified: Mon, 21 Oct 2024 16:32:59 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 utag.sync.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 138ms
32ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.sync.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fdf1fceaeb7550d275b69644a89b96e5c6346de1b511bf4b3d29a6e1719d966d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=300
content-encoding: br
x-amz-version-id: Dn5yZXqIM1qa6mbH1Iw31.c263oeg7Mt
etag: W/"6c1a51d86100950c63a5454620267450"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: H-M-SEWj_Lv6ylgeFWSrh8WJP695aDcxJ49xjtXIXmZy_rWN5Esz5A==
date: Thu, 24 Oct 2024 12:57:11 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:07 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 tm-logo-red-white-t.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/ 5 KB
3 KB 139ms
137ms Image
image/svg+xml 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

content-encoding: gzip
etag: "154e-5f3af05760400"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640450_411_9316_37_0_182";dur=1
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/svg+xml
vary: Accept-Encoding
content-disposition: attachment; filename="tm-logo-red-white-t.svg"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
last-modified: Thu, 02 Feb 2023 03:18:40 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 2173
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 trend-vision-one-laptop-console-nav.svg
www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/ 529 KB
381 KB 142ms
140ms Image
image/svg+xml 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/console-images/navigation/trend-vision-one-laptop-console-nav.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

content-encoding: gzip
etag: "8428e-60a606b8ffa80"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:58:29 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640451_421_9749_37_0_182";dur=1
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/svg+xml
vary: Accept-Encoding
content-disposition: attachment; filename="trend-vision-one-laptop-console-nav.svg"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=74
last-modified: Fri, 17 Nov 2023 22:11:38 GMT
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 389784
x-xss-protection: 1;mode=block
server: nginx

GET
H2 200 sps-mobile-security-enterprise-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 20 KB
20 KB 185ms
56ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "183303c0127c38a2849f7046d6cccef2"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWXsmWcsAAAMTgAACgAoeZ94gIABUUwmmgNMQinpphTajYQvKwELeE/OVgBtGKtmHupZyE1aayT3xGL5wi+DNlz8XckU4UJB7JlnL
expires: Thu, 24 Oct 2024 17:41:02 GMT
access-control-allow-origin: *
content-length: 19998
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.3937609

GET
H2 200 xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 18 KB
18 KB 128ms
76ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "b3ffdce154f5ac33f90bafd0b8f52ddf"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWSzIeOkAAAITgAACgAoOZ95AIAAxTJiZBkYUGTQMGpD6ZCPsuEfgkoW50OJVGIEuNhB8XckU4UJAsyHjpA==
expires: Thu, 24 Oct 2024 18:35:21 GMT
access-control-allow-origin: *
content-length: 18350
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.393760e

GET
H2 200 cloud-one-workload-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 20 KB
21 KB 67ms
42ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
akamai-grn: 0.55c82c17.1729774635.3937637
etag: "fd80448de919134c924f18226b59ecd2"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWVD58OwAAAMTgAACgAoub56gIABIaptRnqJ6hmnpQoGmhkZMSSLjJ2xPlk8aolRMHW9P0K4v6ZmsZxYj7mYYAH4u5IpwoSCh8+HY
expires: Thu, 24 Oct 2024 18:35:22 GMT
access-control-allow-origin: *
content-length: 20734
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-adobe-cachekey: 0C5C788F3C71A099C3F0983A95A8A62D
x-akamai-cache: Hit

GET
H2 200 cloud-one-container-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 22 KB
23 KB 74ms
53ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "0bd7f96f29e779fac6dc954866b8de36"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWc9xaQ0AAAKTgAACgAouZ54AIAAxTTIxMTEGqekZkm0empyIbj0HcSqB1ZIzRPumGYlwpg/X3llbou5IpwoSGe4tIaA=
expires: Thu, 24 Oct 2024 14:05:37 GMT
access-control-allow-origin: *
content-length: 22816
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:25 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.3937638

GET
H2 200 cloud-one-file-storage-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 10 KB
11 KB 132ms
112ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "81b7f638d5ac80cfde194124da99cc5e"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWaHvYKkAAAMTgAACgAov554AIAAiJpPU9qjRtGahTCaaA0xAgVNPUgQa0soHgmo+qZZMeYfZyOm7hWBvwXckU4UJCh72CpA=
expires: Thu, 24 Oct 2024 19:01:18 GMT
access-control-allow-origin: *
content-length: 10478
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.3937641

GET
H2 200 zero-trust-access-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 24 KB
24 KB 74ms
54ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
akamai-grn: 0.55c82c17.1729774635.3937642
etag: "54553bd846274282dee4b07c8fd3198b"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWRRgqYoAAAKTgAACgAouZ54QIAAxTJiZBkYRGmI0aaYkQvgyR6UW88UjS0OOQNJdMCXWOiWk3XxdyRThQkBRgqYo
expires: Thu, 24 Oct 2024 21:13:10 GMT
access-control-allow-origin: *
content-length: 24410
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
content-type: image/webp
server: Unknown
x-adobe-cachekey: 5BB35AB042566BA9BCB5B6A56370A54E
x-akamai-cache: Hit

GET
H2 200 all-products-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 64 KB
64 KB 73ms
54ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
akamai-grn: 0.55c82c17.1729774635.3937643
etag: "891ae1c6af5064a7f40d8b2f96a4ea68"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWQAjRP8AAAITgAACgAouZ94AIAAxTJiZBkYUND1NNMmI6GwgBZcHKQWGdiFA8L4puS7nSfF3JFOFCQACNE/w
expires: Thu, 24 Oct 2024 22:09:53 GMT
access-control-allow-origin: *
content-length: 65306
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Mon, 27 Mar 2023 00:57:09 GMT
content-type: image/webp
server: Unknown
x-adobe-cachekey: 2F94EFFD713E3B68C3B8BA124A22E23C
x-akamai-cache: Hit

GET
H2 200 asrm-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 14 KB
15 KB 71ms
53ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1ac209128f661abb8a982d1bdb20d08e"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWXWqKgQAAAGTgAACgAouZ5wAIAAih6jTRg1ChppgAZYQojzNFvCnA3RgB2Kn4u5IpwoSDrVFQIA=
expires: Thu, 24 Oct 2024 19:43:27 GMT
access-control-allow-origin: *
content-length: 14534
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:43:26 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.3937644

GET
H2 200 email-security-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 24 KB
25 KB 131ms
112ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-44-201-149.deploy.static.akamaitechnologies.com

Software

Unknown /

Resource Hash

3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "adeabd4b80e2b5f6ab0d131473fa84c3"
x-adobe-smart-imaging: 0
expires: Thu, 24 Oct 2024 20:50:41 GMT
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
last-modified: Wed, 04 Jan 2023 02:50:40 GMT
content-type: image/webp
strict-transport-security: max-age=31536000; includeSubDomains
-x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWRAIvj0AAAITgAACgAouZ54gIAAxTJiZBkYUNDIaegk92DgGNMkdi6AkXb2vg3gSTUZJXJ/F3JFOFCQEAi+PQA==
-x-adobe-assetlist: [trendmicro/email-security-console-shot]
access-control-allow-origin: *
content-length: 24906
akamai-grn: 0.55c82c17.1729774635.3937645
server: Unknown
x-adobe-cachekey: 711FC40BFBA4ED5D5FF9207B4B3379C6
x-akamai-cache: Hit

GET
H3 200 search-script.js Show response
customer.cludo.com/scripts/bundles/ 427 KB
77 KB 53ms
43ms Script
application/javascript 104.22.28.96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://customer.cludo.com/scripts/bundles/search-script.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.22.28.96 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b542a8a622ba0605abd4a9bd0e3bf7270f4369489003f21d7f04693f8b7902f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=300
content-encoding: br
cf-cache-status: HIT
etag: W/"06cdac89adb1:0"
age: 92
cf-ray: 8d7a21b1beffac2e-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 11:42:48 GMT
vary: Accept-Encoding
server: cloudflare
x-lb: 2

GET
H2 200 share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 648 B
737 B 76ms
57ms Image
image/svg+xml 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=439
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 13:04:34 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635822_398664804_842642320_131_7889_38_0_146";dur=1
content-length: 362
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/ 409 B
655 B 74ms
56ms Image
image/svg+xml 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=439
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 13:04:34 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635822_398664804_842642322_132_7748_38_0_146";dur=1
content-length: 281
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure1.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 129 KB
130 KB 251ms
233ms Image
image/jpeg 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure1.jpg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b48790495eddeae3e0430f64ecc844e3c3697501416e416cc8debc2d34211c31

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "20556-625203d3f3e40"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=88, origin; dur=72, ak_p; desc="1729774635822_398664804_842642323_16045_7762_37_0_146";dur=1
content-length: 132438
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/jpeg
last-modified: Wed, 23 Oct 2024 07:57:37 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure2.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 161 KB
161 KB 211ms
193ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure2.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

14ac47a3f8c91eddbb4c93a48b64e6122e31887390d8bf874dbbea6734e420d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2834e-6251ee32eb6c0"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=52, origin; dur=72, ak_p; desc="1729774635822_398664804_842642324_12541_7645_37_0_146";dur=1
content-length: 164686
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:20:51 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure3.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 292 KB
292 KB 256ms
239ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure3.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f20b7f18279af9a017fdf103c3f1563bdf7a51085dc768141c16c29e0aa69d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "48f68-6251ee3a8c8c0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=40, origin; dur=72, ak_p; desc="1729774635857_398664804_842642515_11252_6957_37_0_146";dur=1
content-length: 298856
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:20:59 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure4.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 122 KB
122 KB 271ms
254ms Image
image/jpeg 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure4.jpg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

2f4a8b2033486a210029ae51394b7d80caa72b1e1c8c322e9fd6e59a9eefbb5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "1e74c-6251ee3f51400"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=34, origin; dur=82, ak_p; desc="1729774635856_398664804_842642516_11616_6792_37_0_146";dur=1
content-length: 124748
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/jpeg
last-modified: Wed, 23 Oct 2024 06:21:04 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure5.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 43 KB
43 KB 277ms
260ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure5.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b63f6e5a8a265a75b9b48aa4e989103767103eae931f6e07e75a867a66f1a0b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "aaff-6251ee4139880"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=38, origin; dur=69, ak_p; desc="1729774635863_398664804_842642517_11427_6361_37_0_146";dur=1
content-length: 43775
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:06 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure6.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 47 KB
47 KB 218ms
202ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure6.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ba03811c426a87e10d1b6a3744fd8d91843e5a2ebb1d62f681e1ced558375c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "bbb1-6251ee4415f40"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=33, origin; dur=65, ak_p; desc="1729774635856_398664804_842642518_9759_7072_37_0_146";dur=1
content-length: 48049
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:09 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure7.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 76 KB
77 KB 316ms
300ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure7.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dc3855b86a189b170776cf2b7ab327151d2818495a447eaf9005afd98ad69bbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "131f8-6251ee45fe3c0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:17 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=114, origin; dur=65, ak_p; desc="1729774635870_398664804_842642519_19155_6631_36_0_146";dur=1
content-length: 78328
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:11 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure8.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 72 KB
73 KB 458ms
442ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure8.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6798b334b1b266b9770232d8c0d0099e23b6640c6debb3908c58383c30a91bd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "120a2-6251ee48daa80"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:17 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=100, origin; dur=252, ak_p; desc="1729774635856_398664804_842642520_35166_6613_37_0_146";dur=1
content-length: 73890
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:14 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure9.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 35 KB
35 KB 279ms
264ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure9.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a69c1d25c1bcf2144debc26ca1a27f6194f3d98473071a3f38ca9a40bfa82b75

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "8a6f-6251ee48daa80"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=37, origin; dur=86, ak_p; desc="1729774635856_398664804_842642521_12311_6719_37_0_146";dur=1
content-length: 35439
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:14 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure10.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 99 KB
100 KB 219ms
204ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure10.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

09671211b3dfce338d7b10e0facceb4e544a681f06578357653142c67c1c9738

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "18bfd-6251ee59110c0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=31, origin; dur=61, ak_p; desc="1729774635856_398664804_842642522_9295_9134_37_0_146";dur=1
content-length: 101373
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:31 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure11.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 74 KB
75 KB 284ms
270ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure11.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d2add63014ec164711e0bcfa84e92b53f72b286924c5e22e5e3c9b4d2dd25dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "12857-6251ee5bed780"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=98, origin; dur=72, ak_p; desc="1729774635856_398664804_842642523_17041_9122_36_0_146";dur=1
content-length: 75863
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:34 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure12.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 59 KB
59 KB 369ms
355ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure12.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d46743617f18e2efd828df550093f9f45643dbb273eb527ca35c8254cc6a3e18

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "ebdf-6251ee5ec9e40"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:17 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=140, origin; dur=64, ak_p; desc="1729774635876_398664804_842642633_20897_8108_36_0_146";dur=1
content-length: 60383
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:37 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure13.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 90 KB
91 KB 277ms
265ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure13.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3da90cb72f6e3e0d7ac0a5117bd5bd0655d25af44513c191079f859b3efc5b32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "1698c-6251ee61a6500"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=26, origin; dur=69, ak_p; desc="1729774635876_398664804_842642634_10039_8179_37_0_146";dur=1
content-length: 92556
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:40 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure14.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 143 KB
144 KB 287ms
275ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure14.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7a7280f1650ce525c8ef8072dbedcb0ad083493a82e588613c7057cdf2eda329

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "23c8c-6251ee6ff46c0"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=49, origin; dur=74, ak_p; desc="1729774635876_398664804_842642635_12770_8047_37_0_146";dur=1
content-length: 146572
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:21:55 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure15.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 168 KB
169 KB 294ms
282ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure15.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

fd62f3f14e54832fd06aa307ddb2385d956be87969d9d6b330f47c15053d5984

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "2a08b-6251ee98f6780"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=24, origin; dur=70, ak_p; desc="1729774635884_398664804_842642636_10655_5783_37_0_146";dur=1
content-length: 172171
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:22:38 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure16.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 139 KB
139 KB 301ms
288ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure16.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e9a8f9fcf432531424d3666b4e613b7977f2a12d4627554e9152cb895c18bd19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "22a1c-6251eecc76100"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=59, origin; dur=71, ak_p; desc="1729774635876_398664804_842642637_13520_7089_36_0_146";dur=1
content-length: 141852
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:23:32 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure17.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 146 KB
147 KB 316ms
303ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure17.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1f30fa6c414ccbf78465b96e421d266c3ef9b09c24b69fe19434906ea79cba71

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "249ac-6251eed7e7c00"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:16 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=32, origin; dur=78, ak_p; desc="1729774635876_398664804_842642638_11452_7359_37_0_146";dur=1
content-length: 149932
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:23:44 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure18.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 109 KB
109 KB 324ms
312ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure18.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d8e64236dc73bfdfe4eb0e876db2c6b7ef3d068b3ea9646ca0091f283a08398c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "1b36c-6251eeece2d80"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=41, origin; dur=70, ak_p; desc="1729774635876_398664804_842642639_11630_6968_37_0_146";dur=1
content-length: 111468
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:24:06 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI%20figure19.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 130 KB
131 KB 327ms
315ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI%20figure19.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6134e5e0a001daf2d5fe6b645a5efa85314c1fcf95f5407c20def106dfdec557

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "20920-6251ee2685980"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:16 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=32, origin; dur=66, ak_p; desc="1729774635876_398664804_842642640_10324_6218_37_0_146";dur=1
content-length: 133408
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:20:38 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Picture18.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 37 KB
38 KB 373ms
361ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/Picture18.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

85b9993d5c3520b413924e989acd330dd81b514a473620078dff49b35fe054df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "959c-6251ee23a92c0"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Thu, 24 Oct 2024 12:57:17 GMT
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=39, origin; dur=202, ak_p; desc="1729774635876_398664804_842642641_24547_6475_36_0_146";dur=1
content-length: 38300
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:20:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 PROMETEI-figure20.png
www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/ 55 KB
55 KB 412ms
400ms Image
image/png 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings/PROMETEI-figure20.png

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

7263aa840c4c665c1fa89963da7cdf2e29c62f2c0c624fccc609d215ad4217c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: max-age=1
etag: "da2a-6251eef1a78c0"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:17 GMT
x-prod-n-02: Yes
accept-ranges: bytes
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=196, origin; dur=70, ak_p; desc="1729774635888_398664804_842642642_28355_7518_39_0_146";dur=1
content-length: 55850
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/png
last-modified: Wed, 23 Oct 2024 06:24:11 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 granite.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 67ms
42ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635810_398664804_842642247_26_9174_38_0_182";dur=1
content-length: 1422
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 04:33:02 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 clientLibs.min.js Show response
www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/ 840 B
783 B 92ms
67ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

