Submitted URL: http://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Effective URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Submission: On August 11 via api from DE — Scanned from DE

Summary

This website contacted 42 IPs in 5 countries across 31 domains to perform 127 HTTP transactions. The main IP is 2606:4700::6812:1d4a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com. The Cisco Umbrella rank of the primary domain is 57901.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 7th 2023. Valid for: a year.
This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
23 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
7 104.17.70.206 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2001:4860:480... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
8 151.101.66.137 54113 (FASTLY)
10 95.101.111.170 20940 (AKAMAI-ASN1)
2 6 2600:9000:225... 16509 (AMAZON-02)
1 2a02:26f0:780... 20940 (AKAMAI-ASN1)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 152.195.15.58 15133 (EDGECAST)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.7.151.245 14618 (AMAZON-AES)
1 2600:9000:217... 16509 (AMAZON-02)
1 35.244.142.80 15169 (GOOGLE)
1 108.138.15.119 16509 (AMAZON-02)
1 54.145.46.195 14618 (AMAZON-AES)
2 104.102.38.132 16625 (AKAMAI-AS)
2 34.111.208.231 396982 (GOOGLE-CL...)
2 2600:9000:224... ()
4 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 162.247.243.29 54113 (FASTLY)
2 2a03:2880:f17... 32934 (FACEBOOK)
2 2001:4860:480... 15169 (GOOGLE)
1 37.252.171.149 29990 (ASN-APPNEX)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
4 13.224.189.44 16509 (AMAZON-02)
1 54.149.190.242 16509 (AMAZON-02)
2 3.127.67.224 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 35.81.173.170 16509 (AMAZON-02)
1 35.81.162.201 ()
127 42
Apex Domain
Subdomains
Transfer
31 zscaler.com
www.zscaler.com — Cisco Umbrella Rank: 57901
info.zscaler.com — Cisco Umbrella Rank: 692454
2 MB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5628
c.6sc.co — Cisco Umbrella Rank: 8755
ipv6.6sc.co — Cisco Umbrella Rank: 5816
b.6sc.co — Cisco Umbrella Rank: 3737
22 KB
8 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 475
26 KB
8 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 377
129 KB
7 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2744
d.adroll.com — Cisco Umbrella Rank: 1440
28 KB
7 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2770
www.google.com — Cisco Umbrella Rank: 3
1 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 368
www.linkedin.com — Cisco Umbrella Rank: 543
px4.ads.linkedin.com — Cisco Umbrella Rank: 5984
5 KB
6 google.de
www.google.de — Cisco Umbrella Rank: 5933
948 B
6 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
stats.g.doubleclick.net — Cisco Umbrella Rank: 114
5 KB
4 fullcircleinsights.com
st.fullcircleinsights.com — Cisco Umbrella Rank: 96589
4 KB
3 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 890
gw.linkedin.oribi.io — Cisco Umbrella Rank: 13292
25 KB
3 mountain.com
dx.mountain.com — Cisco Umbrella Rank: 6238
px.mountain.com — Cisco Umbrella Rank: 6266
gs.mountain.com
8 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 14482
ibc-flow.techtarget.com — Cisco Umbrella Rank: 16174
2 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 54
21 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 65
291 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9585
572 B
2 cloudfunctions.net
us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 3207
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 107
257 B
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3627
7 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 170
157 KB
2 bing.com
bat.bing.com — Cisco Umbrella Rank: 374
13 KB
1 mktoresp.com
306-zej-256.mktoresp.com
318 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 464
571 B
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 295
405 B
1 sf14g.com
t.sf14g.com — Cisco Umbrella Rank: 59114
1 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1346
insight.adsrvr.org Failed
3 KB
1 pdst.fm
cdn.pdst.fm — Cisco Umbrella Rank: 3187
6 KB
1 cloudfront.net
d2i34c80a0ftze.cloudfront.net
11 KB
1 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 6447
25 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 819
5 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 641
310 B
127 31
Domain Requested by
24 www.zscaler.com 1 redirects www.zscaler.com
8 js-agent.newrelic.com www.zscaler.com
8 cdn.cookielaw.org www.zscaler.com
cdn.cookielaw.org
7 b.6sc.co
7 info.zscaler.com www.zscaler.com
info.zscaler.com
6 s.adroll.com 2 redirects www.googletagmanager.com
s.adroll.com
6 www.google.de www.zscaler.com
5 www.google.com www.zscaler.com
4 st.fullcircleinsights.com cdn.bizible.com
4 px.ads.linkedin.com 3 redirects
3 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 googleads.g.doubleclick.net www.googletagmanager.com
3 www.googletagmanager.com www.zscaler.com
www.googletagmanager.com
2 epsilon.6sense.com cdn.bizible.com
2 us-central1-adaptive-growth.cloudfunctions.net cdn.pdst.fm
2 www.facebook.com
2 cdn.linkedin.oribi.io snap.licdn.com
2 ibc-flow.techtarget.com trk.techtarget.com
2 munchkin.marketo.net www.zscaler.com
munchkin.marketo.net
2 connect.facebook.net www.zscaler.com
connect.facebook.net
2 bat.bing.com www.googletagmanager.com
bat.bing.com
2 j.6sc.co www.googletagmanager.com
j.6sc.co
2 region1.analytics.google.com www.googletagmanager.com
1 gs.mountain.com www.zscaler.com
1 px.mountain.com dx.mountain.com
www.zscaler.com
1 306-zej-256.mktoresp.com munchkin.marketo.net
1 gw.linkedin.oribi.io cdn.bizible.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 bam.nr-data.net js-agent.newrelic.com
1 d.adroll.com s.adroll.com
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 t.sf14g.com www.zscaler.com
1 js.adsrvr.org www.googletagmanager.com
1 cdn.pdst.fm www.zscaler.com
1 d2i34c80a0ftze.cloudfront.net www.googletagmanager.com
1 dx.mountain.com www.zscaler.com
1 trk.techtarget.com www.zscaler.com
1 cdn.bizible.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 geolocation.onetrust.com cdn.cookielaw.org
0 insight.adsrvr.org Failed js.adsrvr.org
127 45
Subject Issuer Validity Valid
www.zscaler.com
DigiCert SHA2 Extended Validation Server CA
2023-02-07 -
2024-03-09
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
info.zscaler.com
Cloudflare Inc ECC CA-3
2022-11-08 -
2023-11-07
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh
www.google.de
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh
www.google.com
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh
6sc.co
R3
2023-05-25 -
2023-08-23
3 months crt.sh
s.adroll.com
Amazon RSA 2048 M01
2023-06-03 -
2024-07-01
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
io.bizible.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-01 -
2024-07-01
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-05-20 -
2023-08-18
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-06-25 -
2024-06-24
a year crt.sh
*.mountain.com
Go Daddy Secure Certificate Authority - G2
2023-06-12 -
2024-06-23
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
cdn.pdst.fm
GTS CA 1D4
2023-07-25 -
2023-10-23
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
t.sf14g.com
Amazon RSA 2048 M01
2023-07-10 -
2024-08-07
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
ibc-flow.techtarget.com
GTS CA 1D4
2023-07-26 -
2023-10-24
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
d.adroll.com
Amazon RSA 2048 M01
2022-11-08 -
2023-12-07
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-11-18 -
2023-12-19
a year crt.sh
misc.google.com
GTS CA 1C3
2023-07-10 -
2023-10-02
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
aws-st.fullcircleinsights.com
Amazon RSA 2048 M01
2023-05-30 -
2024-06-26
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2023-06-02 -
2023-12-02
6 months crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.google.com
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh
*.google.de
GTS CA 1C3
2023-07-17 -
2023-10-09
3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Frame ID: EB4E846D2BA27400D4259038BFFE1082
Requests: 119 HTTP requests in this frame