898241655767777d954a01288720b8487c6bfcaf831a0243b1e19a5cc67906a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: max-age=115
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635828_398664804_842642315_701_7942_38_0_182";dur=1
content-length: 418
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Thu, 19 Jan 2023 18:06:56 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 sly.min.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 18 KB
7 KB 200ms
175ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

content-encoding: br
etag: "48de-56a21837c9c00-gzip"
x-content-type-options: nosniff
expires: Sun, 27 Oct 2024 23:26:38 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635934_398664804_842642316_11291_7021_37_0_182";dur=1
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Tue, 22 Oct 2024 09:11:05 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=296963
x-prod-n-02: Yes
accept-ranges: bytes
content-length: 6497
x-xss-protection: 1;mode=block
server: Akamai Resource Optimizer

GET
H2 200 jwplayer.js Show response
www.trendmicro.com/content/dam/trendmicro/global/core-library/ 81 KB
23 KB 154ms
130ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

content-encoding: br
etag: "1457a-56a21837c9c00-gzip"
x-content-type-options: nosniff
x-prod-n-01: Yes
expires: Sat, 26 Oct 2024 10:54:49 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635878_398664804_842642317_5702_7444_36_0_182";dur=1
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Thu, 24 Oct 2024 02:26:06 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; preload
cache-control: max-age=165454
accept-ranges: bytes
content-length: 22997
x-xss-protection: 1;mode=block
server: Akamai Resource Optimizer

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 434ms
70ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

ESF /

Resource Hash

d426094c168051f30c71c81f5a51fe910cd31d2cdb2138d71ea0db1029c1186f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
x-content-type-options: nosniff
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires: Thu, 24 Oct 2024 12:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 clientlib-trendresearch.min.js Show response
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/ 710 KB
144 KB 89ms
66ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

1d4b9c9db31602e3a45ae73efab893ceb4bac5d793014bbb44f3575fc4351681

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635829_398664804_842642318_772_7340_38_0_182";dur=1
content-length: 146513
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Mon, 21 Oct 2024 20:38:35 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 header-footer.min.js Show response
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/ 44 KB
7 KB 78ms
55ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

e2d076558e62fb356fd49d3aab6a28e8a0fa5c7175804985663c1f9f64b5f6f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635822_398664804_842642319_134_7666_38_0_182";dur=1
content-length: 7115
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 05:53:56 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 821060e3-3f9c-4a2f-8613-8e0db4841f79.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/ 5 KB
2 KB 104ms
51ms XHR
application/json 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/821060e3-3f9c-4a2f-8613-8e0db4841f79.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8dbeda740f1f4c121c84b5a63dcdb672ef6f9f130a7734f5e981113e5bbc3b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: 7EYbqP6usH2xfUuhtZJ7cQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE8A80AA9213B
age: 52966
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 25 Oct 2024 12:57:15 GMT
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/json
last-modified: Wed, 09 Oct 2024 21:19:21 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 5a0f33eb-601e-001c-4190-1a4b9d000000
cf-ray: 8d7a21b0fbadac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1820
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 autopilot_sdk.js Show response
cdn.bc0a.com/autopilot/f00000000017219/ 37 KB
14 KB 99ms
27ms Script
application/javascript 35.201.125.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.sync.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.125.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

192.125.201.35.bc.googleusercontent.com

Software

UploadServer /

Resource Hash

8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f

Security Headers

Name	Value
Content-Security-Policy	default-src self; script-src self; style-src self;
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://www.trendmicro.com/

Response headers

access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=x1TL3Q==, md5=Oq0I5hLsqrsy+tjjbZlXjg==
etag: "3aad08e612ecaabb32fad8e36d99578e"
age: 191
x-goog-meta-sdk_canonical_host
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-meta-content_only: false
last-modified: Fri, 20 Oct 2023 15:39:22 GMT
content-type: application/javascript
x-guploader-uploadid: AHmUCY2jogMsaqTaE4JFS0TRReja5XC3Avxb6XvYUNuyuKY_yg9U6kJoJDNft3sD-Xk-0MLUGMD0uQP5nw
x-goog-meta-custom: true
x-goog-meta-marvel_config_consistency_custom: {"data-url":"dataservice.tmok.tm/tc.png,trendmicro.scene7.com,0,.66,1&qlt=80,1.0&amp","data-dropsrcset":"true","data-customerid":"f00000000017219","data-ignorepath":"uat-author.we.trendmicro.com,uat.we.trendmicro.com,prod-author.we.trendmicro.com,qa-author.we.trendmicro.com,qa.we.trendmicro.com"}
x-goog-meta-spa: false
cache-control: public, max-age=360
x-goog-meta-disable_debug_elements: false
accept-ranges: bytes
x-goog-generation: 1697816362499806
content-length: 12736
x-goog-meta-publishingdate: 2023-10-20 15:39:22
content-language: en
server: UploadServer
x-goog-meta-marvel_enabled: false
x-goog-metageneration: 3
x-goog-stored-content-encoding: gzip
x-goog-meta-sdk_request_parameters_case_sensitive: false
x-goog-meta-marvel_test_mode: false
expires: Thu, 24 Oct 2024 13:00:04 GMT
x-goog-stored-content-length: 12736
date: Thu, 24 Oct 2024 12:54:04 GMT
x-goog-meta-sdk_canonical_protocol
vary: Accept-Encoding
x-goog-meta-sdk_account_id: f00000000017219
strict-transport-security: max-age=63072000; includeSubDomains
x-goog-meta-sdk_log_level: 2
content-security-policy: default-src self; script-src self; style-src self;
x-goog-meta-marvel_customer_id
x-goog-storage-class: MULTI_REGIONAL
x-goog-meta-sdk_version: 1.5.9
x-goog-meta-sdk_whitelist: ixf
access-control-allow-origin: *

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 122ms
45ms XHR
application/json 104.18.32.137
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.32.137 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8d7a21b1dcc3ab94-YYZ
access-control-allow-origin: *
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H2 200 1963679096 Show response
ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/ 8 KB
1 KB 151ms
52ms XHR
application/json 34.111.194.12
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ixfd2-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/1963679096?client=js_sdk&client_version=1.5.9&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&user_agent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F130.0.0.0%20Safari%2F537.36
Requested by: Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.194.12 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 12.194.111.34.bc.googleusercontent.com
Software: bws/1.0 /
Resource Hash: 9f0f8b97bbedd536c657c8509450f8dbcc3618032ee7b22577d6d6f00f6a0e47

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: public, max-age=3600
content-encoding: br
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-be-pop: IAD-1-601
date: Thu, 24 Oct 2024 12:57:10 GMT
content-type: application/json
server: bws/1.0

GET
H2 200 LJA84-589LU-SVNVV-WKPLQ-NBTC7 Show response
s.go-mpulse.net/boomerang/ 160 KB
40 KB 184ms
36ms Script
application/javascript 23.39.36.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/LJA84-589LU-SVNVV-WKPLQ-NBTC7
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.36.184 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-36-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 718b81757a4a4d863ff8f7ee379db24abde81658399d718e4592cf265b04caaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=604800
timing-allow-origin: *
content-encoding: br
customappheader: mpulse-ab-boomr__git__08ab8be__git__08ab8be__p19.alsi10-lite
content-length: 41104
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 03 Oct 2024 10:48:58 GMT
vary: Accept-Encoding

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 321 KB
72 KB 53ms
41ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10f3b7d24980ea38d92bdb807f87518eb7b8f6523805458b3d0c2e00a25c20c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=300
content-encoding: br
x-amz-version-id: CX3OgkTYbbNeWZGAxmEQKXeGoTvGsfS0
etag: W/"067cbb805978b2bfe9844088d75a7c01"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: tbj8YQAHQp1zlq-3qpiL-W9WX8sgyvxUcmJ2MSbJtXPYvLApEgNKVg==
date: Thu, 24 Oct 2024 12:57:11 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:06 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 xdr-product-console-shot
trendmicro.scene7.com/is/image/trendmicro/ 18 KB
0 5ms
5ms Image
image/webp 23.44.201.149
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.44.201.149 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-44-201-149.deploy.static.akamaitechnologies.com
Software: Unknown /
Resource Hash: 74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

etag: "b3ffdce154f5ac33f90bafd0b8f52ddf"
x-adobe-smart-imaging: 0
x-adobe-assetlist: QlpoOTFBWSZTWSzIeOkAAAITgAACgAoOZ95AIAAxTJiZBkYUGTQMGpD6ZCPsuEfgkoW50OJVGIEuNhB8XckU4UJAsyHjpA==
expires: Thu, 24 Oct 2024 18:35:21 GMT
access-control-allow-origin: *
content-length: 18350
date: Thu, 24 Oct 2024 12:57:15 GMT
x-adobe-modifierlist: QlpoOTFBWSZTWeZ00K0AAAADgAAKCQYsBCAAMQAwIDRiUC9RI5OPF3JFOFCQ5nTQrQ==
content-type: image/webp
last-modified: Wed, 04 Jan 2023 02:43:22 GMT
server: Unknown
x-akamai-cache: Hit
akamai-grn: 0.55c82c17.1729774635.393760e

GET
H2 200 OpenSans.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/ 58 KB
58 KB 87ms
84ms Font
application/octet-stream 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans/OpenSans.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=979
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635876_398664804_842642643_581_7383_36_0_255";dur=1
content-length: 59444
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 material-symbols-outlined.woff2
www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/ 225 KB
226 KB 96ms
93ms Font
application/octet-stream 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/resources/fonts/material-symbols-outlined.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=1438
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635876_398664804_842642644_526_7987_36_0_255";dur=1
content-length: 230732
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/octet-stream
last-modified: Thu, 07 Sep 2023 17:07:37 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/ 72 KB
72 KB 101ms
98ms Font
application/x-font-woff 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=754
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635876_398664804_842642645_523_9597_36_0_255";dur=1
content-length: 73259
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 120ms
39ms Font
font/woff2 142.251.35.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 74486
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 16:15:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 16:15:49 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/ 426 KB
103 KB 69ms
35ms Script
application/javascript 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: futiIRaAGsEL76yunD0yWQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10E7176E8
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 51086
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript
last-modified: Tue, 16 Jul 2024 19:54:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f1eb7d60-801e-00f3-4a00-2440e3000000
cf-ray: 8d7a21b27c14ac25-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 105018
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 136 KB
52 KB 140ms
54ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5f54be95a8fda6209738cf8e2d35c303f65164494d9e898619abf32789a2c40e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 52611
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/ 24 KB
14 KB 60ms
58ms Font
application/x-font-ttf 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: public, max-age=1327
content-encoding: gzip
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636168_398664804_842644288_855_7925_37_0_255";dur=1
content-length: 14370
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/x-font-ttf
last-modified: Thu, 09 Dec 2021 18:07:24 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 44ms
43ms Font
font/woff2 142.251.35.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f3.1e100.net

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 58067
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 20:49:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 20:49:29 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H2 200 jquery.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 111 KB
0 1ms
1ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640448_410_9604_37_0_219";dur=1
content-length: 34015
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 11:31:39 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 200 OpenSans-SemiBold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/ 58 KB
58 KB 47ms
46ms Font
application/octet-stream 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/OpenSans-SemiBold/OpenSans-SemiBold.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=660
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636304_398664804_842645010_19_8785_37_0_255";dur=1
content-length: 59480
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/ 37 KB
38 KB 61ms
60ms Font
application/x-font-woff 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=588
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636314_398664804_842645072_68_8766_37_0_255";dur=1
content-length: 38313
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 Interstate-Bold.woff2
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/ 50 KB
51 KB 81ms
81ms Font
application/octet-stream 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/Interstate-Bold/Interstate-Bold.woff2

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=870
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636337_398664804_842645073_2330_10784_37_0_255";dur=1
content-length: 51664
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/octet-stream
last-modified: Mon, 08 May 2023 17:33:35 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/ 68 KB
68 KB 57ms
56ms Font
application/x-font-woff 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate-light/e9258aa9-8d38-4395-b7e7-e18df29986f1-3.woff

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css

Response headers

strict-transport-security: max-age=15552000; preload
cache-control: public, max-age=1026
x-content-type-options: nosniff
x-prod-n-01: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636314_398664804_842645074_72_8654_37_0_255";dur=1
content-length: 69724
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/x-font-woff
last-modified: Thu, 23 Apr 2020 17:32:22 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-92bf-78d6-aa25-38376022f5dd/ 192 KB
34 KB 43ms
43ms Fetch
application/json 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/01915698-92bf-78d6-aa25-38376022f5dd/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd576a11f562214c87a771d16d82a567b2b1d6cdbd04a4d6b6cc643fd8a1fd3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: hmLaq0/ASEodR4ous3c0Nw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCE8A80B7DF865
age: 50272
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Fri, 25 Oct 2024 12:57:16 GMT
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/json
last-modified: Wed, 09 Oct 2024 21:19:22 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: c6e2f5d7-001e-00e2-7b90-1a77f8000000
cf-ray: 8d7a21b4ef2dac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34527
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 utils.min.js Show response
www.trendmicro.com/etc.clientlibs/clientlibs/granite/ 10 KB
0 1ms
1ms Script
application/javascript 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

vary: Accept-Encoding
content-encoding: br
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774635491_398664804_842640449_404_9390_37_0_219";dur=1
content-length: 3224
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript;charset=utf-8
last-modified: Tue, 22 Oct 2024 14:02:09 GMT
server: Akamai Resource Optimizer
x-frame-options: SAMEORIGIN

GET
H2 404 token.json Show response
www.trendmicro.com/libs/granite/csrf/ 196 B
392 B 47ms
46ms XHR
text/html 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.trendmicro.com/libs/granite/csrf/token.json
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-162-160.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636435_398664804_842645729_24_8194_36_0_219";dur=1
content-length: 173
content-encoding: gzip
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
server: nginx

GET
H2 200 dict.en.json Show response
www.trendmicro.com/libs/cq/i18n/ 14 KB
4 KB 46ms
45ms XHR
application/json 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.trendmicro.com/libs/cq/i18n/dict.en.json