Frame: https://info.zscaler.com/index.php/form/XDFrame
Frame ID: 9F5B4E1051F85822662E35C434BF3C98
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=5gm3a7p&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&upid=27hmsyx&upv=1.1.0
Frame ID: 3DFF42C8D6E4796067380544335D795C
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 0251680EAAE612846D90AC13A83C18FC
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Statc Stealer | Zscaler ThreatLabz Blog

Page URL History Show full URLs

  1. http://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat HTTP 301
    https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

127
Requests

95 %
HTTPS

55 %
IPv6

31
Domains

45
Subdomains

42
IPs

5
Countries

3324 kB
Transfer

7530 kB
Size

36
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat HTTP 301
    https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 80
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 83
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1691761433309%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fstatc-stealer-decoding-elusive-malware-threat%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest=true&liSync=true&e_ipv6=AQKWvGLWOkba6wAAAYnk1t44d1I0Fbr2CFx1rH8WoaogaEWsQCyYiD4DviPIc2ZOjXffwEc

127 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request statc-stealer-decoding-elusive-malware-threat
www.zscaler.com/blogs/security-research/
Redirect Chain
  • http://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
  • https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
2 MB
1 MB
Document
General
Full URL
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7967afe13bb4cedec250ae638c4e27ca26a21ac0bc950cce6118130b20b6557d
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com app-abm.marketo.com; img-src 'self' https: data: blob: d2iiunr5ws5ch1.cloudfront.net fast.wistia.net; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net embed-cloudfront.wistia.com *.wistia.com; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com fast.wistia.net; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io *.hushly.com https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 fast.wistia.net
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
196
cache-control
public, max-age=300
cf-cache-status
DYNAMIC
cf-ray
7f50e8ef5db9bb86-FRA
content-encoding
br
content-language
en
content-security-policy
default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com app-abm.marketo.com; img-src 'self' https: data: blob: d2iiunr5ws5ch1.cloudfront.net fast.wistia.net; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net embed-cloudfront.wistia.com *.wistia.com; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com fast.wistia.net; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io *.hushly.com https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 fast.wistia.net
content-type
text/html; charset=UTF-8
date
Fri, 11 Aug 2023 13:43:50 GMT
expires
Fri, 11 Aug 2023 13:45:34 GMT
last-modified
Fri, 11 Aug 2023 13:34:01 GMT
server
cloudflare
strict-transport-security
max-age=31536000; preload
via
varnish
x-ah-environment
prod
x-cache
MISS
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM testmydefenses.com
x-geo-country
US
x-nf-request-id
01H7JDDMDDQSCSJPV6TBR6NDFW
x-request-id
v-bb45c89a-384b-11ee-9551-37b8682b5f10
x-ua-compatible
IE=edge
x-xss-protection
1