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-162-160.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Response headers

strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
cache-control: public, max-age=862
content-encoding: gzip
etag: "b91bea50244aae0b72b630e6c7e2791f"
x-content-type-options: nosniff
x-prod-n-02: Yes
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636465_398664804_842645874_22_6958_36_0_255";dur=1
content-length: 4080
x-xss-protection: 1;mode=block
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/json;charset=utf-8
content-language: en
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 13 KB
3 KB 47ms
46ms Fetch
application/json 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: /1UdBS+YEc76mTiBEFqAyQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCA5D10971D872
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 36492
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/json
last-modified: Tue, 16 Jul 2024 19:54:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 41b462fb-e01e-00ca-1356-d80047000000
cf-ray: 8d7a21b6686bac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3017
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202310.2.0/assets/ 21 KB
4 KB 47ms
46ms Fetch
text/css 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: c7xAZ9MSGAobGaTYg/Qtag==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 720
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/css
last-modified: Tue, 16 Jul 2024 19:54:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 324b1e67-601e-0071-7a6f-d8e1b3000000
cf-ray: 8d7a21b6686cac33-YYZ
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 utag.255.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 408 B
831 B 59ms
47ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.255.js?utv=ut4.44.201708221516
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1287c8080a63948b642eba779165be748e3ea564dae96b986f2fa82f05f2839c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=1296000
x-amz-version-id: o8iOktPyGSG_mFB.HY8i6diGgLLF5hpQ
etag: "39e237ae5209b493309382d823a84d49"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 408
x-amz-cf-id: wsOVhU4dghsc5BwRo7-yHnfBoemYRkYkcd1e07XHxi7ayY-QZnj-Yg==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.18.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 64ms
53ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.18.js?utv=ut4.44.201510262117
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d050dd8e451aa5ced84df0d65f5bc418c771bcc48fbd6a1e228f464a7aebdfc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: To1RPtdg_gcLTcbkYeytY6CWeChbclVh
etag: W/"7b3219e1e1fff7a504092fcd6a621c19"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: RCLzbbDXRutyzKPDCgjv4YYsNtKruyFXKWMQcUQLxNuuLd2CtDS4aA==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:58 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.539.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 4 KB
2 KB 58ms
46ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.539.js?utv=ut4.44.202302152254
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0c0809c5501a44a8163889f864f5e1ac5bf40278c7c876cbbcb3b42258bf1600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: tWfebHSmjeJPWvjd4Dj5ts48EY.2GnoV
etag: W/"79bb257269ce7a0cef14ab1c6ac7abca"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: C97zfH5-EPkTPwnOzmHtR0ZfCLIVMXoM0Mud-IMnO2WNtpwk1G7W3A==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.260.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 23 KB
6 KB 58ms
47ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.260.js?utv=ut4.44.201708221516
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f8cc976de5717cbe83d70ee0d8ab102de48f530ac9774540259d0231075366f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: vnOWpw0FfQh_8abBMMJXYjSsvwOLNuBI
etag: W/"f79bdf7588eadd98516041f0d22da60e"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D9Fx4chlb7RDmLKqXp35f4d54vyGQ59zty9MlZi-qJh_yy7oXjTXUA==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:58 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.101.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 27 KB
7 KB 58ms
48ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.101.js?utv=ut4.44.202307121000
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b400a41d9cf76d300fa0295e88e1200125f1b8be6ffb975f8bb0970f60ed96cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: 8nGjCfuCZslW1TTaH2v2Ka64aWD5zUQe
etag: W/"1028ced174f538fb9d28f8b9d222ffe0"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: oqL4ONBhddiIPzoqvjN-mSbS01bRR63-m3M31grATu7hDhr9d95eig==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:00 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.100.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 23 KB
6 KB 72ms
61ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.100.js?utv=ut4.44.202307121000
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b9d976b4a534de7d216ef42fe69261fdb9c2b2d60b0e536f181040e075b5e7b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: i2.5nglraqnvGBV5n4WQL3oxPKW5qi0C
etag: W/"222bff105bb66c3d73f56a1e87e282a7"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ghdJmpHyrRvefzzKxtYuNAXN5G5kWqwrItT3G1fB6M5cL6KQgeFmRA==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:05 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.75.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 3 KB
2 KB 62ms
51ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.75.js?utv=ut4.44.201608171750
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93a14f0cba4e6906e213fec85a81d6576c9f71442c95b81fa921c46af69753be

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: MBqok328jNB_bugkkZ28V2iJ1KTvKdvm
etag: W/"d09cb453e390c960b71a87e37814d708"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: d9QKD54C_6lgM2ZrAv0HPpWp2mQnWyPKuqIMQISRAvg9EbHJ3YIXQg==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:59 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.252.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 62ms
51ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.252.js?utv=ut4.44.201708221330
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbac24429269d33701e02afa81c3288fa2b63f931d1b4193201346ed328a6af5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: 7EdwEZl.caxB.k0kpHue4HOPi.qBMcxO
etag: W/"331251bd281f468316aa2de4e3d026a8"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5viDEfCVlTxpu5xPhE1viwTgTXQSMqo9xn2lDwWLeIwsyOZiznI5Mw==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:04 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.158.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 3 KB
1 KB 69ms
59ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.158.js?utv=ut4.44.201708221516
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 314a4db2e647c5063a6f63b6436ec31ce63e91a476b77aad634f8b7f2ed1de90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: 37ytj5lRG3Aqw6bGI6ljqZJlbkZdYvBG
etag: W/"faacdd3d4195e2593c38934710837d3c"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: fM5OSKCyWSFY4Fz0kFfTiBaqCaDGQiYUrpRfq0H4p7kBXliGdpgciQ==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:01 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.361.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 7 KB
2 KB 71ms
61ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.361.js?utv=ut4.44.202001241305
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c8cf8672c5a4d67f575a1234a06d2510aae4af895dc54625db471316d7884ded

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: l3ypxuC_r8fpDVhpsCrX.mu0BNlGOGRf
etag: W/"06bf34e94fd665975e0ef6fc6c762cfa"
age: 5
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: flw5U9Bw9kzc3hlcChOk9fYfFzDjbNmhI4PCyU6ooivlWV_D2R0tqg==
date: Thu, 24 Oct 2024 12:57:12 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:05 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.321.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 5 KB
2 KB 85ms
75ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.321.js?utv=ut4.44.201708311522
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: deafd7212c6cff5c9736590aa0633108ce0a931fa3d71c25134663e8d1de3477

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: bUMtc3N5Me5_.vhH5qpNV6K7k0Yf6XAG
etag: W/"c49696947ce095c9f195576b54d79ed0"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: gVoBwG5s3Bm2PNowqfjNCETb9UlQFjsJQx2FHWCwKEkS0Hp8_-SYQA==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:04 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.417.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 4 KB
2 KB 86ms
76ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.417.js?utv=ut4.44.202307211458
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5c3cf48f20089b1c9095808f743222bc3367cdff033bdc92938eee628b6edb3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: 0FnYjJrM9V84DBMB2hOlDPIYnVSbxaz0
etag: W/"2f65bb886fe33d81d5c7717db3fbc104"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: Ry3vmiHO4NUYJSCrFOnQbd-Zo37WGRs2rJ11crFXle85wygW7pHp3Q==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:03 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.523.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 10 KB
3 KB 85ms
75ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.523.js?utv=ut4.44.202010211554
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3b6f04db9bb0fc01a5789192f3559e3f34680431da3bc7d81146136a227e61ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: fA37e_2GTPwNuKHkqWNTvsg1RUf_7TW9
etag: W/"31e865de3ca577777bcb301835247913"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: s75v_ihiHL6USnFXM2Spe-JVm063JkboYNEE22Y-41uFtQe2rU2igQ==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:58 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.525.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 87ms
77ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.525.js?utv=ut4.44.202010151358
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c9cf6b9f1614666063ed6559738b01479aac79f6a4fde04cef2bcd352cae0ea2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: H6zfVRhdmXjwx_wG4ABJG.wyw7m0yNQr
etag: W/"39855c05af769fe20ef35bcc04a4af0a"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: HJYuv8PCfOpeGB-Toiaz_9FgUNPdipHYExK6c3bxBRjBTFPvX-Lbww==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.536.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 18 KB
6 KB 88ms
78ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.536.js?utv=ut4.44.202012081217
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c204eedfcbc423fbebdec6aeca7659702d6a0c4f773024ec02333c40b3ea0938

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: xgZPhXywFTru8tyesUPxi8QO5eSowYj_
etag: W/"61fdcf7984ffe53dbd8b43d79af10a9c"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: izzOV1Mc6cS17ayAO-Nm3ceLMGG8399nUtgMUz7LcPkZaVAo10qT_g==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:04 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.542.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 10 KB
3 KB 89ms
79ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.542.js?utv=ut4.44.202104211340
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 100bfa4f54e66d0ce2ee2e0b99e8299badcf4bc97067200e3b259e33e1746168

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: y9GRgfQIwx2f4V0rXCxGTM1fU7jdhi1X
etag: W/"3787f7f9bd29a80423b3e1b007083854"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: c3qOAwudmuuLamkvaKlW9JH1AmLk1nEE0xNH9FzGkfeY0ozQOOq4Kg==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.555.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 4 KB
2 KB 89ms
80ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.555.js?utv=ut4.44.202108111458
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cb8c839f8d393bc88940076ce6d506432058517cd78b32affee721dcd34e4bd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: HRO9IlN7._Mr2CToJiEsN8KSjPF.JzVU
etag: W/"407f7c5d8ec284a823b2b2d79e4390e6"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: w5l4T0H18WfRvpS6swX0nhL8azjHeat4UtC7WnbG7d2a7K7rNmeUDw==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:03 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.576.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 17 KB
5 KB 90ms
81ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.576.js?utv=ut4.44.202410011600
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c1fe01fd7089945bec5c6468c09e8e461af87869f2fad13393dc682f62ac84cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: kh0AQdnmIkSAYtx04CglGcg4h0bJ.gzx
etag: W/"7f10f6ae10d002aa01cac916c36107b8"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: z-Weksp1jZR2vyQuk9rgBmXgzkA9WkrIOH12oBPbAml3q7QPenPF7g==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:05 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.591.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
2 KB 90ms
82ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.591.js?utv=ut4.44.202302221438
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d5b9c1772d4bae40f46a7606b70fac2717527ef459d6c02977d98bafcb648a32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: n1LwiN9ds4znGyQ.vUPvys8Xa_4XN8r0
etag: W/"d4c476bd74049191a51e41c544e4101b"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: A-ZBhU0aQx7qW1voZmW_qrxPZUS2i-zBypirRs3HGVxNg7wMQcmyMw==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.592.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 91ms
83ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.592.js?utv=ut4.44.202303031111
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 23ff59faa9b93a2e6e2070924a335754bc400f011fccffa05502fd3e6c591635

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: 8trHU7OUA9.AEMxM4Bk1d_9NKiN3jTwf
etag: W/"d9e3f31fa6fc3ef595b7cfa2b2f0223e"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: PbGmZvhdZusm27QLtTqPv2-7RxyehpUk203SKBD9t40B-_hSKaykCA==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.614.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 91ms
83ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.614.js?utv=ut4.44.202308081416
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3d745f856b16c6caea232b133da71099351fa3cdb9cb8c386c7de5658e2a048f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: FNuoOMsWD3NxfSxwfK5qkuiJKsfcySgK
etag: W/"8e57d03f952c1d0bb945b795dfe55d0a"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: yp12tcUH9RkchPLxjEq7QHPzI2EbWDXkqFm3OOOSj1B58x5ajBkUgQ==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:01 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.621.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 4 KB
2 KB 91ms
84ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.621.js?utv=ut4.44.202403051655
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e82d046eab9f90243836f4a53d62c9f3630394011fc3a726479e56b727a2e19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: xzB4DJIOSkG2X1BmOpMKslFSFJ.tcM4k
etag: W/"beacb080b1c23c6091f7419364bb02b7"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: lH3Dzbl4_LFmrabYlUpZYaQmUV7AYDBgBBiOi-0DnoEgAZt7_c7TbQ==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.623.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 4 KB
2 KB 92ms
85ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.623.js?utv=ut4.44.202403281058
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 34c2c75fc039a1ecb484fd4fa42cea1bfdf227c65ceacc982cc2dc68e1e0a4a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: A5AgxfAkBo2NWQq0XFS6eiffbgMzj4Oz
etag: W/"e272388549ffe271e6fadf56035e8496"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: a1bMUWUAQfxtzAjvWMIBnGRrC5Hw2znHpYN6bgPraEm--_lnrmQPZQ==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:58 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.631.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 7 KB
2 KB 92ms
85ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.631.js?utv=ut4.44.202406261308
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8ceb75d474e0458a42876b949f086cd646f599f128e924b84525a86e42147c6d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: Fo1bZJAwQafi7Pbq9qjZUD4pKo4cm_b7
etag: W/"4bd951b15ac569521462b47664db25b5"
age: 1
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: RCt2gWSCaHzPA5ESHpPcMYWmfK4RIdlm-8KSxJsZWEBx_cns_0D9vA==
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:44:01 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 200 utag.643.js Show response
tags.tiqcdn.com/utag/trendmicro/europe/prod/ 2 KB
1 KB 91ms
86ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.643.js?utv=ut4.44.202410030941
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 250b88dc794a09ae133909d82987e866c00496c39aa7383f0e87bd6e775c1641

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
cache-control: max-age=1296000
content-encoding: br
x-amz-version-id: YvTKrbVvZonbBbU2wW6UiwV9QeOxl98U
etag: W/"5466296f259fc8bb4875b8fc92bfb06b"
age: 4
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: NA4YDVudjwQrvbcS_YzkQEKtpV4UFzZ9dsztqbRfFV_xLS7WAb6nWw==
date: Thu, 24 Oct 2024 12:57:13 GMT
content-type: application/javascript
last-modified: Mon, 21 Oct 2024 17:43:59 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H2 404 unmasking-prometei-a-deep-dive-into-our-mxdr-findings.disruptorV2.json Show response
www.trendmicro.com/de_de/research/24/j/ 196 B
392 B 51ms
42ms XHR
text/html 23.56.162.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.disruptorV2.json
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.162.160 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-162-160.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636649_398664804_842646926_24_11817_36_0_219";dur=1
content-length: 173
content-encoding: gzip
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
server: nginx

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
2 KB 311ms
209ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Content-Encoding: gzip
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Connection: keep-alive
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 729
Date: Thu, 24 Oct 2024 12:57:16 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 LJA84-589LU-SVNVV-WKPLQ-NBTC7 Show response
s.go-mpulse.net/boomerang/ 160 KB
0 0ms
0ms Script
application/javascript 23.39.36.184
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/LJA84-589LU-SVNVV-WKPLQ-NBTC7
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.36.184 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-36-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 718b81757a4a4d863ff8f7ee379db24abde81658399d718e4592cf265b04caaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=604800
timing-allow-origin: *
content-encoding: br
customappheader: mpulse-ab-boomr__git__08ab8be__git__08ab8be__p19.alsi10-lite
content-length: 41104
date: Thu, 24 Oct 2024 12:57:15 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 03 Oct 2024 10:48:58 GMT
vary: Accept-Encoding

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
567 B 66ms
64ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

ESF /

Resource Hash

d426094c168051f30c71c81f5a51fe910cd31d2cdb2138d71ea0db1029c1186f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
x-content-type-options: nosniff
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
expires: Thu, 24 Oct 2024 12:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script'
cache-control: private, max-age=0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
x-xss-protection: 0
server: ESF

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
624 B 36ms
36ms Image
image/svg+xml 104.18.86.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.86.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 55814
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: image/svg+xml
last-modified: Wed, 23 Oct 2024 06:02:57 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 24bd09c9-e01e-0024-5e7b-250ac4000000
cf-ray: 8d7a21b75844ac25-YYZ
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H/1.1 200 / Show response
script.opentracker.net/ 23 KB
7 KB 356ms
85ms Script
text/javascript 23.239.22.30
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://script.opentracker.net/?site=www.trendmicro.de
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.239.22.30 Fremont, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li743-30.members.linode.com
Software: /
Resource Hash: 3fc10fa26cb2eae1cc63eff73e36d3b4c151cd2e87011765797b1b5ec43d26ca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Content-Encoding: gzip
Date: Thu, 24 Oct 2024 12:57:17 GMT
Content-Type: text/javascript;charset=UTF-8
vary: Origin,Accept-Encoding

GET
H2

200

i.gif
datacloud.tealiumiq.com/vdata/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tealium_dmp&google_cm&tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main
https://cm.g.doubleclick.net/pixel?google_nid=tealium_dmp&google_cm=&tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_tc=
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_gid=CAESEA_Gig00nISR51oAl6BCXjc&google_c...

43 B
640 B

44ms
43ms

Image
image/gif

34.230.99.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_gid=CAESEA_Gig00nISR51oAl6BCXjc&google_cver=1
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Server: 34.230.99.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-99-111.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Origin
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-uuid: 30b794de-fcd4-4b54-90dd-98a4678db838
pragma: no-cache
x-tid: db105aa0756a4e2d97859130967fb04f
expires: Thu, 24 Oct 2024 12:57:20 GMT
content-length: 43
x-serverid: uconnect_i-027b07d31340d5f38
date: Thu, 24 Oct 2024 12:57:20 GMT
x-acc: trendmicro:main:2:vdata
content-type: image/gif
x-ulver: 7923a65c0262dece38cc3fed1cfea676cc0381d1-SNAPSHOT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-did: 0192be9a4bd800b083e889a79ae005065006905d00b08
x-region: us-east-1

Redirect headers

cache-control: no-cache, must-revalidate
location: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_vid=0192be9a4bd800b083e889a79ae005065006905d00b08&tealium_account=trendmicro&tealium_profile=main&google_gid=CAESEA_Gig00nISR51oAl6BCXjc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 415
date: Thu, 24 Oct 2024 12:57:19 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 137ms
38ms Script
application/javascript 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111d7"
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 15:57:16 GMT
accept-ranges: bytes
content-length: 18830
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H2 200 revenuepulse-lib-v3.js Show response
resources.trendmicro.com/rs/945-CXD-062/images/ 2 KB
1 KB 15508ms
82ms Script
application/x-javascript 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: public, max-age=60
content-encoding: gzip
cf-cache-status: HIT
etag: "5223bf-6f3-623b1377a820e"
age: 9
x-content-type-options: nosniff
cf-ray: 8d7a22181e6854a3-YYZ
expires: Thu, 24 Oct 2024 12:58:32 GMT
accept-ranges: bytes
content-length: 695
date: Thu, 24 Oct 2024 12:57:32 GMT
content-type: application/x-javascript
last-modified: Sat, 05 Oct 2024 02:05:07 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 128ms
37ms Script
text/javascript 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
age: 5412
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 13:27:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 11:27:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 i.js Show response
datacloud.tealiumiq.com/trendmicro/main/16/ 33 B
603 B 3271ms
82ms Script
application/javascript 34.230.99.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://datacloud.tealiumiq.com/trendmicro/main/16/i.js?cb=24087991159545584&jsonp=utag.ut.getvisitorid
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.230.99.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-99-111.compute-1.amazonaws.com
Software: /
Resource Hash: 1bf3c2bc7a61528d088ad564a9ce1138491498bffc1988c38051be666b6e0c3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Origin
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-uuid: db105aa0-756a-4e2d-9785-9130967fb04f
pragma: no-cache
x-tid: db105aa0756a4e2d97859130967fb04f
expires: Thu, 24 Oct 2024 12:57:19 GMT
content-length: 33
x-serverid: uconnect_i-0e5926341802118a4
date: Thu, 24 Oct 2024 12:57:19 GMT
x-acc: trendmicro:main:16:datacloud
content-type: application/javascript
x-ulver: 7923a65c0262dece38cc3fed1cfea676cc0381d1-SNAPSHOT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-region: us-east-1

GET

activityi;dc_pre=CKedqNaIp4kDFXUn-QAddUArPA;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186
6240125.fls.doubleclick.net/ Frame F851
Redirect Chain

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186?
https://6240125.fls.doubleclick.net/activityi;dc_pre=CKedqNaIp4kDFXUn-QAddUArPA;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186?