Redirect headers

CF-RAY
7f50e8ee79a24d91-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Fri, 11 Aug 2023 13:43:50 GMT
Expires
Fri, 11 Aug 2023 14:43:50 GMT
Location
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
OtAutoBlock.js
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
45 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/OtAutoBlock.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
27201
content-md5
1BoBNuQl7UMMaO7E490CGQ==
content-length
6406
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:15 GMT
server
cloudflare
etag
0x8DAE80BD5AAEF51
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
78b21313-c01e-00c3-79e1-5a51a5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f08df09b98-FRA
expires
Sat, 12 Aug 2023 13:43:51 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b97b49ee323dbccf9a13f15fa3d93188d01681652d52b1ed40ad00c32dfb0513
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
X1C0PY0lSDg1JSpsyFxfYA==
age
78153
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6837
x-ms-lease-status
unlocked
last-modified
Wed, 09 Aug 2023 06:37:54 GMT
server
cloudflare
etag
0x8DB98A3296B6A19
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
5c9da7cf-b01e-0077-07fa-caec17000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f08df19b98-FRA
google_tag.script.js
www.zscaler.com/sites/default/files/google_tag/zscaler_marketing/
347 B
408 B
Script
General
Full URL
https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing/google_tag.script.js?rz6uy4
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
3
x-nf-request-id
01H7JDDMN1PDAWAPXXWAWM0KHT
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
53
x-cache
MISS
x-ah-environment
prod
x-request-id
v-a8a83bac-37ae-11ee-bb5b-075a2f1ddb44
last-modified
Thu, 10 Aug 2023 18:49:27 GMT
server
cloudflare
content-type
application/javascript
cache-control
public, max-age=300
cf-ray
7f50e8f0ff94bb86-FRA
expires
Fri, 11 Aug 2023 13:48:29 GMT
css_bgXcuoCuBgmTPgyTwNfOBgg92gN4Xeqm5AoQmhNKzbI.css
www.zscaler.com/sites/default/files/css/
373 KB
32 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_bgXcuoCuBgmTPgyTwNfOBgg92gN4Xeqm5AoQmhNKzbI.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e05dcba80ae0609933e0c93c0d7ce06083dda03785deaa6e40a109a134acdb2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDMGSCDTW1Q9K5PR2MV13
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
197
x-cache
MISS
x-ah-environment
prod
x-request-id
v-a98c2656-3582-11ee-996d-8f29ae5d5a0c
last-modified
Wed, 12 Jul 2023 06:29:42 GMT
server
cloudflare
content-type
text/css
cache-control
public, max-age=300
cf-ray
7f50e8f00e8abb86-FRA
expires
Fri, 11 Aug 2023 13:45:34 GMT
css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
www.zscaler.com/sites/default/files/css/
499 KB
77 KB
Stylesheet
General
Full URL
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
221b2ab2dc209b559aa7ba48f5d22ed8ada589e5fcd180a3bc3c98ba35b4e632
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDMGH9PK3JH2R59NRHWYY
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
197
x-cache
HIT
x-ah-environment
prod
x-request-id
v-7ce099ea-3733-11ee-bf7c-3f73aa9daf8e
last-modified
Wed, 02 Aug 2023 06:14:33 GMT
server
cloudflare
content-type
text/css
cache-control
public, max-age=300
cf-ray
7f50e8f00e8cbb86-FRA
expires
Fri, 11 Aug 2023 13:45:34 GMT
3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/
5 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/3e894970-e3e9-4783-85e9-7c38eedbfbbf.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
12548
content-md5
StpE19/mctRp4PJx19Cb7Q==
content-length
1739
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:16 GMT
server
cloudflare
etag
0x8DAE80BD639ADC0
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
b2a92248-f01e-00cb-47e1-5a4ad6000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f17a2218f9-FRA
expires
Sat, 12 Aug 2023 13:43:51 GMT
search.svg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/
796 B
528 B
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/search.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd888ef4dda066839f9cb6d29aaf789463cccb55f245fd45d10983a618c77f72
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cf-resized
internal=ok/d q=0 n=536+0 c=0+0 v=2023.7.3 l=796
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
W/"cfy7moBMyALipuzaOAMY2HLyJJ1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive"
content-type
image/svg+xml
cache-control
public, max-age=300
cf-ray
7f50e8f18855bb86-FRA
support.svg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/
409 B
386 B
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/support.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3cafb353ffa959edb33bbc7b79625416ef1e7393f7784c6debef4c2f35a65e3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cf-resized
internal=ok/d q=0 n=28+0 c=0+0 v=2023.7.3 l=409
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
W/"cfP-dZjJk4NDGZQDqR0iQMhCUa1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive"
content-type
image/svg+xml
cache-control
public, max-age=300
cf-ray
7f50e8f18859bb86-FRA
chevron-down.svg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/
258 B
519 B
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/header/chevron-down.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52272481e0caa74b259f2d54324a5b00e547cc8d35fea3174cc3702f9cc8d516
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cf-resized
internal=ok/d q=0 n=42+0 c=0+0 v=2023.7.3 l=258
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
W/"cffNue2_WleoWt3sgAiUKLsXFi1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive"
content-type
image/svg+xml
cache-control
public, max-age=300
cf-ray
7f50e8f1885dbb86-FRA
gt-haptik-zs-regular-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
18 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-regular-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
736666a53a4a4805e200de224be9255704ff848fd84d60333b087d50d02490ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
9
x-nf-request-id
01H7JDDMR3Z93704S7M0AGCZXQ
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
245
x-cache
MISS
x-ah-environment
prod
content-length
18848
x-request-id
v-bc0cbc82-2664-11ee-86d4-af16c7cdfb6f
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f1986fbb86-FRA
expires
Fri, 11 Aug 2023 13:44:46 GMT
gt-haptik-zs-medium-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-medium-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd9535c4b369928aa5fe4ddebbe42a9f96bb590ba9a70176297599192b9cbab4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDMR7EE43JSA88VZY61KT
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
245
x-cache
HIT
x-ah-environment
prod
content-length
19504
x-request-id
v-9c11d97a-3718-11ee-bdfb-9f9ccc0d590f
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f19870bb86-FRA
expires
Fri, 11 Aug 2023 13:44:46 GMT
email-decode.min.js
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
866 B
Script
General
Full URL
https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
last-modified
Tue, 08 Aug 2023 14:42:33 GMT
server
cloudflare
content-encoding
gzip
etag
W/"64d25459-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
7f50e8f27974bb86-FRA
expires
Sun, 13 Aug 2023 13:43:51 GMT
js_gNZTZIkSbsSU4xGxTQt_hjD-nyOnfiY1yPAmRJLLw8c.js
www.zscaler.com/sites/default/files/js/
512 KB
159 KB
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_gNZTZIkSbsSU4xGxTQt_hjD-nyOnfiY1yPAmRJLLw8c.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
80d6536489126ec494e311b14d0b7f8630fe9f23a77e2635c8f0264492cbc3c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDMWZSEXMG49S77PZ697W
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
121
x-cache
HIT
x-ah-environment
prod
x-request-id
v-878ccc92-3080-11ee-bc11-8332d023700f
last-modified
Wed, 12 Jul 2023 06:04:52 GMT
server
cloudflare
content-type
text/javascript
cache-control
public, max-age=300
cf-ray
7f50e8f28983bb86-FRA
expires
Fri, 11 Aug 2023 13:46:50 GMT
forms2.min.js
info.zscaler.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
7134
etag
"3a089f-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7f50e8f31d582bae-FRA
expires
Fri, 11 Aug 2023 17:43:51 GMT
js_RSyG1wH8d5iarwmvfWZ4hbyq6qiUPONW63fYPWOvzuY.js
www.zscaler.com/sites/default/files/js/
813 B
713 B
Script
General
Full URL
https://www.zscaler.com/sites/default/files/js/js_RSyG1wH8d5iarwmvfWZ4hbyq6qiUPONW63fYPWOvzuY.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
452c86d701fc77989aaf09af7d667885bcaaeaa8943ce356eb77d83d63afcee6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
1
x-nf-request-id
01H7JDDMX3DXQ7GRG13CCRPY8T
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
147
x-cache
HIT
x-ah-environment
prod
x-request-id
v-a3ee750e-371d-11ee-a297-2f4006f25b72
last-modified
Wed, 12 Jul 2023 06:02:28 GMT
server
cloudflare
content-type
text/javascript
cache-control
public, max-age=300
cf-ray
7f50e8f28984bb86-FRA
expires
Fri, 11 Aug 2023 13:46:46 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
72 B
310 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bd5068ee3f41ad2ed4f003c13c4e939021c77f7a69ac82d25211c72868b520e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7f50e8f31b2fbbe6-FRA
access-control-allow-headers
Content-Type
blog-subscription-form-background%401x.jpeg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/
14 KB
14 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/page/blog/blog-subscription-form-background%401x.jpeg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c311211146b7d1e26f7807e2131bd1c0787e54cc6dd90b9dd111fd2b4a1c7d77
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
14066
cf-resized
internal=ok/d q=0 n=246+100 c=0+0 v=2023.7.3 l=14066
last-modified
Fri, 09 Dec 2022 14:12:58 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cftz37uaFigiYaqZiowwIKFZQi1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive", cf-images 299 "image too large for AVIF"
content-type
image/webp
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f2a99ebb86-FRA
gt-haptik-zs-bold-webfont.woff2
www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/
19 KB
19 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/fonts/gthaptic/gt-haptik-zs-bold-webfont.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f641642f73b0d4a76b30723c0dec94325eafbc39620de7e3fc6283e1550829e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDMXX07PNVCPNJYFQJVRQ
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
147
x-cache
HIT
x-ah-environment
prod
content-length
19652
x-request-id
v-52286c3c-2b53-11ee-8d51-fb57d22b1541
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f2a9a5bb86-FRA
expires
Fri, 11 Aug 2023 13:46:46 GMT
fa-brands-400.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
74 KB
74 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-brands-400.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec2e22fd918a8ffef0f54f466fb7edd2c586f39dad794cd25a0a97ce36c404d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
3
x-nf-request-id
01H7JDDMXMBR6NKDF120QBNQSF
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
245
x-cache
HIT
x-ah-environment
prod
content-length
76008
x-request-id
v-2550241a-36f3-11ee-99f3-c320573950fb
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f2a9a7bb86-FRA
expires
Fri, 11 Aug 2023 13:44:46 GMT
fa-solid-900.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
134 KB
135 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-solid-900.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
68eb827a2fa6f035eab41392f863522ae5dc0d4c0c31d5245362a7f1a5aed46a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
3
x-nf-request-id
01H7JDDMXM0AZBAD1YYHMBPPD4
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
196
x-cache
HIT
x-ah-environment
prod
content-length
137704
x-request-id
v-28d14e32-37b8-11ee-a6a4-433e1f0a01ee
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f2a9a9bb86-FRA
expires
Fri, 11 Aug 2023 13:45:35 GMT
fa-light-300.woff2
www.zscaler.com/themes/custom/zscaler/build/webfonts/
181 KB
181 KB
Font
General
Full URL
https://www.zscaler.com/themes/custom/zscaler/build/webfonts/fa-light-300.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2dc0e215dc2374fc5cdacf24707fabeabc2e4193e12ec9c0203ac9a52a5daf3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Origin
https://www.zscaler.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
3
x-nf-request-id
01H7JDDMYWDGBN3E2YF6A3K7K3
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
age
146
x-cache
HIT
x-ah-environment
prod
content-length
185360
x-request-id
v-c78058cc-3720-11ee-8077-fbf2874a6f6d
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
server
cloudflare
content-type
font/woff2
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f2ea00bb86-FRA
expires
Fri, 11 Aug 2023 13:46:46 GMT
fail-over.js
www.zscaler.com/
0
2 KB
XHR
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_gNZTZIkSbsSU4xGxTQt_hjD-nyOnfiY1yPAmRJLLw8c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src 'self' fast.wistia.com https: data: blob:; script-src 'self' https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net *.mountain.com trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com; connect-src 'self' blob: https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com;
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-nf-request-id
01H7JDDN0W8A1XYAW3JMPN295R
date
Fri, 11 Aug 2023 13:43:51 GMT
content-security-policy
default-src 'none'; img-src 'self' fast.wistia.com https: data: blob:; script-src 'self' https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net *.mountain.com trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com; connect-src 'self' blob: https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload
cf-cache-status
DYNAMIC
age
76242
content-length
0
x-xss-protection
1; mode=block
server
cloudflare
etag
"51b043bac3337957be83d6187f5365eb-ssl"
vary
X-Bb-Conditions
x-frame-options
SAMEORIGIN https://cms.zscaler.com
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
cf-ray
7f50e8f35a65bb86-FRA
fail-over.js
www.zscaler.com/
0
100 B
Script
General
Full URL
https://www.zscaler.com/fail-over.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_gNZTZIkSbsSU4xGxTQt_hjD-nyOnfiY1yPAmRJLLw8c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'none'; img-src 'self' fast.wistia.com https: data: blob:; script-src 'self' https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net *.mountain.com trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com; connect-src 'self' blob: https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com;
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN https://cms.zscaler.com
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-nf-request-id
01H7JDDN2H5023KY1WV3643NM3
date
Fri, 11 Aug 2023 13:43:51 GMT
content-security-policy
default-src 'none'; img-src 'self' fast.wistia.com https: data: blob:; script-src 'self' https://netlify-rum.netlify.app j.6sc.co *.adroll.com snap.licdn.com cdn.bizible.com cdn.pdst.fm connect.facebook.net *.mountain.com trk.techtarget.com t.sf14g.com *.marketo.net js.adsrvr.org *.crazyegg.com https://cdnjs.cloudflare.com https://*.cloudfront.net https://googleads.g.doubleclick.net https://cdn.cookielaw.org https://sidebar.bugherd.com http://info.zscaler.com 'unsafe-eval' 'unsafe-inline' bat.bing.com https://widget.usersnap.com/ http://fast.wistia.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ https://resources.usersnap.com/ https://www.googletagmanager.com/gtag/ http://pipedream.wistia.com/ https://www.google-analytics.com/ https://cdn.acsbapp.com https://acsbapp.com https://www.googletagmanager.com js.driftt.com js.adsrvr.org assets.adobedtm.com bugcrowd.com *.bugcrowdusercontent.com *.googleadservices.com https://twin-iq.kickfire.com https://www.rumiview.com *.linkedin.oribi.io gateway.zscalertwo.net *.jquery.com www.youtube.com; font-src 'self' data: https://fonts.gstatic.com http://fonts.gstatic.com https://fast.wistia.com/assets https://acsbapp.com; style-src 'self' 'unsafe-inline' http://info.zscaler.com http://fonts.googleapis.com https://www.googletagmanager.com; connect-src 'self' blob: https://ingesteer.services-prod.nsvcs.net fast.wistia.com https://google.com https://www.google.com www.google.co.in secure.adnxs.com cdn.linkedin.oribi.io *.cloudfunctions.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 ibc-flow.techtarget.com *.mktoresp.com bat.bing.com *.crazyegg.com *.6sc.co st.fullcircleinsights.com https://*.google-analytics.com https://region1.analytics.google.com https://cdn.cookielaw.org https://geolocation.onetrust.com https://cms.zscaler.com https://www.zscaler.com https://sockjs.pusher.com wss://ws-mt1.pusher.com https://sessions.bugsnag.com https://*.acsbapp.com https://*.wistia.com https://*.litix.io https://embedwistia-a.akamaihd.net http://pipedream.wistia.com/ https://www.google-analytics.com/ https://analytics.google.com https://stats.g.doubleclick.net https://ba5832d1af5a45e6ad89599ab3f2054d.us-central1.gcp.cloud.es.io https://www.googletagmanager.com *.6sense.com *.linkedin.oribi.io https://adservice.google.com http://embed.wistia.com; media-src https://cms.zscaler.com https://fast.wistia.com/embed/ https://fast.wistia.com/assets/ blob: https://embedwistia-a.akamaihd.net https://embed-cloudfront.wistia.com js.driftt.com https://embed-fastly.wistia.com https://embed-ssl.wistia.com; worker-src 'self' blob: ; frame-src 'self' insight.adsrvr.org www.facebook.com staging.visualize-roi.com https://*.doubleclick.net https://bugcrowd.com https://fast.wistia.com https://fast.wistia.net http://info.zscaler.com https://sidebar.bugherd.com js.driftt.com insight.adsrvr.org match.adsrvr.org www.youtube.com;
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload
cf-cache-status
DYNAMIC
age
76243
content-length
0
x-xss-protection
1; mode=block
server
cloudflare
etag
"51b043bac3337957be83d6187f5365eb-ssl"
vary
X-Bb-Conditions
x-frame-options
SAMEORIGIN https://cms.zscaler.com
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
cf-ray
7f50e8f3aac9bb86-FRA
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.39.0/
372 KB
89 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Zp/CcrZmK7hQ2S6c/t9Tpw==
age
34352
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
90454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:04 GMT
server
cloudflare
etag
0x8DA87805EB35DE2
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
526a626c-301e-007c-66e1-5a45d3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f3d9d59b98-FRA
zscaler-logo.svg
www.zscaler.com/sites/default/files/images/page/m7header/
2 KB
2 KB
Image
General
Full URL
https://www.zscaler.com/sites/default/files/images/page/m7header/zscaler-logo.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-cache-hits
2
x-nf-request-id
01H7JDDN40S2PNHR0TSSGKH8BY
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
DYNAMIC
content-encoding
br
x-content-type-options
nosniff
age
196
x-cache
HIT
x-ah-environment
prod
x-request-id
v-3b81069a-2f6f-11ee-8d9a-d7d8e895ea1c
last-modified
Wed, 29 Mar 2023 13:53:42 GMT
server
cloudflare
content-type
image/svg+xml
cache-control
public, max-age=300
cf-ray
7f50e8f3daf6bb86-FRA
expires
Fri, 11 Aug 2023 13:45:35 GMT
shutterstock_329313614.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----custom-images/
42 KB
43 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/images/blogs/----custom-images/shutterstock_329313614.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be56e8099617d98bf0baca0cf02681faf7190434dcb5eac3d6a938f08fac2444
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
43356
cf-resized
internal=ok/d q=0 n=513+412 c=0+0 v=2023.7.3 l=43356
last-modified
Fri, 04 Sep 2020 22:17:50 GMT
cf-bgj
imgq:86,h2pri
server
cloudflare
etag
"cfN5Jq5yQbgbYW9lNtNSfSYKQw1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive", cf-images 299 "image too large for AVIF"
content-type
image/webp
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f3eaf7bb86-FRA
gtm.js
www.googletagmanager.com/
452 KB
120 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/google_tag/zscaler_marketing/google_tag.script.js?rz6uy4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4f9d5ec6f2bd4518b2290c4ba38427c09fe1d3d733654680da7ee72df05bd3ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
122398
x-xss-protection
0
last-modified
Fri, 11 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 11 Aug 2023 13:43:51 GMT
zscaler-blog-category-hero-background-gradient-blue-2x.jpg
www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/
126 KB
126 KB
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format%3Dauto/sites/default/files/blog-hero/zscaler-blog-category-hero-background-gradient-blue-2x.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2b66668bbb8fae36b12842672cbeeedc9e7c16562d3c592a6613b6f44aed1b1
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
content-length
128708
cf-resized
internal=ok/d q=0 n=217+222 c=0+0 v=2023.7.3 l=128708
last-modified
Tue, 09 May 2023 14:59:58 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
"cfhbxO8X4tnrT2okRVhjqRLd_o1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive", cf-images 299 "image too large for AVIF", cf-images 299 "original is 45589B smaller"
content-type
image/jpeg
cache-control
public, max-age=300
accept-ranges
bytes
cf-ray
7f50e8f45b5fbb86-FRA
priority
u=1;i=?0,cf-chb=(257;u=4;i=?0 28205;u=5;i=?0 63104;u=6;i=?0)
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=1944&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&callback=jQuery112405791916411437934_1691761431654&_=1691761431655
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
abf7c1c5621ec0eb8743468b6d9c02cf9e9ee9847ac733273c9593b2990fb191