0
0

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 3258ms
86ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.523.js?utv=ut4.44.202010211554
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15412
date: Thu, 24 Oct 2024 12:57:19 GMT
x-tw-cdn: FT
last-modified: Fri, 15 Mar 2024 03:07:08 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kiad7000087-IAD
x-amz-server-side-encryption: AES256

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ 43 B
676 B 1161ms
48ms Image
image/gif 52.72.192.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10105370&js=no

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.72.192.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-72-192-139.compute-1.amazonaws.com

Software

ATS/9.1.10.144 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
cache-control: no-cache, no-store, private, must-revalidate
pragma: no-cache
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-content-type-options: nosniff
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.144)
expires: Thu, 24 Oct 2024 12:57:17 GMT
accept-ranges: bytes
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: image/gif
server: ATS/9.1.10.144
x-frame-options: DENY

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 228 KB
58 KB 58ms
27ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

b3cad51ca0cfdbeac9d38f7aad54e6564408f0da56a6fd56350e0d03d4f0aef9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-K6UlksQY' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-K6UlksQY' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=23, mss=1232, tbw=4411, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: n+R2XGHqo1ABjGQxENYAK64Iwf5jYxqYK6CnA2LT22PcGJ0dZTxqOX0MVv0daSm1CdqPtrUMDsilO/PGr4dfrA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59508
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 1386ms
39ms Script
application/javascript 23.200.3.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.3.33 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-3-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=74305
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Thu, 24 Oct 2024 12:57:18 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2

200

sumome.js Show response
load.sumome.com/
Redirect Chain

https://load.sumome.com/
https://load.sumome.com/sumome.js

2 KB
2 KB

35ms
35ms

Script
application/javascript

138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/sumome.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: acf59197679c94a3b3eb2591f4127a1121474dd5c9110067db172a657dadd822

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "7524c7647c5293025519ea102c5573d5"
date: Thu, 24 Oct 2024 12:57:20 GMT
last-modified: Tue, 22 Oct 2024 21:05:16 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: 9STEXlUALfI8l1x5vRcp+Y/uLT+doTIerB4g82dgDydegUUWQXShWhUlE4JG8TLTIcmr+pNz8Ek=
cdn-cachedat: 10/23/2024 23:24:05
cache-control: max-age=600
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 4e268661c58e0ff04675997cccef8fc0
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 6XWETDF5YC3VW8W7
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

Redirect headers

cache-control: no-cache
location: https://load.sumome.com/sumome.js
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 257f72cdf74b97e13b7d301874e53dac
cdn-pullzone: 1686293
content-length: 162
date: Thu, 24 Oct 2024 12:57:20 GMT
content-type: text/html
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 equally-widget.min.js Show response
widget.equally.ai/ 256 KB
78 KB 15699ms
83ms Script
text/javascript 108.139.29.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/equally-widget.min.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.614.js?utv=ut4.44.202308081416

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.29.47 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-139-29-47.jfk50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ca70357bd2a65bc9f6ecaac6e388340eeec552358d5c4a405b249f2fe2bd3c84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
etag: W/"7b2ddca772b30e1177d598c23668259b"
age: 65820
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: n0WV4lVg5QAtTO6_ObyPu_2WGHKLtmQiRSRA1fl0yGjUNddDANITnA==
date: Wed, 23 Oct 2024 18:40:33 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Tue, 22 Oct 2024 16:09:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 ef73a156d5c211fdbb7e4231f2a0edca.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 312 KB
102 KB 71ms
70ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXG7CKV&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

01ac050d2b55e284ce67847f85f2d85fc6facd41934bd30f055235fe754a92fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Thu, 24 Oct 2024 12:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 24 Oct 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 103811
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 350 KB
111 KB 73ms
73ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-PCCSVH5M9H&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4cb7065a0872567d945dcc1bf304379e4dbcd73d46b15b89d112c939a09986b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 113355
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478
6240125.fls.doubleclick.net/ Frame DC6B
Redirect Chain

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478?
https://6240125.fls.doubleclick.net/activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478?

0
0

153ms
152ms

Document
text/html

172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6240125.fls.doubleclick.net/activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478?

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 2340
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Thu, 24 Oct 2024 12:57:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6240125.fls.doubleclick.net/activityi;dc_pre=CKmiqNaIp4kDFdoZ-QAdQSMq-A;src=6240125;type=all_p0;cat=trend0;ord=1996453323426.9478?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 81ms
39ms Script
application/javascript 104.22.70.197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.22.70.197 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"b57737a151d7fd411c90e2eb8cdb171e"
age: 15162
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9a7me32KxvlHtI8Efl0uqqtSkCe1RlD5aq6zW4LtsIfrzWQq8VpWqKafCFC2T4qGcv9UQAvPhxro7vP8hTNU%2Bdw5ih6ctBO%2BAMnvt%2F7stmeWToVv%2FjDj5tZn6NMxdQ3VrA%2FKy4Gl"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400, stale-while-revalidate=30, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d7a21b9583e7117-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 vpr-eu.min.js Show response
cdn.veritonic.com/static/ 6 KB
3 KB 15717ms
74ms Script
text/javascript 13.225.63.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.veritonic.com/static/vpr-eu.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.643.js?utv=ut4.44.202410030941
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-116.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 800dcc0d92c0059f497bdc7b22fd7f870cce1250418d08280f7ca43151d32fea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Accept-Encoding
content-encoding: gzip
x-amz-version-id: zXD9yrPgYtQp0Zk31IWmitsoN0KPUpG9
etag: W/"82321654f94f503e4bfad8880866f327"
age: 49951
via: 1.1 3425db2c749d144a96b60e99c2493db0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: yw5bQ9DLJFt7Y3uYIckAftYFL7Ek0eZaTVNpwWr32zB2qLSMk7_PnA==
date: Wed, 23 Oct 2024 23:05:01 GMT
content-type: text/javascript
last-modified: Tue, 17 Sep 2024 00:14:09 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
x-amz-server-side-encryption: AES256

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
432 B 37ms
36ms Script
application/javascript 3.168.102.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/europe/202410211743&cb=1729774636769
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-45.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-amz-version-id: 2XUX04X5QEw0.xFya64khU._sHTRl_Pz
etag: "7bc0ee636b3b83484fc3b9348863bd22"
age: 484
x-cache: Hit from cloudfront
x-amz-cf-id: FLUbM6Pe7FMmO0qNjQ3sR8tC5O0l89LyGHAxADEu56lbrl3MT2ieIw==
date: Thu, 24 Oct 2024 12:49:13 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sat, 11 Mar 2023 06:57:46 GMT
cache-control: max-age=300
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 2
x-amz-cf-pop: JFK52-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/a62d836d/www-widgetapi.vflset/ 31 KB
10 KB 38ms
38ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/a62d836d/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

sffe /

Resource Hash

8f2c4bcb919e31182646d5e52650914f15a9cc8ff0847d30c4dc4adcd4c2653c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
age: 8807
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
x-content-type-options: nosniff
expires: Fri, 24 Oct 2025 10:30:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 10:30:29 GMT
last-modified: Mon, 21 Oct 2024 04:28:38 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
content-length: 10288
x-xss-protection: 0
server: sffe

GET
H2 200 config.json Show response
c.go-mpulse.net/api/ 2 KB
1 KB 198ms
91ms XHR
application/json 104.96.84.186
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=LJA84-589LU-SVNVV-WKPLQ-NBTC7&d=www.trendmicro.com&t=5765915&v=1.803.70&sl=0&si=52e6536d-712d-4f94-8165-3a59a5c11244-slv2nf&plugins=AK,ConfigOverride,Continuity,PageParams,RT,PaintTiming,NavigationTiming,ResourceTiming,Memory,Errors,Akamai,EventTiming,BFCache,LOGN&acao=&ak.ai=807181
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.84.186 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-84-186.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d53f1292d5f4f237386f702b79d61d54e44d1afedbc1984a33a776cd4f586ef1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
timing-allow-origin: *
content-encoding: gzip
access-control-allow-origin: *
alt-svc: h3=":443"; ma=93600
content-length: 875
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/json
vary: Accept-Encoding

GET
H3 200 3617363145015639 Show response
connect.facebook.net/signals/config/ 76 KB
15 KB 68ms
67ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/3617363145015639?v=2.9.173&r=stable&domain=www.trendmicro.com&hme=ead923021ccd3483ef3b9b04703d0a78b943fbdc01e8d7cec21c5059f1f4a5e9&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C34%2C143%2C15%2C50%2C194%2C193%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

4d3fc03e1f18ac04b15cc9e5d5ed5329914683224daa6006f76a0f64b8b04e5e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=23, rtx=0, c=75, mss=1232, tbw=67987, tp=65, tpl=0, uplat=41, ullat=0
pragma: public
x-fb-debug: GZ63CZyocrlz6o0dMUclXM9kev4cbqrMDAHmkwpKWMgzUpLtM/an10uBHq8D+MxYopG+4/1N+jkffdVGfJB3Zg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
436 B 54ms
50ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAiAABBAAAACAkJ~&jid=1752580116&gjid=1019062743&cid=1237141721.1729774637&tid=UA-36872905-5&_gid=632915050.1729774637&_slc=1&z=697434869

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

e2b6b69e884b97b64d32ec79daaae0c8a743a198e1b972ef97e154f5d5f86f3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
648 B 1210ms
54ms XHR
text/plain 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-36872905-5&cid=1237141721.1729774637&jid=1752580116&gjid=1019062743&_gid=632915050.1729774637&_u=YGDAiAABBAAAAGAkJ~&z=2085471824

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:149:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:18 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:149:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
73 B 55ms
51ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-3&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=281386900

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 58ms
52ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-6&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=319374560

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

3c455a838efdbb611b38e5727139ab7b298aa9e6d7b9229e70e0026182c59acb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 57ms
51ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-7&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=1650740116

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fec6e7c36c69095d38ed7ec24d0e3c27e42a45e60470a977029dff2e18fab316

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 61ms
53ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-8&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=1991853879

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

b7431a06942519f1e9aaac2822856ef1c372797c26c2e5d4aaf823623557201a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 60ms
53ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-9&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=1322150148

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

be5961e267b1d1c503355c8e716be39139f9671ebc7d6a58719e1aaf9e82025f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 59ms
52ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-10&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=1747739029

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

b0320c6cf482b927eed1b60c209708227cefae4b49cb87518f87bba744f333ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 60ms
54ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-11&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=2055338019

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

e977378fc763940e16a1785f5a7270ad54cff08c6f929d88e3b050ec2a84a580

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
83 B 57ms
52ms XHR
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACAABBAAAAGAkJg~&cid=1237141721.1729774637&tid=UA-36872905-12&_gid=632915050.1729774637&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=2000464266

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

a317d0c413b8d00f74e5778405d2d72eaae5a9dbc6cec47ec320e21759584d65

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.trendmicro.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:16 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
345 B 42ms
36ms Image
image/gif 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=469434864&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ul=en-ca&de=UTF-8&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACAABBAAAAAAkJ~&cid=1237141721.1729774637&tid=UA-44690910-24&_gid=632915050.1729774637&cd3=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&z=912369094

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

age: 64507
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 19:02:09 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
701 B 15712ms
116ms XHR
application/json 68.67.179.166
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.166 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 154.47.17.42; 154.47.17.42; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
an-x-request-uuid: 2da522af-ecc8-4609-a9b1-17ef3c966fbd
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 24 Oct 2024 12:57:32 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 56ms
38ms XHR
text/html 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-33-42-75.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-origin: https://www.trendmicro.com
content-length: 7
date: Thu, 24 Oct 2024 12:57:16 GMT
content-type: text/html
access-control-allow-headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
284 B 148ms
38ms XHR
text/html 23.33.42.88
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-33-42-88.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: null
expires: Thu, 24 Oct 2024 12:57:17 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1729774636985_388049816_1018104562_19_862_36_53_219";dur=1
access-control-allow-origin: https://www.trendmicro.com
content-length: 4
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/html
vary: Origin

POST
H3 200 collect
www.google.com/ccm/ 0
0 138ms
57ms Ping
text/html 142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&scrsrc=www.googletagmanager.com&frm=0&rnd=1851141627.1729774637&auid=5191721.1729774637&npa=0&gtm=45He4al0v9103800028za200&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101533422~101686685~101794737~101823848&tft=1729774636942&tfd=1765&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXG7CKV&l=dataLayer
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

POST
H2 204 collect
analytics.google.com/g/ 0
0 54ms
52ms Fetch
text/plain 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-PCCSVH5M9H&gtm=45je4al0v888878635za200&_p=1729774636039&_gaz=1&gcs=G111&gcd=13t3t3t3t5l1&npa=0&dma=0&tag_exp=101533422~101686685~101794737~101823847&gdid=dYmQxMT&cid=1237141721.1729774637&ecid=1720214677&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&ec_mode=c&_s=1&sid=1729774636&sct=1&seg=0&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&en=page_view&_fv=1&_ss=1&_ee=1&ep.consumer=not_consumer&tfd=1835
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PCCSVH5M9H&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s74-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
269 B 57ms
52ms Ping
text/plain 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-PCCSVH5M9H&cid=1237141721.1729774637&gtm=45je4al0v888878635za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5l1&npa=0&frm=0&tag_exp=101533422~101686685~101794737~101823847
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PCCSVH5M9H&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 2FF7 0
0 389ms
55ms Document
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-PCCSVH5M9H&gacid=1237141721.1729774637&gtm=45je4al0v888878635za200&dma=0&gcs=G111&gcd=13t3t3t3t5l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101794737~101823847&z=1492525928

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PCCSVH5M9H&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 184ms
136ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-PCCSVH5M9H&cid=1237141721.1729774637&gtm=45je4al0v888878635za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5l1&npa=0&frm=0&tag_exp=101533422~101686685~101794737~101823847&tag_exp=101533422~101686685~101794737~101823847&z=173841815

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 24 Oct 2024 12:57:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 64ms
63ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-GBTVB6FHY4&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9d58d37478267b7e6fcce1827c0797d820a5c627604dc049903c7ed5ee7d1961

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 99113
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame 847B 0
0 381ms
50ms Document
text/html 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fwww.trendmicro.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXG7CKV&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 58675
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Oct 2024 20:39:22 GMT
expires: Thu, 23 Oct 2025 20:39:22 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 71ms
70ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8NK5WKVH4J&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1c6332d1095765afdba83cbea8981167447bc9a4cd7a68167636925cdec58451

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98906
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 282 KB
99 KB 103ms
102ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-HSS3WREM8Z&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

92ddc3a1e1de81b4af1c6657015497cefc874ee4baf933cd8146f2ab2cbfc9b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101465
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 120ms
119ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-J3BCDGQ9EV&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