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7f50e8f45f912bae-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
getForm
info.zscaler.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://info.zscaler.com/index.php/form/getForm?munchkinId=306-ZEJ-256&form=7140&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&callback=jQuery112405791916411437934_1691761431656&_=1691761431657
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
13304f18d81d93df080e863a92efc97fece468560d09e370c090700e84b591ac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7f50e8f46f922bae-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
en.json
cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/
76 KB
15 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/3e894970-e3e9-4783-85e9-7c38eedbfbbf/57d0b2fd-5e95-4e1b-923d-cff7f0c71c9e/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
12040
content-md5
a+O//X2h08gSfqxZ78vXYQ==
content-length
15164
x-ms-lease-status
unlocked
last-modified
Tue, 27 Dec 2022 13:11:17 GMT
server
cloudflare
etag
0x8DAE80BD6BFBADE
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
5301dbcb-c01e-00e1-19d0-5e3f93000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f4ae3d18f9-FRA
expires
Sat, 12 Aug 2023 13:43:51 GMT
forms2.css
info.zscaler.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
6562
etag
"460919-3437-60062cdee3780"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7f50e8f4e81b2bae-FRA
content-length
2623
expires
Fri, 11 Aug 2023 17:43:51 GMT
forms2-theme-round.css
info.zscaler.com/js/forms2/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://info.zscaler.com/js/forms2/css/forms2-theme-round.css
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
5014
etag
"460918-e46-60062cdee3780"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7f50e8f4e8202bae-FRA
content-length
968
expires
Fri, 11 Aug 2023 17:43:51 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Xx897lTVYGjMQiwuGCrzDA==
age
4084
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3007
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:55 GMT
server
cloudflare
etag
0x8DA87805972EF22
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
787e6ad9-401e-0138-04e1-5adfea000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f55f2e18f9-FRA
otCookieSettingsButton.json
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
5 KB
2 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCookieSettingsButton.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
ssl6Phwu9+sah2W05EtyUQ==
age
26519
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1767
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:30:57 GMT
server
cloudflare
etag
0x8DA87805A8DD1F0
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
95db905d-901e-0094-2de3-5ab828000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7f50e8f55f3018f9-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.39.0/assets/
22 KB
5 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
B55i3ZY9miZIaUrwjufy0w==
age
10470
x-ms-lease-status
unlocked
last-modified
Fri, 26 Aug 2022 16:31:09 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
7e19b9f3-801e-0003-59e1-5adbe1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7f50e8f55f3218f9-FRA
form-button-arrow.svg
www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/
704 B
510 B
Image
General
Full URL
https://www.zscaler.com/cdn-cgi/image/format=auto/themes/custom/zscaler/images/footer/form-button-arrow.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d4a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d25984848cb59b62095fd6cb563ef08f012a501258c06fd7e64d263a785e1c88
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/sites/default/files/css/css_Ihsqstwgm1Wap7pI9dIu2K2lieX80YCjvDyYujW05jI.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:51 GMT
strict-transport-security
max-age=31536000; preload
via
varnish
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'
cf-resized
internal=ok/d q=0 n=602+0 c=0+0 v=2023.7.3 l=704
last-modified
Wed, 19 Jul 2023 08:22:20 GMT
cf-bgj
imgq:0,h2pri
server
cloudflare
etag
W/"cfDDzwzbiwy4uUZkpDyQAkTPSc1gWqs-rDoNB_ezzVDw"
vary
Accept, Accept-Encoding
warning
cf-images 299 "cache-control is too restrictive"
content-type
image/svg+xml
cache-control
public, max-age=300
cf-ray
7f50e8f58c7abb86-FRA
XDFrame
info.zscaler.com/index.php/form/ Frame 9F5B
2 KB
898 B
Document
General
Full URL
https://info.zscaler.com/index.php/form/XDFrame
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7f50e8f5d9952bae-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 11 Aug 2023 13:43:52 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/?random=1691761432025&cv=11&fst=1691761432025&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&hn=www.googleadservices.com&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&auid=1589828845.1691761432&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e75bb828a464f4b8987fddd4ba8cd008c54f248ebbd941f82a4d47be95960bf6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1360
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 11 Aug 2023 11:44:23 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
7169
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 11 Aug 2023 13:44:23 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1691761432038&cv=11&fst=1691761432038&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&hn=www.googleadservices.com&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&auid=1589828845.1691761432&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b81a8f58e7f0d88215001e9ebdb7ce06797849119c2e851a02d226b1c96a692d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1357
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
279 KB
91 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7eaab25edc8c9c784d6a7591022fc5babfb21a0cd151446f4aa08fa6a4fd9efd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:52 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
93408
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 11 Aug 2023 13:43:52 GMT
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/svg+xml
forms2.min.js
info.zscaler.com/js/forms2/js/ Frame 9F5B
208 KB
69 KB
Script
General
Full URL
https://info.zscaler.com/js/forms2/js/forms2.min.js
Requested by
Host: info.zscaler.com
URL: https://info.zscaler.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://info.zscaler.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
7135
etag
"3a089f-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7f50e8f8ed572bae-FRA
expires
Fri, 11 Aug 2023 17:43:52 GMT
collect
www.google-analytics.com/j/
3 B
208 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1057947138&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&ul=en-us&de=UTF-8&dt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiEABBAAAACAAI~&jid=2092545377&gjid=1256403236&cid=1257529249.1691761432&tid=UA-6177009-1&_gid=1960830698.1691761432&_slc=1&gtm=45He3890n715SLZFK&z=750344722
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
349 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=2092545377&gjid=1256403236&_gid=1960830698.1691761432&_u=YGBAiEABBAAAAGAAI~&z=1331539185
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 11 Aug 2023 13:43:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
245 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3890&_p=1057947138&_gaz=1&cid=1257529249.1691761432&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1691761432&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&dt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&en=page_view&_fv=1&_ss=1&ep.allowLinker=true&ep.cookieDomain=auto&ep.content_group=Blogs&ep.blog_parent_category=Security%20Research&ep.blog_child_category=Threatlabz%20Research
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
56 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-10SPJ4YJL9&cid=1257529249.1691761432&gtm=45je3890&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-10SPJ4YJL9&cid=1257529249.1691761432&gtm=45je3890&aip=1&z=1197972082
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/812494211/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1691761432038&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&fmt=3&is_vtc=1&random=14595046&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
455 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1691761432038&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&fmt=3&is_vtc=1&random=14595046&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/973777747/
42 B
108 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/973777747/?random=1691761432025&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&fmt=3&is_vtc=1&random=4294809625&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/973777747/
42 B
108 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/973777747/?random=1691761432025&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45He3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&fmt=3&is_vtc=1&random=4294809625&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=2092545377&_u=YGBAiEABBAAAAGAAI~&z=937375588
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=2092545377&_u=YGBAiEABBAAAAGAAI~&z=937375588
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:52 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async-api.e9f77430-1.237.1.min.js
js-agent.newrelic.com/
3 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/async-api.e9f77430-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
370a9e517ef0694db38a18b53a46711e1461912f0074f024db5373ff946fc894
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
Nnzi3DxfGlFxxxaHTHoVoaEtXaaSwSj1
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGM44G2H3T95M0RG
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1384
x-amz-id-2
pYMoGKzxpzTDzhmdjTgFG5JFai/unv5XW+Eo4tyfxeb6QhVr+NUuCnGsSPtGwjMZeEidI8tMaCw=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1691761433.222479,VS0,VE0
etag
"193a6d6f02af9cfb9888de413246e90b"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4661
860.95a91211-1.237.1.min.js
js-agent.newrelic.com/
14 KB
5 KB
Script
General
Full URL
https://js-agent.newrelic.com/860.95a91211-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0aee72df00de1dcfe4d631dd2a72979cee0e756ef7e243b2799856582c44557
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
EoQgbqtiNktUFHe2XcVVByjJaUw3xjmB
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGME0EFST6A5NB5B
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5422
x-amz-id-2
Th5W14ONfFa1hPkjGXdAwsnAcmTWbhXtOnkYTgyxzqjdHoN5/7oAlCp3nkLVz675UvH0slqFSN0=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1691761433.222453,VS0,VE0
etag
"b550851fb79f7d61442ca34a6120ac44"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4712
session-manager.d080e4cc-1.237.1.min.js
js-agent.newrelic.com/
1 KB
913 B
Script
General
Full URL
https://js-agent.newrelic.com/session-manager.d080e4cc-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
oaOpBoY_R0Emmn1D4qOBGa8Bli_CwZsc
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGM1T0AT17NVAZ13
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
686
x-amz-id-2
O6L3Ip1/4vY5L1/soaX8sXkNC/gXPkvDfaja4IcpjlxbDAWhaXoBV8SjiDx7hZYgttdDgTYrt4U=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1691761433.222158,VS0,VE0
etag
"a097cb2068fb2d63e521cacf139c921d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4230
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1057947138&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&ul=en-us&de=UTF-8&dt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Engagement&ea=10%25&el=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&_u=aGDACEABBAAAAGAAI~&jid=1545427309&gjid=1566976651&cid=1257529249.1691761432&tid=UA-6177009-1&_gid=1960830698.1691761432&_r=1&gtm=45He3890n715SLZFK&z=442208889
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
6934ae2b-4c76-4229-97d0-8f637b004b88.js
j.6sc.co/j/
4 KB
4 KB
Script
General
Full URL
https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
uLuCr1hhLpJjZt0sFSB89FSJa4YqIrE7
date
Fri, 11 Aug 2023 13:43:53 GMT
x-amz-cf-pop
FRA2-C2
x-amz-server-side-encryption
AES256
x-amz-meta-content-type
application/json
content-length
3771
pragma
no-cache
last-modified
Tue, 02 May 2023 17:36:47 GMT
server
AmazonS3
etag
"afb8c61166e7f50fe6d7ab7b6377733c"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
JBE95G40HAee0nRexA-Qs2uQqNfGCDIHAE9_IV6NnNJ0PnNfRmltGw==
expires
Fri, 11 Aug 2023 13:43:53 GMT
roundtrip.js
s.adroll.com/j/
75 KB
24 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e7ad47a4bc6ddbb17cb8cbe6167dae4717d0b5962a1d63de2e93e6dc201b9e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

X-Amz-Version-Id
2W0nFhLgp3U9gUvvEzXT9GuNEpd6A6yg
Content-Encoding
gzip
Via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
Date
Fri, 11 Aug 2023 12:31:44 GMT
Age
4448
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Thu, 03 Aug 2023 19:17:31 GMT
Server
AmazonS3
Etag
W/"67e54a60303cfbf4c3b977aa390ad408"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
bHfnp3Mlecwz8vK2x7sY5EbfLk5NTKTjRaakd7RmQc4RvyfuK253ew==
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a40a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 24 Jul 2023 09:07:54 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=26156
accept-ranges
bytes
content-length
4862
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Fri, 11 Aug 2023 13:43:53 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C8D9107F56F446F4BC885189A3552848 Ref B: FRA31EDGE0605 Ref C: 2023-08-11T13:43:53Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
bizible.js
cdn.bizible.com/scripts/
67 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (via/F333) /
Resource Hash
d132dd3ebfcfaf838e709f20f4c76fe2868ffa0dc22ee126f87af6dd0b4a7adb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
gzip
last-modified
Wed, 09 Aug 2023 23:28:33 GMT
server
ECS (via/F333)
age
26222
etag
"4d757c3619cbd91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
25480
fbevents.js
connect.facebook.net/en_US/
172 KB
47 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 11 Aug 2023 13:43:53 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
47151
x-xss-protection
0
pragma
public
x-fb-debug
nQU34fZyeNT8Q4Y+53YnNTEPzTNul5pZrXFgkIcAmX6dDB27HIl4sBHHSlL4uvOXQHqG0SR1LOYQIkjr4yvaOg==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
73889
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1200
cf-ray
7f50e8fdbdfb03f8-FRA
expires
Fri, 11 Aug 2023 14:03:53 GMT
spx
dx.mountain.com/
20 KB
6 KB
Script
General
Full URL
https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=21718526323252640term=value
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.7.151.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-7-151-245.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
297f95779a7ddf48032664221491a3228529dfbe09233c945a12234d63470527