755eda4e50235ef25d84799d5aab35fc7dd0528f0db87136623122da16716065

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98869
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 107ms
107ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-B6B5TMPL5M&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f2797c899aa8d506a11db5c393bfded690a682723a3f313e7df6eb038b89241f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98863
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 124ms
124ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9QHD3P38EF&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0493eeab44cf3747fa91f18320f7f6206fc12cb851115dc7cd94fcd1c405a11d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98884
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 118ms
117ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-93585RYGPB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1ff3865cdff9d499b02953d709b9e32c2ab673c6382668d6134df4f4c0d83e65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98966
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
97 KB 147ms
146ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q8079E61JF&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a61f59bf0a3696f4fdf94840e15f741a4c2562427891eaa14de7d5cd0d6b586e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 24 Oct 2024 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 98867
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 80ms
25ms Image
text/plain 31.13.80.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=3617363145015639&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&rl=&if=false&ts=1729774637123&sw=1600&sh=1200&v=2.9.173&r=stable&a=tmtealium&ec=0&o=4126&fbp=fb.1.1729774637120.378148528425924745&cs_est=true&ler=empty&cdl=API_unavailable&it=1729774636855&coo=false&rqm=GET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=22, rtx=0, c=10, mss=1316, tbw=2910, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 140ms
138ms Image
image/png 31.13.80.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=3617363145015639&ev=PageView&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&rl=&if=false&ts=1729774637123&sw=1600&sh=1200&v=2.9.173&r=stable&a=tmtealium&ec=0&o=4126&fbp=fb.1.1729774637120.378148528425924745&cs_est=true&ler=empty&cdl=API_unavailable&it=1729774636855&coo=false&rqm=FGET

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7429325495986048645"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: rOA/TBnPObGlWA85p/a/tghzpELVywBO0ziSuKhD6RqQYZIpCoAG5rrMk5CMAlEWl0hxDwRqwwh5767xIXemkA==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7429325495986048645", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=28, rtx=0, c=14, mss=1316, tbw=3263, tp=-1, tpl=-1, uplat=113, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 792 B
667 B 403ms
76ms XHR
application/json 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 08a133d2709f4ec7be7169310eb97799fba7f35810bed022dcc4523a51715dac

Request headers

Authorization: Token f0978075a275d14104571cd0b3e9919c9748869b
X-6s-CustomID: WebTag1.0 810eb8f4ed8abcee5cd1e233263d8d3f
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
content-length: 406
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 129ms
45ms Preflight 99.83.231.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.231.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.trendmicro.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Thu, 24 Oct 2024 12:57:17 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 99ms
99ms Script
application/x-javascript 23.204.6.193
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.204.6.193 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-6-193.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Sat, 01 Feb 2025 12:57:17 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Thu, 24 Oct 2024 12:57:17 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H3 200 sm.25.html
static.addtoany.com/menu/ Frame E44E 0
0 68ms
42ms Document
text/html 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 7281
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8d7a21ba687daab0-YYZ
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 24 Oct 2024 12:57:17 GMT
last-modified: Thu, 24 Oct 2024 10:55:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBy5WqaufTE4Dwk3un8zbCodkYUl4BdjhbFKozkG1Vx%2BSyuxsL5haobBPBPPJQDvKZXeLmcG6Rk2cFRtsKruEdOYVzgOnyZ7Z2TU6%2FlPo6%2BTkOESDvQLnpBkxCong8uZRyOJvuO%2BqEKxx97UgA%2B%2F61ks"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.D0Uc7kY6.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 69ms
41ms Script
application/javascript 104.22.70.197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.22.70.197 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://www.trendmicro.com/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"6fea96ea56ee4fff557b8776f9c8c3a6"
age: 189
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iWHx1VS8CY9UgnqcMMmPUXHbxHGEJUrYNuPIShUJ%2BI%2FFjpXQceAI%2BoYngQxDpgJoGi6ioyshBBNVyACMT4JGIUEPLm60JOWifBmWugHIKRYtLneaPhFFrUmbb1KYck8vAx2QRz9z"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: application/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=315360000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d7a21ba594eabd9-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H/1.1 200 /
log.opentracker.net/ 44 B
235 B 1672ms
135ms Image
image/gif 139.162.178.190
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.opentracker.net/?p=1&mid=1729774637007%3A1729774637007&fv=true&ti=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sh=1200&sw=1600&sc=24&lc=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=&t0=1729774637008&cld=Thu%20Oct%2024%202024%2005%3A57%3A17%20GMT-0700%20(Pacific%20Daylight%20Time)&si=www.trendmicro.de&ots=1.1729774637008.1729774637008.1729774637008&otui=309067561.1729774637008.1729774637008.1729774637008.1.1.0&otr=false&otor=false&otpe=false&ot_site=www.trendmicro.de&pix&rnd=37149
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 139.162.178.190 Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 139-162-178-190.ip.linodeusercontent.com
Software: /
Resource Hash: 2f8847dddd520cab371dd2e596ea27f647fbf18dcda0dadc2e7a8ec6af7614ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: no-cache
Content-Length: 44
Keep-Alive: timeout=60
Date: Thu, 24 Oct 2024 12:57:18 GMT
Content-Type: image/gif;charset=ISO-8859-1
Connection: keep-alive

GET
H/1.1 200
OK /
log.leadboxer.com/ 44 B
216 B 1590ms
135ms Image
image/gif 139.177.182.128
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.leadboxer.com/?p=1&mid=1729774637007%3A1729774637007&fv=true&ti=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sh=1200&sw=1600&sc=24&lc=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=&t0=1729774637008&cld=Thu%20Oct%2024%202024%2005%3A57%3A17%20GMT-0700%20(Pacific%20Daylight%20Time)&si=www.trendmicro.de&ots=1.1729774637008.1729774637008.1729774637008&otui=309067561.1729774637008.1729774637008.1729774637008.1.1.0&otr=false&otor=false&otpe=false&ot_site=www.trendmicro.de&pix&rnd=37149
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 139.177.182.128 Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li2247-128.members.linode.com
Software: Apache-Coyote/1.1 /
Resource Hash: 2f8847dddd520cab371dd2e596ea27f647fbf18dcda0dadc2e7a8ec6af7614ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Cache-Control: no-cache
Content-Length: 44
Date: Thu, 24 Oct 2024 12:57:19 GMT
Content-Type: image/gif;charset=ISO-8859-1
Server: Apache-Coyote/1.1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 65ms
54ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 47ms
46ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22f0978075a275d14104571cd0b3e9919c9748869b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22810eb8f4ed8abcee5cd1e233263d8d3f%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H3

200

activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545
6240125.fls.doubleclick.net/ Frame F851
Redirect Chain

https://6240125.fls.doubleclick.net/activityi;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545?
https://6240125.fls.doubleclick.net/activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545?

0
0

141ms
140ms

Document
text/html

172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6240125.fls.doubleclick.net/activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545?

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 182
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Thu, 24 Oct 2024 12:57:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6240125.fls.doubleclick.net/activityi;dc_pre=CN-YstaIp4kDFcQa-QAdn805wQ;src=6240125;type=windo0;cat=trend003;ord=5442765793812.545?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
analytics.google.com/g/ 0
0 52ms
51ms Fetch
text/plain 142.250.81.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-GBTVB6FHY4&gtm=45je4al0v9126309663za200&_p=1729774636039&_gaz=1&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101533422~101686685~101794737~101823847&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2136
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GBTVB6FHY4&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s74-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
48 B 53ms
53ms Ping
text/plain 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GBTVB6FHY4&cid=1237141721.1729774637&gtm=45je4al0v9126309663za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&frm=0&tag_exp=101533422~101686685~101794737~101823847
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GBTVB6FHY4&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:19 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame F820 0
0 93ms
56ms Document
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-GBTVB6FHY4&gacid=1237141721.1729774637&gtm=45je4al0v9126309663za200&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101686685~101794737~101823847&z=1959490810

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GBTVB6FHY4&cx=c&_slc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.trendmicro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 24 Oct 2024 12:57:17 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 137ms
137ms Image
image/gif 142.250.64.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-GBTVB6FHY4&cid=1237141721.1729774637&gtm=45je4al0v9126309663za200&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t6l1&npa=0&frm=0&tag_exp=101533422~101686685~101794737~101823847&tag_exp=101533422~101686685~101794737~101823847&z=1084757096

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 24 Oct 2024 12:57:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 52ms
52ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8NK5WKVH4J&gtm=45je4al0v9126156099za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823847&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2225
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8NK5WKVH4J&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 51ms
50ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-J3BCDGQ9EV&gtm=45je4al0v9125500130za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823848&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2258
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-J3BCDGQ9EV&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 51ms
51ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-93585RYGPB&gtm=45je4al0v9126552113za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823847&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2294
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-93585RYGPB&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 51ms
51ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-B6B5TMPL5M&gtm=45je4al0v9126019539za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823847&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2329
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B6B5TMPL5M&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 53ms
53ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-HSS3WREM8Z&gtm=45je4al0v9164396489za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823848&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2370
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HSS3WREM8Z&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 56ms
55ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Q8079E61JF&gtm=45je4al0v9126405765za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101686685~101794737~101823848&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2413
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Q8079E61JF&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 52ms
52ms Fetch
text/plain 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-9QHD3P38EF&gtm=45je4al0v9126425456za200&_p=1729774636039&gcs=G111&gcd=13t3t3t3t6l1&npa=0&dma=0&tag_exp=101533422~101686685~101794737~101823847&gdid=dYmQxMT&ul=en-ca&sr=1600x1200&cid=1237141721.1729774637&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&dt=Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)&sid=1729774637&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_15=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tfd=2455
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QHD3P38EF&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s39-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.trendmicro.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:17 GMT
content-type: text/plain
server: Golfe2

POST
H/1.1 200
OK visitWebPage
945-cxd-062.mktoresp.com/webevents/ 2 B
318 B 432ms
44ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1729774637684&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1729774637682-52911&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: ae7a22e5-7c6b-464d-8825-06df94ba1d33
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Thu, 24 Oct 2024 12:57:19 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

OPTIONS
H2 200 v
v.eps.6sc.co/ Frame 0
0 397ms
49ms Preflight
application/json 18.173.219.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.219.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-219-106.jfk52.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Thu, 24 Oct 2024 12:57:18 GMT
via: 1.1 64d968aa0a0b58a1d00cb142d02b0ac0.cloudfront.net (CloudFront)
x-amz-apigw-id: AJ-XQH0LoAMECXQ=
x-amz-cf-id: tY4wvTkH4wGM8sm-5UA5pvENw3tWqJ32moZilqCq27Hl7nAXvMWOEA==
x-amz-cf-pop: JFK52-P1
x-amzn-requestid: 1266c21e-ee87-4229-ac8f-e8d27bbf4341
x-cache: Miss from cloudfront

POST
H2 200 v Show response
v.eps.6sc.co/ 12 B
520 B 109ms
107ms XHR
application/json 18.173.219.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v.eps.6sc.co/v
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.219.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-219-106.jfk52.r.cloudfront.net
Software: /
Resource Hash: 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://www.trendmicro.com/

Response headers

x-amz-apigw-id: AJ-XRF2PIAMEGrQ=
x-amzn-trace-id: Root=1-671a442e-01ab172c4d5347b71a9c5993;Parent=328f7656925b251b;Sampled=0;Lineage=1:56167173:0
access-control-allow-methods: OPTIONS,POST
x-amzn-requestid: 9bfb6f96-c818-4c54-9431-183d8b9db2b9
via: 1.1 64d968aa0a0b58a1d00cb142d02b0ac0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 12
x-amz-cf-id: DxomEawJchOeQ_xheUeKJEfG7X9ikwrvMb9hkaeVov5idiG3xrmSyA==
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P1
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 47ms
46ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1948.5999994277954%2C%22duration%22%3A533.9000005722046%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1948.5999994277954%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A2482.5%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=&d=1&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 48ms
47ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:18 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
763 B 1219ms
119ms XHR
application/json 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=2908409&time=1729774638234&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Referer: https://www.trendmicro.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 000625388aec178a82b03da9b0462865
x-msedge-ref: Ref A: 1230331B8133418FBC40F8B0B37E9929 Ref B: YTO01EDGE0810 Ref C: 2024-10-24T12:57:19Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYlOIrsF4qCsD2psEYoZQ==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Thu, 24 Oct 2024 12:57:19 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmask...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmask...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2908409%26time%3D1729774638234%26li_adsId%3Dd077d95d-a2f2-447b-8797-610eca3465a9%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmask...

0
384 B

90ms
86ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&cookiesTest=true&liSync=true
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 0B3E1636A2B5469583A74877898F8DF0 Ref B: YTO01EDGE0715 Ref C: 2024-10-24T12:57:19Z
x-li-fabric: prod-ltx1
x-li-uuid: AAYlOIrpuZXWNzY55jlurQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 24 Oct 2024 12:57:18 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-fabric: prod-ltx1
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
date: Thu, 24 Oct 2024 12:57:18 GMT
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
x-li-pop: afd-prod-ltx1-x
content-security-policy: frame-ancestors 'self'
cache-control: no-cache, no-store
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2908409&time=1729774638234&li_adsId=d077d95d-a2f2-447b-8797-610eca3465a9&url=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&cookiesTest=true&liSync=true
pragma: no-cache
x-msedge-ref: Ref A: 46DEC111202541BCAC3F516A279DBA16 Ref B: YTO01EDGE0715 Ref C: 2024-10-24T12:57:19Z
x-li-uuid: AAYlOIroNq7XpQ14LC+ISg==
content-length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 48ms
48ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:19 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:19 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
212 B 180ms
178ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 39AFBD55906043CCA0469FF4D696394A Ref B: YTO01EDGE0715 Ref C: 2024-10-24T12:57:19Z
x-li-fabric: prod-ltx1
access-control-allow-credentials: true
x-li-uuid: AAYlOIrr1on5IrkRLDBo4Q==
x-li-proto: http/2
access-control-allow-origin: https://www.trendmicro.com
x-cache: CONFIG_NOCACHE
date: Thu, 24 Oct 2024 12:57:18 GMT
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 50ms
49ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:19 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:19 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 i.gif
datacloud.tealiumiq.com/trendmicro/main/16/ 43 B
765 B 45ms
44ms Image
image/gif 34.230.99.111
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/trendmicro/main/16/i.gif?t3=undefined&t4=undefined&cb=0.6380012455412305
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.230.99.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-99-111.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

vary: Origin
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-uuid: a2e8c8e5-71c7-45cc-8ee5-efa6e80a8b5e
pragma: no-cache
x-tid: db105aa0756a4e2d97859130967fb04f
expires: Thu, 24 Oct 2024 12:57:20 GMT
content-length: 43
x-serverid: uconnect_i-05470694f868e8e10
date: Thu, 24 Oct 2024 12:57:20 GMT
x-acc: trendmicro:main:16:datacloud
content-type: image/gif
x-ulver: 7923a65c0262dece38cc3fed1cfea676cc0381d1-SNAPSHOT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-region: us-east-1

GET
H2 200 adsct
t.co/i/ 43 B
464 B 462ms
146ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=c78d4e85-aa49-4fd1-ba1c-8f796a8ef0b4&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=062b529f-5fd8-4ec4-9b9d-67b330937b61&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nwah&type=javascript&version=2.3.30

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 949e39e8c89e930b
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 7188072e7181648788cc0c93923fa2ac9ef3a5f1a699923bd8abb3d55cc0c764
cf-cache-status: DYNAMIC
cf-ray: 8d7a21ce48bcac4c-YYZ
x-response-time: 80
content-length: 43
date: Thu, 24 Oct 2024 12:57:20 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 1289ms
143ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c78d4e85-aa49-4fd1-ba1c-8f796a8ef0b4&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=062b529f-5fd8-4ec4-9b9d-67b330937b61&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nwah&type=javascript&version=2.3.30

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 3c404c6b34d1249f
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 89ccc9cb348e97c7b93a138038cb7db29e8ef7b384f8d44292a5c3eee9f020cf
x-response-time: 81
content-length: 43
date: Thu, 24 Oct 2024 12:57:20 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 adsct
t.co/i/ 43 B
628 B 456ms
143ms Image
image/gif 172.66.0.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=23af6d5c-f067-4713-b80f-28f3912760fa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=062b529f-5fd8-4ec4-9b9d-67b330937b61&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nvy74&type=javascript&version=2.3.30

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: 0b674a4b967e1108
cache-control: no-cache, no-store, max-age=0
x-connection-hash: dbf8ac39e9acffc4c47e423bf58093a651d0729bca878b6943c15c46dbaf122b
cf-cache-status: DYNAMIC
cf-ray: 8d7a21ce48bbac4c-YYZ
x-response-time: 80
content-length: 43
date: Thu, 24 Oct 2024 12:57:20 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 1286ms
140ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=23af6d5c-f067-4713-b80f-28f3912760fa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=062b529f-5fd8-4ec4-9b9d-67b330937b61&tw_document_href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nvy74&type=javascript&version=2.3.30

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: 5373dac9fc81031d
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 89ccc9cb348e97c7b93a138038cb7db29e8ef7b384f8d44292a5c3eee9f020cf
x-response-time: 76
content-length: 43
date: Thu, 24 Oct 2024 12:57:20 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H2 200 2.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 315 KB
96 KB 59ms
58ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/2.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: 9ce9dde767ac632d60c8fedcf72973d7b73ab31ba4c1b7ba66b54acafea8ad77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "44e1856010ff0b18e84e012db9ef587e"
date: Thu, 24 Oct 2024 12:57:20 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: DHg9Qov9CTwG31zzITlDACDoTeZB+z+UzgFAaruyDGVh2BJT7IYzK9zjMpq6CS+IMlRNuIbIp9s=
cdn-cachedat: 10/22/2024 21:08:35
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 56b65f01addeba7c5b2013e64a38f5d4
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 38T3CBJANR14PA6Z
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 19.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 41 KB
17 KB 112ms
112ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/19.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: 6bd75299c3bfc54423f83442b734f5747df80e300c21899f2abc354c449e44e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "ca087519ca7e70b69918e1a4d518be83"
date: Thu, 24 Oct 2024 12:57:20 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: SSEEzfSi6yk/jWSg3+TGsn1M6Bxymhq3077SwUIrHQ/gaM4YQpd7+usMyqLFiNZBg+qQOy4SrK0=
cdn-cachedat: 10/22/2024 21:08:35
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 97e23594a4ef1c112cb7a7cbb2e1f1be
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 38T12RP0HXRKRN5C
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

POST
H2 200 / Show response
sumome.com/api/load/ 793 B
1 KB 114ms
112ms Fetch
application/json 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/api/load/

Requested by

Host: load.sumome.com
URL: https://load.sumome.com/19.8ce2f449e0e5a6831968.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

cc5e2950bbbccfde464c305bc439c34ee9a99f49af45e8ec0b9611a43ede9dc1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
content-length: 793
date: Thu, 24 Oct 2024 12:57:20 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

OPTIONS
H2 204 /
sumome.com/api/load/ Frame 0
0 297ms
94ms Preflight 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/api/load/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-48-201.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Thu, 24 Oct 2024 12:57:20 GMT
server: nginx/1.21.5

OPTIONS
H2 204 services
sumome.com/ Frame 0
0 96ms
96ms Preflight 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/services
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-48-201.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Thu, 24 Oct 2024 12:57:20 GMT
server: nginx/1.21.5

POST
H2 200 services Show response
sumome.com/ 29 KB
4 KB 128ms
126ms Fetch
application/json 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/services

Requested by

Host: load.sumome.com
URL: https://load.sumome.com/19.8ce2f449e0e5a6831968.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

abc7b585e06fc3a8c9e9b27c3092cc7b073ede40a202734ddebeb226d4421563

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.trendmicro.com/

Response headers

content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 24 Oct 2024 12:57:21 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 52ms
52ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A19%20GMT%22%2C%22timeSpent%22%3A%221023%22%2C%22totalTimeSpent%22%3A%224026%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:20 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:20 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 1.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 94 KB
34 KB 44ms
43ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/1.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: 21caa26c33fb920310d8d816e8ba173ff6a7153561d5b12496f12271fe659ddd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "fd781cefb818976a5a9956e71b243174"
date: Thu, 24 Oct 2024 12:57:21 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: dFOorSYHdEQEIaYdBBpZNiMDExoKlzi4Q2D9bR1eFJjxPD/bNoStm2ukvKeHFOEY+e3Wvv/DlH0=
cdn-cachedat: 10/22/2024 21:08:37
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 033a6d439850e00eec19210de45e4a78
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: GVVB93B0H2DK5CB6
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 4.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 443 KB
109 KB 52ms
51ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/4.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: a785e63bf025fd479a520e92e25d4c0eb58c723d6d381afa674f2be6c1f2d86a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "a155bef1d8cdd6ac0007a4f92f1a55ca"
date: Thu, 24 Oct 2024 12:57:21 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: 6KJ4Fzu5GyczbJybrhhywqYXjAUzuFoNXWk1Eq0DYpwHk2CoL+dpiL6TTJIp8ESKdE0NMYlCwaM=
cdn-cachedat: 10/22/2024 21:08:37
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: ae5abe726d49e4ef89481525b22f1b5c
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: GVV2QVTEB0PYPESJ
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 7.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 439 KB
116 KB 60ms
60ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/7.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: d7ad7e23c0da0e9d49b2a166fd37edb30e1691313d4bd1d1a1b1cf52b8174081

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "100a23a0fc15cd57590da38b2872bd65"
date: Thu, 24 Oct 2024 12:57:21 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: 8+CAKetacNFqYfc6GjrgSj28o6R13jeIi4IDVic7M6+UodBOvwTSGmBtf4gYaRESyYh9gMx+5WJVSkRU6SOH1RBMs2DadaZG+2CHUxpaw8A=
cdn-cachedat: 10/24/2024 09:43:08
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: bff472d33a00dc01b81f40d32b5bdde4
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: 1KYDYXSHPVFGJBHC
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 0.8ce2f449e0e5a6831968.js Show response
load.sumome.com/ 1 MB
61 KB 248ms
247ms Script
application/javascript 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://load.sumome.com/0.8ce2f449e0e5a6831968.js
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: 5a15299baa3aadd5d0989470279e7be9b6431ffa77068783ff2a169f41edf245

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
content-encoding: br
etag: "dacf2d17a63449076dfbf472fab65cdc"
date: Thu, 24 Oct 2024 12:57:21 GMT
last-modified: Tue, 22 Oct 2024 21:05:14 GMT
content-type: application/javascript
vary: Accept-Encoding
cdn-cache: HIT
cdn-requestpullcode: 200
x-amz-id-2: Z9WHIx5iC35tsShDl+b0Q5fOggvNxcdDGCCHgRFdVLJw0X3plWIxZ0uDmJp87aadUfMsTef8ce0=
cdn-cachedat: 10/24/2024 03:46:52
cache-control: max-age=31536000
cdn-requestpullsuccess: True
cdn-requesttime: 1
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: 7284e7ecfebf674c5ba6a8668cd9d485
cdn-pullzone: 1686293
cdn-proxyver: 1.04
x-amz-request-id: BDKGGPCPNJZ9W5CY
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

OPTIONS
H2 204 features
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ Frame 0
0 95ms
94ms Preflight 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-48-201.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-sumo-auth
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Thu, 24 Oct 2024 12:57:21 GMT
server: nginx/1.21.5

GET
H2 200 features Show response
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ 3 KB
2 KB 109ms
108ms XHR
application/json 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

52ae2bead6d942b75e5b9a72db391de07ee8532155744ce84681f67143d6e04c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

X-Sumo-Auth: undefined
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
content-encoding: gzip
etag: "1340772550"
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
date: Thu, 24 Oct 2024 12:57:21 GMT
content-type: application/json; charset=utf-8
vary: Origin, Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 features Show response
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ 3 KB
430 B 219ms
109ms XHR
application/json 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

52ae2bead6d942b75e5b9a72db391de07ee8532155744ce84681f67143d6e04c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

X-Sumo-Auth: undefined
Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
content-encoding: gzip
etag: "1340772550"
access-control-allow-credentials: true
access-control-allow-origin: https://www.trendmicro.com
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: application/json; charset=utf-8
vary: Origin
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

OPTIONS
H2 204 features
sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/ Frame 0
0 95ms
94ms Preflight 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sumome.com/api/site/bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a/features?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-48-201.us-west-2.compute.amazonaws.com
Software: nginx/1.21.5 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-sumo-auth
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: pragma, x-requested-with, accept, x-sumo-auth, x-sumo-token, content-type
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE
access-control-allow-origin: https://www.trendmicro.com
access-control-max-age: 2592000
date: Thu, 24 Oct 2024 12:57:21 GMT
server: nginx/1.21.5

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 48ms
47ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A20%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225026%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:21 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:21 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 css
fonts.googleapis.com/ 68 KB
3 KB 61ms
59ms Stylesheet
text/css 142.250.65.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:900,900italic,800,800italic,700,700italic,600,600italic,500,500italic,400,400italic,300,300italic,200,200italic,100,100italic

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.170 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f10.1e100.net

Software

ESF /

Resource Hash

ec1acb7dbf95791cc97fffd8d8c05826eed8faa32aa9c09ac76aa60cd82b3448

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 24 Oct 2024 11:06:55 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 /
sumome.com/api/event/ 2 B
235 B 292ms
97ms Image
text/plain 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sumome.com/api/event/?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a&app_id=156085c5-0017-4150-b225-a731ad248f38&shortcut_id=undefined&visitor_id=3f5f913fa61efdec7b1afdc4266d29f6ec07656245f13b1f15e8c57856c1480d&event=popup&href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=null&cache=0.2656038116149966

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
etag: "-684271315"
content-length: 2
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: text/plain
vary: Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 /
sumome.com/api/event/ 2 B
234 B 289ms
98ms Image
text/plain 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sumome.com/api/event/?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a&app_id=156085c5-0017-4150-b225-a731ad248f38.0ce959b66921c411b77937a579ba0f4fdf5a7023f1d5d4aed83323ed5695cefe&shortcut_id=undefined&visitor_id=3f5f913fa61efdec7b1afdc4266d29f6ec07656245f13b1f15e8c57856c1480d&event=popup&href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=null&cache=0.4557180330360391

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
etag: "-684271315"
content-length: 2
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: text/plain
vary: Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 /
sumome.com/api/event/ 2 B
234 B 295ms
105ms Image
text/plain 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sumome.com/api/event/?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a&app_id=156085c5-0017-4150-b225-a731ad248f38.5799fbb2f6d8c1ef2ebca71fc6f2d57239487d5028ce6fae35354449284a6e6b&shortcut_id=undefined&visitor_id=3f5f913fa61efdec7b1afdc4266d29f6ec07656245f13b1f15e8c57856c1480d&event=popup&href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=null&cache=0.5554868846139387

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
etag: "-684271315"
content-length: 2
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: text/plain
vary: Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
H2 200 /
sumome.com/api/event/ 2 B
234 B 289ms
100ms Image
text/plain 54.149.48.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sumome.com/api/event/?site_id=bcb4650331e445fc191ac9b7b41e418e46fc2a34a4d8417ac1cb72c278c31c3a&app_id=156085c5-0017-4150-b225-a731ad248f38.0ce959b66921c411b77937a579ba0f4fdf5a7023f1d5d4aed83323ed5695cefe.5799fbb2f6d8c1ef2ebca71fc6f2d57239487d5028ce6fae35354449284a6e6b&shortcut_id=undefined&visitor_id=3f5f913fa61efdec7b1afdc4266d29f6ec07656245f13b1f15e8c57856c1480d&event=popup&href=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&ref=null&cache=0.3177702034673946

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.149.48.201 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-149-48-201.us-west-2.compute.amazonaws.com

Software

nginx/1.21.5 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.myshopify.com https://.shopify.com
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

x-robots-tag: noindex, nofollow
content-security-policy: frame-ancestors 'self' https://*.myshopify.com https://*.shopify.com
etag: "-684271315"
content-length: 2
date: Thu, 24 Oct 2024 12:57:22 GMT
content-type: text/plain
vary: Accept-Encoding
server: nginx/1.21.5
x-frame-options: SAMEORIGIN

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 82 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 90 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/webp

GET
H2 200 4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88
media.sumome.com/ 586 B
1 KB 148ms
34ms Image
image/svg+xml 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.sumome.com/4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: d8282c6a4c6ca3d158d75674d00345a50cee1cef971be4017cf4d15be8428f1c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"d9f4d47a979053d418c2bb03066943ba"
date: Thu, 24 Oct 2024 12:57:22 GMT
last-modified: Mon, 30 Oct 2023 17:42:43 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cdn-cache: HIT
x-amz-id-2: BEylCtvRK3ep8Eg5Ufk/0e6wsUffIpG13mlW8dSLmEuZ3fLqgpmCl6pQCRxnGV7mUytiQ5ICf/Y=
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cache-control: public, max-age=2592000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: dcd2313352c4c0281b1620f42598870a
cdn-pullzone: 1699148
cdn-proxyver: 1.04
x-amz-request-id: 2AJWCHC3AXAH996N
access-control-allow-origin: *
cdn-cachedat: 10/23/2024 19:04:19
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88 Show response
media.sumome.com/ 586 B
0 148ms
148ms XHR
image/svg+xml 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://media.sumome.com/4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: d8282c6a4c6ca3d158d75674d00345a50cee1cef971be4017cf4d15be8428f1c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"d9f4d47a979053d418c2bb03066943ba"
date: Thu, 24 Oct 2024 12:57:22 GMT
last-modified: Mon, 30 Oct 2023 17:42:43 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cdn-cache: HIT
x-amz-id-2: BEylCtvRK3ep8Eg5Ufk/0e6wsUffIpG13mlW8dSLmEuZ3fLqgpmCl6pQCRxnGV7mUytiQ5ICf/Y=
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cache-control: public, max-age=2592000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: dcd2313352c4c0281b1620f42598870a
cdn-pullzone: 1699148
cdn-proxyver: 1.04
x-amz-request-id: 2AJWCHC3AXAH996N
access-control-allow-origin: *
cdn-cachedat: 10/23/2024 19:04:19
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
0 0ms
0ms Font
font/woff2 142.251.35.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:900,900italic,800,800italic,700,700italic,600,600italic,500,500italic,400,400italic,300,300italic,200,200italic,100,100italic

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f3.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 74486
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 16:15:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 16:15:49 GMT
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48236
x-xss-protection: 0
server: sffe

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
0 0ms
0ms Font
font/woff2 142.251.35.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.163 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f3.1e100.net

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://www.trendmicro.com
Referer: https://fonts.googleapis.com/

Response headers

age: 58067
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 20:49:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 20:49:29 GMT
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50296
x-xss-protection: 0
server: sffe

GET
H2 200 4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88
media.sumome.com/ 586 B
0 0ms
0ms Image
image/svg+xml 138.199.40.58
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.sumome.com/4720b373859b04afd757651cd6d7fb201973415db9d188b41026f6b394d52c88
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 138.199.40.58 New York, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 138-199-40-58.bunnyinfra.net
Software: BunnyCDN-NY1-885 /
Resource Hash: d8282c6a4c6ca3d158d75674d00345a50cee1cef971be4017cf4d15be8428f1c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cdn-status: 200
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
content-encoding: br
etag: W/"d9f4d47a979053d418c2bb03066943ba"
date: Thu, 24 Oct 2024 12:57:22 GMT
last-modified: Mon, 30 Oct 2023 17:42:43 GMT
content-type: image/svg+xml
vary: Accept-Encoding
cdn-cache: HIT
x-amz-id-2: BEylCtvRK3ep8Eg5Ufk/0e6wsUffIpG13mlW8dSLmEuZ3fLqgpmCl6pQCRxnGV7mUytiQ5ICf/Y=
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
cache-control: public, max-age=2592000
cdn-requestpullsuccess: True
cdn-requesttime: 0
cdn-uid: 9c82050d-8a2a-487e-850e-e2fa1f9b77c3
cdn-requestid: dcd2313352c4c0281b1620f42598870a
cdn-pullzone: 1699148
cdn-proxyver: 1.04
x-amz-request-id: 2AJWCHC3AXAH996N
access-control-allow-origin: *
cdn-cachedat: 10/23/2024 19:04:19
cdn-edgestorageid: 885
server: BunnyCDN-NY1-885
cdn-requestcountrycode: CA

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 87ms
47ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A21%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226027%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:23 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:23 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 53ms
52ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A22%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%227033%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:23 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:23 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 49ms
48ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A23%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228034%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:24 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:24 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 52ms
51ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A24%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%229034%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:25 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:25 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 57ms
56ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%2210035%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:26 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:26 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 63ms
62ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A26%20GMT%22%2C%22timeSpent%22%3A%223000%22%2C%22totalTimeSpent%22%3A%2213035%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:29 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:29 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 / Show response
ip.veritonicmetrics.com/ 23 B
460 B 185ms
68ms XHR
application/json 18.238.49.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ip.veritonicmetrics.com/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.49.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-49-96.jfk52.r.cloudfront.net
Software: /
Resource Hash: 544c96737d41c6447ad4305ec78c2cebbe36706767b7d74f99f6c10fc1cca501