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
gzip
server
istio-envoy
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
x-envoy-upstream-service-time
2
be
spx-burnin
expires
Thu, 01 Jan 1970 00:00:00 GMT
fullcircle.js
d2i34c80a0ftze.cloudfront.net/
32 KB
11 KB
Script
General
Full URL
https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=731c316a-c46e-4a94-81a9-7cfc0ea0d53e&domain=zscaler.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2176:e400:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
aa2b8282a1438a0e53971aa29a5c54f2911a3cb79b44cc20f8521ead150c458f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 01:38:28 GMT
via
1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront), 1.1 521484bc87dc7b3d509c41618270e818.cloudfront.net (CloudFront)
content-encoding
gzip
x-amz-cf-pop
FRA56-C1, MXP64-C3
age
43524
x-amzn-requestid
be801ded-3a22-40f9-aca2-288aee3e4fd2
x-amzn-trace-id
Root=1-64d59114-27329f007ecdb5fc68e027f8;Sampled=0;lineage=be50798f:0
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amz-apigw-id
JeObSGckPHcFfeg=
x-amz-cf-id
Vli2zY1gsUtHawHjxFoLzLK-vDrYMvP3lA6qnLACmiQAI67i6sof3g==
ping.min.js
cdn.pdst.fm/
26 KB
6 KB
Script
General
Full URL
https://cdn.pdst.fm/ping.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
80.142.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:04:46 GMT
content-encoding
gzip
age
2347
x-guploader-uploadid
ADPycds7XnnYHIh2P-1AdtPgWIkF8ubBlfdKlyVN9wPROYQ2J1Ixvq7gTWYzuozCfGPcVgn468a7piukfZ6It000Ly0Me7FYf_zf
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5774
last-modified
Fri, 28 May 2021 20:34:03 GMT
server
UploadServer
etag
"d001d1c9f5a942fa5524eeacb047e819"
vary
Accept-Encoding
x-goog-generation
1622234043862937
x-goog-hash
crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
5774
accept-ranges
bytes
content-type
application/javascript;
expires
Fri, 11 Aug 2023 14:04:46 GMT
js
www.googletagmanager.com/gtag/
237 KB
79 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-812494211
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8124a04347a296f12b1b2f288f064f11aa7cda722ac2d0b50252fabba7649a9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
81136
x-xss-protection
0
last-modified
Fri, 11 Aug 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 11 Aug 2023 13:43:53 GMT
up_loader.1.1.0.js
js.adsrvr.org/
5 KB
3 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-15-119.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Fri, 11 Aug 2023 06:16:41 GMT
Content-Encoding
gzip
Via
1.1 4dd80d99fd5d0f6baaaf5179cd921f72.cloudfront.net (CloudFront)
Last-Modified
Tue, 01 Aug 2023 20:10:44 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-P7
Age
26832
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
Dwdd8Fd9AGw4uHBrNHQGNu8WHacnhZ_b0fglb_9dFlLA0Jr5aaSgMg==
sf14g.js
t.sf14g.com/
0
0
Script
General
Full URL
https://t.sf14g.com/sf14g.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.46.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-145-46-195.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