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: private, max-age=300
x-amzn-trace-id: Root=1-671a443c-3bf6f5402acbfde815f777ed;Parent=12d27ebf4b89ce98;Sampled=0;Lineage=1:55bc2445:0
access-control-allow-methods: OPTIONS,POST,GET
x-amzn-requestid: ee3661c8-5365-4091-89b2-785b0a09e4c5
via: 1.1 20292965cdbba1b959488426be2ef49e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 23
x-amz-cf-id: Ixb5bi2Pk6y9-NYQN9elE3G_gOZ5cNaElpkQm_2igfRDe4y20XMcyw==
date: Thu, 24 Oct 2024 12:57:32 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P3

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 49ms
48ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A29%20GMT%22%2C%22timeSpent%22%3A%223000%22%2C%22totalTimeSpent%22%3A%2216035%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&an_uid=0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:32 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:32 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

OPTIONS
H2 200 /
atr-eu.veritonicmetrics.com/ Frame 0
0 402ms
128ms Preflight
application/json 52.28.215.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://atr-eu.veritonicmetrics.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.215.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-215-114.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET,OPTIONS,POST
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: AJ-Zoht5liAEPyg=
content-length: 13
content-type: application/json
date: Thu, 24 Oct 2024 12:57:33 GMT

POST
H2 200 / Show response
atr-eu.veritonicmetrics.com/ 13 B
132 B 164ms
162ms XHR
application/json 52.28.215.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://atr-eu.veritonicmetrics.com/
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.28.215.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-215-114.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: b232b740e35e175a9a671a7695fc317efc0d86304efd2733f0f8d70105c744c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://www.trendmicro.com/

Response headers

apigw-requestid: AJ-ZqiRnliAEPoQ=
access-control-allow-origin: *
content-length: 13
date: Thu, 24 Oct 2024 12:57:33 GMT
content-type: application/json

GET
H2 200 config Show response
api.equally.ai/api/v1/widget/ 39 KB
39 KB 84ms
83ms XHR
application/json 35.171.10.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=7c71737d1f34b66c7528dd8035a992bb
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.171.10.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-10-243.compute-1.amazonaws.com
Software: nginx /
Resource Hash: de92b47473cacb4f157f0a62770610c8af4dc4625238e4d691a6e1f369e24c02

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Referer: https://www.trendmicro.com/

Response headers

apigw-requestid: AJ-ZxhY5oAMEJFA=
access-control-allow-origin: *
content-length: 40180
date: Thu, 24 Oct 2024 12:57:34 GMT
content-type: application/json
server: nginx

OPTIONS
H2 204 config
api.equally.ai/api/v1/widget/ Frame 0
0 146ms
45ms Preflight 35.171.10.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=7c71737d1f34b66c7528dd8035a992bb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.171.10.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-10-243.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: GET
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,equally-auth-provider,equally-client-id,referer,user-agent,x-referer
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: AJ-ZxiLzoAMEc_g=
date: Thu, 24 Oct 2024 12:57:34 GMT
server: nginx

OPTIONS
H2 204 config
api.equally.ai/api/v1/widget/ Frame 0
0 45ms
45ms Preflight 35.171.10.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.171.10.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-10-243.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-referer
Access-Control-Request-Method: POST
Origin: https://www.trendmicro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type,equally-auth-provider,equally-client-id,referer,user-agent,x-referer
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: AJ-Zzh_2oAMEciA=
date: Thu, 24 Oct 2024 12:57:34 GMT
server: nginx

POST
H2 200 config Show response
api.equally.ai/api/v1/widget/ 27 B
158 B 85ms
84ms XHR
application/json 35.171.10.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.equally.ai/api/v1/widget/config?apiKey=82MjGgGBc5p9X1otEipH&userID=undefined
Requested by: Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.171.10.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-10-243.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776

Request headers

Referer: https://www.trendmicro.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
X-Referer: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Content-Type: text/plain;charset=UTF-8

Response headers

apigw-requestid: AJ-ZzhRsIAMEcDg=
access-control-allow-origin: *
content-length: 27
date: Thu, 24 Oct 2024 12:57:34 GMT
content-type: application/json
server: nginx

GET
H2 200 en.json Show response
widget.equally.ai/locales/ 10 KB
4 KB 116ms
39ms Fetch
application/json 108.139.29.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.equally.ai/locales/en.json

Requested by

Host: widget.equally.ai
URL: https://widget.equally.ai/equally-widget.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.29.47 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-139-29-47.jfk50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8217d4cfca53c8bbe23edfb6df20e2b0fadfa55222fecadb246ddb7c281c2163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"8d57fd76fc218da7e4745626a703c1ad"
age: 65819
access-control-allow-methods: HEAD, GET
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: L46czAbYkGTzPyAp_r9XDu0WkLwulUSuKiI3oEW75YgRglz8sOd3Aw==
date: Wed, 23 Oct 2024 18:40:36 GMT
content-type: application/json
vary: Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
last-modified: Tue, 22 Oct 2024 16:09:23 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 8e923e72a50f75048382f193bf6c8c4e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 48ms
48ms Image
image/gif 23.33.42.75
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&visitor=b41218f3-3422-4848-8e05-eb83a9212fe1&session=fa6d3bf4-2a95-4124-8d9b-758dd0fdd347&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2024%20Oct%202024%2012%3A57%3A32%20GMT%22%2C%22timeSpent%22%3A%223002%22%2C%22totalTimeSpent%22%3A%2219037%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20does%20Prometei%20insidiously%20operate%20in%20a%20compromised%20system%3F%20This%20Managed%20Extended%20Detection%20and%20Response%20investigation%20conducted%20with%20the%20help%20of%20Trend%20Vision%20One%20provides%20a%20comprehensive%20analysis%20of%20the%20inner%20workings%20of%20this%20botnet%20so%20users%20can%20stop%20the%20threat%20in%20its%20tracks%20before%20it%20inflicts%20damage%20to%20the%20system.%22%2C%22keywords%22%3A%22endpoints%2Cresearch%2Carticles%2C%20news%2C%20reports%2Ccyber%20threats%22%2C%22title%22%3A%22Unmasking%20Prometei%20A%20Deep%20Dive%20Into%20Our%20MXDR%20Findings%20%7C%20Trend%20Micro%20(DE)%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&pageViewId=54db7852-1a5e-49d3-80f7-d47d350edcd0&an_uid=0&v=1.1.29

Requested by

Host: www.trendmicro.com
URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.75 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-42-75.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.trendmicro.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Thu, 24 Oct 2024 12:57:35 GMT
accept-ranges: bytes
content-length: 43
date: Thu, 24 Oct 2024 12:57:35 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 6240125.fls.doubleclick.net
URL: https://6240125.fls.doubleclick.net/activityi;dc_pre=CKedqNaIp4kDFXUn-QAddUArPA;src=6240125;type=windo0;cat=trend003;ord=3001440166252.0186?

Verdicts & Comments Add Verdict or Comment

178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

56 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.tealiumiq.com/trendmicro	1970-01-21 10:05:34	Name: TVT Value: Thu+Oct+24+12%3A57%3A20+2024~~~undefined~undefined~~~~~~
.trendmicro.com/	1969-12-31 23:59:59	Name: _c1Ref Value: /de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
.trendmicro.com/	1969-12-31 23:59:59	Name: _formRef Value: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
.trendmicro.com/	1970-01-21 01:12:46	Name: channeloriginator Value: Direct
.trendmicro.com/	1970-01-21 01:12:46	Name: channelcloser Value: Direct
.trendmicro.com/	1970-01-21 10:05:34	Name: initialTrafficSource Value: utmcsr=(direct)\|utmcmd=(none)\|utmccn=(not set)
.trendmicro.com/	1969-12-31 23:59:59	Name: __utmzzses Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: Vzw2uMbuEQs
.youtube.com/	1970-01-21 04:48:46	Name: VISITOR_INFO1_LIVE Value: xIGy0iG3UYU
.youtube.com/	1970-01-21 04:48:46	Name: VISITOR_PRIVACY_METADATA Value: CgJDQRIEGgAgGw%3D%3D
www.trendmicro.com/	1970-01-21 00:29:34	Name: NSC_MC_dxu-bfn-xfc_XBG-IUUQ Value: ffffffff09224f4345525d5f4f58455e445a4a423660
.trendmicro.com/	1970-01-21 00:31:01	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Oct+24+2024+05%3A57%3A16+GMT-0700+(Pacific+Daylight+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=4690f74c-d55f-4f00-a9ff-0be09a803740&interactionCount=0&landingPath=https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html&groups=C0001%3A1%2CC0002%3A1%2CC0003%3A1%2CC0004%3A1
.trendmicro.com/	1969-12-31 23:59:59	Name: google_id_captured Value: true
.trendmicro.com/	1970-01-21 00:31:01	Name: _gid Value: GA1.2.632915050.1729774637
.trendmicro.com/	1970-01-21 00:29:34	Name: _gat_tealium Value: 1
.trendmicro.com/	1970-01-21 02:39:10	Name: _gcl_au Value: 1.1.5191721.1729774637
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_PCCSVH5M9H Value: GS1.1.1729774636.1.0.1729774636.60.0.1720214677
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga Value: GA1.1.1237141721.1729774637
.www.trendmicro.com/	1970-01-21 00:39:39	Name: RT Value: "z=1&dm=www.trendmicro.com&si=510ba2f7-95a1-440a-a6d0-a98215c1b4b5&ss=m2nb5mlm&sl=0&tt=0&bcn=%2F%2F68794911.akstat.io%2F"
.trendmicro.com/	1970-01-21 02:39:10	Name: _fbp Value: fb.1.1729774637120.378148528425924745
.trendmicro.com/	1970-01-21 00:29:36	Name: _ots Value: 1.1729774637008.1729774637008.1729774637008
.trendmicro.com/	1970-01-21 10:05:34	Name: _otui Value: 309067561.1729774637008.1729774637008.1729774637008.1.1.0
.trendmicro.com/	1970-01-21 00:29:36	Name: _otpe Value: https%3A%2F%2Fwww.trendmicro.com%2Fde_de%2Fresearch%2F24%2Fj%2Funmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
www.trendmicro.com/	1970-01-21 10:05:34	Name: _gd_visitor Value: b41218f3-3422-4848-8e05-eb83a9212fe1
www.trendmicro.com/	1970-01-21 00:29:49	Name: _gd_session Value: fa6d3bf4-2a95-4124-8d9b-758dd0fdd347
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_GBTVB6FHY4 Value: GS1.2.1729774637.1.0.1729774637.60.0.0
.doubleclick.net/	1970-01-21 04:48:46	Name: receive-cookie-deprecation Value: 1
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_8NK5WKVH4J Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_J3BCDGQ9EV Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_93585RYGPB Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_B6B5TMPL5M Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_HSS3WREM8Z Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_Q8079E61JF Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.doubleclick.net/	1970-01-21 01:12:46	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-21 10:05:34	Name: IDE Value: AHWqTUnE60PNhRy-Mm7msLQRKnvH3nloAzrJB1Z_yhw5BDUrCGQy_KNWG2ohRzIw
.trendmicro.com/	1970-01-21 10:05:34	Name: _ga_9QHD3P38EF Value: GS1.2.1729774637.1.0.1729774637.0.0.0
.trendmicro.com/	1970-01-21 10:05:34	Name: _mkto_trk Value: id:945-CXD-062&token:_mch-trendmicro.com-1729774637682-52911
.yahoo.com/	1970-01-21 09:15:32	Name: A3 Value: d=AQABBC1EGmcCEIOln9ZWgbmaDuoUhas-Sv0FEgEBAQGVG2ckZyXaxyMA_eMAAA&S=AQAAAhi8PtK1lb93IexjIByGeIs
.linkedin.com/	1970-01-21 00:31:01	Name: lidc Value: "b=TGST06:s=T:r=T:a=T:p=T:g=3026:u=1:x=1:i=1729774638:t=1729861038:v=2:sig=AQGzYxCi5NRZSlO2S4ovDH0MYLmt96G7"
.linkedin.com/	1970-01-21 02:39:10	Name: li_sugr Value: 3b465743-a43f-4d41-bba3-db6c71f7b7fb
.linkedin.com/	1970-01-21 01:12:46	Name: UserMatchHistory Value: AQL-EM4W2sNxRwAAAZK-mlgGtNsLUcsVBfqjH3lmWoV4MGi5GoStBcK4Nts4I6Qb1AWN5L8QzkiovQ
.linkedin.com/	1970-01-21 01:12:46	Name: AnalyticsSyncHistory Value: AQJSjIlb62XZlAAAAZK-mlgGraV9sZMqymU0aauGOxb7T9ddAdkEr00v4Y1dAPrsMvHLDpyfV5BZ9qVBTfGimg
.linkedin.com/	1970-01-21 09:15:10	Name: bcookie Value: "v=2&47ac99a1-2fcc-413d-898f-a4a8afa76594"
.www.linkedin.com/	1970-01-21 09:15:10	Name: bscookie Value: "v=1&20241024125719da80aeb4-905d-42a0-805a-ddad6113ab97AQGJ7T7cphqFc87iQg0Dywv8NK1hT3e8"
.doubleclick.net/	1970-01-21 00:29:35	Name: test_cookie Value: CheckForPermission
.tealiumiq.com/	1970-01-21 09:15:10	Name: TAPID Value: trendmicro/main>db105aa0756a4e2d97859130967fb04f\|
.trendmicro.com/	1970-01-21 09:15:10	Name: utag_main Value: v_id:0192be9a4bd800b083e889a79ae005065006905d00b08$_sn:1$_ss:0$_st:1729776439996$ses_id:1729774635994%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/	1970-01-21 01:12:46	Name: channelflow Value: Direct\|other\|1732366640000
www.trendmicro.com/	1970-01-21 01:12:50	Name: __smVID Value: 3f5f913fa61efdec7b1afdc4266d29f6ec07656245f13b1f15e8c57856c1480d
.t.co/	1970-01-21 10:05:34	Name: muc_ads Value: bbcd7826-3cae-4ea4-9e67-38645e6f0100
.t.co/	1970-01-21 00:29:36	Name: __cf_bm Value: CrkZOfkGAUjQtF1VWO61XompLPv2B_QdKJGyKdmNcFQ-1729774640-1.0.1.1-3KgkzppYQqsgUaA8AzRfl7VLcIGKS0PEUn2.U1hbFs2BuJmYUSQtlr4a0eMSpAPSaa9Lu.ikWmMFTf_NHmikpQ
.twitter.com/	1970-01-21 10:05:34	Name: personalization_id Value: "v1_XRTeqEzl8YbC1YeCAqfe9w=="
www.trendmicro.com/	1970-01-21 10:05:34	Name: __smSmartbarShown Value: Thu%20Oct%2024%202024%2005:57:22%20GMT-0700%20(Pacific%20Daylight%20Time)
.resources.trendmicro.com/	1970-01-21 00:29:36	Name: __cf_bm Value: iq3VSvdqd0syyL8jM_AIHWVdZI5lfPqZ43T40LSy6TM-1729774652-1.0.1.1-QmT.6ioLo_v8EIoDufWpwGMtsm1UnOPrfTTzq0t0GH3qrWgxAOUakhdI.2NPeDIgVS9gf_9lhrb2On4tBGALgA
.adnxs.com/	1970-01-21 10:05:34	Name: receive-cookie-deprecation Value: 1
www.trendmicro.com/	1970-01-21 00:39:39	Name: _an_uid Value: 0

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.sync.js(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://tags.tiqcdn.com/utag/trendmicro/europe/prod/utag.sync.js(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://www.trendmicro.com/libs/granite/csrf/token.json Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.disruptorV2.json Message: Failed to load resource: the server responded with a status of 404 ()
rendering	warning	URL: https://www.trendmicro.com/de_de/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0601D00B4010000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6240125.fls.doubleclick.net
945-cxd-062.mktoresp.com
analytics.google.com
analytics.twitter.com
api.equally.ai
atr-eu.veritonicmetrics.com
b.6sc.co
c.6sc.co
c.go-mpulse.net
cdn.bc0a.com
cdn.cookielaw.org
cdn.veritonic.com
cm.g.doubleclick.net
connect.facebook.net
customer.cludo.com
datacloud.tealiumiq.com
eps.6sc.co
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
ip.veritonicmetrics.com
ipv6.6sc.co
ixfd2-api.bc0a.com
j.6sc.co
load.sumome.com
log.leadboxer.com
log.opentracker.net
media.sumome.com
munchkin.marketo.net
px.ads.linkedin.com
resources.trendmicro.com
s.go-mpulse.net
script.opentracker.net
secure.adnxs.com
snap.licdn.com
sp.analytics.yahoo.com
static.addtoany.com
static.ads-twitter.com
stats.g.doubleclick.net
sumome.com
t.co
tags.tiqcdn.com
td.doubleclick.net
trendmicro.scene7.com
v.eps.6sc.co
widget.equally.ai
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.linkedin.com
www.trendmicro.com
www.youtube.com
6240125.fls.doubleclick.net
104.17.70.206
104.18.32.137
104.18.86.42
104.22.28.96
104.22.70.197
104.244.42.3
104.96.84.186
108.139.29.47
13.107.42.14
13.225.63.116
138.199.40.58
139.162.178.190
139.177.182.128
142.250.64.99
142.250.65.170
142.250.65.200
142.250.80.34
142.250.81.238
142.251.32.98
142.251.35.163
142.251.40.228
142.251.40.238
146.75.28.157
172.217.165.134
172.253.122.156
172.66.0.227
172.67.39.148
18.173.219.106
18.238.49.96
192.28.144.124
23.200.3.33
23.204.6.193
23.239.22.30
23.33.42.75
23.33.42.88
23.39.36.184
23.44.201.149
23.56.162.160
3.168.102.45
31.13.80.12
31.13.80.36
34.111.194.12
34.230.99.111
35.171.10.243
35.201.125.192
52.28.215.114
52.72.192.139
54.149.48.201
68.67.179.166
99.83.231.3
01ac050d2b55e284ce67847f85f2d85fc6facd41934bd30f055235fe754a92fd
0493eeab44cf3747fa91f18320f7f6206fc12cb851115dc7cd94fcd1c405a11d
08a133d2709f4ec7be7169310eb97799fba7f35810bed022dcc4523a51715dac
09671211b3dfce338d7b10e0facceb4e544a681f06578357653142c67c1c9738
0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae
0c0809c5501a44a8163889f864f5e1ac5bf40278c7c876cbbcb3b42258bf1600
0d050dd8e451aa5ced84df0d65f5bc418c771bcc48fbd6a1e228f464a7aebdfc
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e
100bfa4f54e66d0ce2ee2e0b99e8299badcf4bc97067200e3b259e33e1746168
10f3b7d24980ea38d92bdb807f87518eb7b8f6523805458b3d0c2e00a25c20c5
1203817a41844d7b3fb01f6ebdef78975b98e96e09719b60fecc368afde2fc6e
1287c8080a63948b642eba779165be748e3ea564dae96b986f2fa82f05f2839c
14ac47a3f8c91eddbb4c93a48b64e6122e31887390d8bf874dbbea6734e420d9
16270c15435abfbd1e22c9a06378d29d8823f68d61216d61422d1b0b0643e776
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1bf3c2bc7a61528d088ad564a9ce1138491498bffc1988c38051be666b6e0c3c
1c580985c46f2d69e9d251c3275a031da27d8219e702677f7285ddad9134c562
1c6332d1095765afdba83cbea8981167447bc9a4cd7a68167636925cdec58451
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1d4b9c9db31602e3a45ae73efab893ceb4bac5d793014bbb44f3575fc4351681
1ec6e60eccd6b2d3ff7edf499b388216646cd18d1341bef9ddb6b66148bec3f1
1f30fa6c414ccbf78465b96e421d266c3ef9b09c24b69fe19434906ea79cba71
1ff3865cdff9d499b02953d709b9e32c2ab673c6382668d6134df4f4c0d83e65
21caa26c33fb920310d8d816e8ba173ff6a7153561d5b12496f12271fe659ddd
23ff59faa9b93a2e6e2070924a335754bc400f011fccffa05502fd3e6c591635
250b88dc794a09ae133909d82987e866c00496c39aa7383f0e87bd6e775c1641
293ceaa480bda1594e9f61f6a52858999cd0aad1ef4f5d3eafe7cc559727e41d
2f4a8b2033486a210029ae51394b7d80caa72b1e1c8c322e9fd6e59a9eefbb5b
2f8847dddd520cab371dd2e596ea27f647fbf18dcda0dadc2e7a8ec6af7614ab
314a4db2e647c5063a6f63b6436ec31ce63e91a476b77aad634f8b7f2ed1de90
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1
34c2c75fc039a1ecb484fd4fa42cea1bfdf227c65ceacc982cc2dc68e1e0a4a4
3a3abfe7b0630828bff7d1f3a6e29c316f1a432e1909877d8c713abf14e43c3e
3b6f04db9bb0fc01a5789192f3559e3f34680431da3bc7d81146136a227e61ac
3c455a838efdbb611b38e5727139ab7b298aa9e6d7b9229e70e0026182c59acb
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3d745f856b16c6caea232b133da71099351fa3cdb9cb8c386c7de5658e2a048f
3da90cb72f6e3e0d7ac0a5117bd5bd0655d25af44513c191079f859b3efc5b32
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3f95c868390ea2426ee26d756867a51141df402ab30ccc73404c16450fc10f4b
3fc10fa26cb2eae1cc63eff73e36d3b4c151cd2e87011765797b1b5ec43d26ca
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4a7f7e246fb61ccc3f57cd38061bbbdd4ada9768649d9d3e3362ec46be278bf5
4c38452d4117e2bb77829601aca27ac6584ebdf4d42ce505c0f7b1ae0f933147
4cb7065a0872567d945dcc1bf304379e4dbcd73d46b15b89d112c939a09986b4
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
4d3fc03e1f18ac04b15cc9e5d5ed5329914683224daa6006f76a0f64b8b04e5e
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
52ae2bead6d942b75e5b9a72db391de07ee8532155744ce84681f67143d6e04c
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
544c96737d41c6447ad4305ec78c2cebbe36706767b7d74f99f6c10fc1cca501
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56df5bf2317bc2156b954c3fd2913afcce23eb4947c47f3ac401017dc4a0151d
5a15299baa3aadd5d0989470279e7be9b6431ffa77068783ff2a169f41edf245
5c30d00dbb97ec4c05d6b41e850ea8ffab1c1623692de4193bcb235639be1d8d
5c3cf48f20089b1c9095808f743222bc3367cdff033bdc92938eee628b6edb3b
5e22ea5c930abbc085ab76916ce30cff31ab7aefc38bcb7dc1158b3c500303d8
5f54be95a8fda6209738cf8e2d35c303f65164494d9e898619abf32789a2c40e
60aaad2288d23fb03527331b7b03e1f1643898e136a926f1d48609f453babd85
6134e5e0a001daf2d5fe6b645a5efa85314c1fcf95f5407c20def106dfdec557
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6798b334b1b266b9770232d8c0d0099e23b6640c6debb3908c58383c30a91bd9
68c21f3bfefc064bc07808b48bba6165dfc210d152ba4a6a35a567ed49151877
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bd75299c3bfc54423f83442b734f5747df80e300c21899f2abc354c449e44e4
6c04d9bf543d950d0a664dcf8927022d547b28227d31c34b631b87de46ab120e
718b81757a4a4d863ff8f7ee379db24abde81658399d718e4592cf265b04caaa
7263aa840c4c665c1fa89963da7cdf2e29c62f2c0c624fccc609d215ad4217c8
7358c5616f671017f307d161644d253f0f81083b0be68f3a3fefefa33b59de5d
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
74f5da663574c88f8694494adf45161949674fcfff783f3306b0644dc2a84adb
755eda4e50235ef25d84799d5aab35fc7dd0528f0db87136623122da16716065
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7a7280f1650ce525c8ef8072dbedcb0ad083493a82e588613c7057cdf2eda329
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551
800dcc0d92c0059f497bdc7b22fd7f870cce1250418d08280f7ca43151d32fea
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
8217d4cfca53c8bbe23edfb6df20e2b0fadfa55222fecadb246ddb7c281c2163
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84f657435e631a1442815def2faa66eb24833b1047908ebd71275bfbef9690ed
85b9993d5c3520b413924e989acd330dd81b514a473620078dff49b35fe054df
87f3c566fded467082953eef2a96ae49cce26e2ee4d5f7dde84d95f6da5858e9
898241655767777d954a01288720b8487c6bfcaf831a0243b1e19a5cc67906a3
8ceb75d474e0458a42876b949f086cd646f599f128e924b84525a86e42147c6d
8f165f985e320dc59f197fbbb490da7c547d89887457ad09dfe75599c950bc7f
8f2c4bcb919e31182646d5e52650914f15a9cc8ff0847d30c4dc4adcd4c2653c
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
92ddc3a1e1de81b4af1c6657015497cefc874ee4baf933cd8146f2ab2cbfc9b7
93a14f0cba4e6906e213fec85a81d6576c9f71442c95b81fa921c46af69753be
9ce9dde767ac632d60c8fedcf72973d7b73ab31ba4c1b7ba66b54acafea8ad77
9d58d37478267b7e6fcce1827c0797d820a5c627604dc049903c7ed5ee7d1961
9e82d046eab9f90243836f4a53d62c9f3630394011fc3a726479e56b727a2e19
9f0f8b97bbedd536c657c8509450f8dbcc3618032ee7b22577d6d6f00f6a0e47
9f8cc976de5717cbe83d70ee0d8ab102de48f530ac9774540259d0231075366f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a317d0c413b8d00f74e5778405d2d72eaae5a9dbc6cec47ec320e21759584d65
a61f59bf0a3696f4fdf94840e15f741a4c2562427891eaa14de7d5cd0d6b586e
a69c1d25c1bcf2144debc26ca1a27f6194f3d98473071a3f38ca9a40bfa82b75
a785e63bf025fd479a520e92e25d4c0eb58c723d6d381afa674f2be6c1f2d86a
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
abc7b585e06fc3a8c9e9b27c3092cc7b073ede40a202734ddebeb226d4421563
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acf59197679c94a3b3eb2591f4127a1121474dd5c9110067db172a657dadd822
ad514bcb3f2e982a190a5e963a29655f37824683a85f6b9ebe942ebd735e18ae
b0320c6cf482b927eed1b60c209708227cefae4b49cb87518f87bba744f333ed
b232b740e35e175a9a671a7695fc317efc0d86304efd2733f0f8d70105c744c9
b3cad51ca0cfdbeac9d38f7aad54e6564408f0da56a6fd56350e0d03d4f0aef9
b400a41d9cf76d300fa0295e88e1200125f1b8be6ffb975f8bb0970f60ed96cd
b48790495eddeae3e0430f64ecc844e3c3697501416e416cc8debc2d34211c31
b542a8a622ba0605abd4a9bd0e3bf7270f4369489003f21d7f04693f8b7902f5
b63f6e5a8a265a75b9b48aa4e989103767103eae931f6e07e75a867a66f1a0b3
b7431a06942519f1e9aaac2822856ef1c372797c26c2e5d4aaf823623557201a
b8217635d6b5c4c2041a155603a487da7b6fab112152e8095b23b660a32ee5bb
b9d976b4a534de7d216ef42fe69261fdb9c2b2d60b0e536f181040e075b5e7b2
ba03811c426a87e10d1b6a3744fd8d91843e5a2ebb1d62f681e1ced558375c53
bc6e1ea2c2ddcb591413f7bd88178f4563bd3dbbb5726fa86ad11777f99d5bf4
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
be5961e267b1d1c503355c8e716be39139f9671ebc7d6a58719e1aaf9e82025f
beb4690cf911f555766083248e81809736077be198a40edad9868c9e4469ca65
c1fe01fd7089945bec5c6468c09e8e461af87869f2fad13393dc682f62ac84cf
c204eedfcbc423fbebdec6aeca7659702d6a0c4f773024ec02333c40b3ea0938
c8cf8672c5a4d67f575a1234a06d2510aae4af895dc54625db471316d7884ded
c8dbeda740f1f4c121c84b5a63dcdb672ef6f9f130a7734f5e981113e5bbc3b8
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
c9cf6b9f1614666063ed6559738b01479aac79f6a4fde04cef2bcd352cae0ea2
ca70357bd2a65bc9f6ecaac6e388340eeec552358d5c4a405b249f2fe2bd3c84
cb8c839f8d393bc88940076ce6d506432058517cd78b32affee721dcd34e4bd4
cc5e2950bbbccfde464c305bc439c34ee9a99f49af45e8ec0b9611a43ede9dc1
cd1eef6ba8780ec4e408014498fe98f8691792cc00168d4b115f1500d502a3fc
d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382
d2add63014ec164711e0bcfa84e92b53f72b286924c5e22e5e3c9b4d2dd25dc7
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d426094c168051f30c71c81f5a51fe910cd31d2cdb2138d71ea0db1029c1186f
d46743617f18e2efd828df550093f9f45643dbb273eb527ca35c8254cc6a3e18
d50a796a476b1fcf5c96954fd3576ff056c278490683dce6f1504a9ded73edc1
d53f1292d5f4f237386f702b79d61d54e44d1afedbc1984a33a776cd4f586ef1
d5b9c1772d4bae40f46a7606b70fac2717527ef459d6c02977d98bafcb648a32
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
d7ad7e23c0da0e9d49b2a166fd37edb30e1691313d4bd1d1a1b1cf52b8174081
d8282c6a4c6ca3d158d75674d00345a50cee1cef971be4017cf4d15be8428f1c
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
d8e64236dc73bfdfe4eb0e876db2c6b7ef3d068b3ea9646ca0091f283a08398c
da316d75d41c92dac17387c6c4e18d457cbbecb0587ed53081bb21afcb4e0e10
da8c4697d246d5dde073b87ff33798d3fc46c4a3c5ca37626292b8efc7c3de99
dc3855b86a189b170776cf2b7ab327151d2818495a447eaf9005afd98ad69bbf
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de92b47473cacb4f157f0a62770610c8af4dc4625238e4d691a6e1f369e24c02
deafd7212c6cff5c9736590aa0633108ce0a931fa3d71c25134663e8d1de3477
e2b6b69e884b97b64d32ec79daaae0c8a743a198e1b972ef97e154f5d5f86f3a
e2d076558e62fb356fd49d3aab6a28e8a0fa5c7175804985663c1f9f64b5f6f1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e977378fc763940e16a1785f5a7270ad54cff08c6f929d88e3b050ec2a84a580
e9a8f9fcf432531424d3666b4e613b7977f2a12d4627554e9152cb895c18bd19
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ec1acb7dbf95791cc97fffd8d8c05826eed8faa32aa9c09ac76aa60cd82b3448
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f20b7f18279af9a017fdf103c3f1563bdf7a51085dc768141c16c29e0aa69d96
f2797c899aa8d506a11db5c393bfded690a682723a3f313e7df6eb038b89241f
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
fbac24429269d33701e02afa81c3288fa2b63f931d1b4193201346ed328a6af5
fccc0c93601e70e152b4337e6448f90fe3771495da1c42c703a8181347b479b6
fd576a11f562214c87a771d16d82a567b2b1d6cdbd04a4d6b6cc643fd8a1fd3f
fd62f3f14e54832fd06aa307ddb2385d956be87969d9d6b330f47c15053d5984
fdf1fceaeb7550d275b69644a89b96e5c6346de1b511bf4b3d29a6e1719d966d
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fec6e7c36c69095d38ed7ec24d0e3c27e42a45e60470a977029dff2e18fab316

www.trendmicro.com Open in urlscan Pro 23.56.162.160 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

238 Requests

98 %HTTPS

0 %IPv6

36 Domains

54 Subdomains

50 IPs

4 Countries

6145 kBTransfer

14595 kBSize

56 Cookies

28 Outgoing links

Redirected requests

238 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.trendmicro.com Open in urlscan Pro
23.56.162.160 Public Scan

Screenshot
Live screenshot

Full Image

238
Requests

98 %
HTTPS

0 %
IPv6

36
Domains

54
Subdomains

50
IPs

4
Countries

6145 kB
Transfer

14595 kB
Size

56
Cookies

238 HTTP transactions
4 data transactions