munchkin.js
munchkin.marketo.net/
1 KB
2 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Fri, 11 Aug 2023 13:43:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
collect
stats.g.doubleclick.net/j/
4 B
70 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=1545427309&gjid=1566976651&_gid=1960830698.1691761432&_u=aGDACEABBAAAAGAAI~&z=1063483772
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 11 Aug 2023 13:43:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=1545427309&_u=aGDACEABBAAAAGAAI~&z=538950788
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-6177009-1&cid=1257529249.1691761432&jid=1545427309&_u=aGDACEABBAAAAGAAI~&z=538950788
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
lazy-feature-loader.c1052c27-1.237.1.min.js
js-agent.newrelic.com/
1 KB
867 B
Script
General
Full URL
https://js-agent.newrelic.com/lazy-feature-loader.c1052c27-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8f51d7bb4a7314fbd42bd5a2cec23adcfd23441c6539c3437cac22bc10c285a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
4gplzRtxWsISTBSfvxcHM2iQ7IWskafp
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
FGMFHKA8BCZDAHJD
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
422
x-amz-id-2
b1C6Hx7FixjbCwFIc+5ICMs9iLzGLUJtTJaIbhcfAT1kfqQ6k4sioRXp5G7/iX9xorqroX6uKSI=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1691761433.314112,VS0,VE0
etag
"e2a4dffecb3f725ca685cfc37cc223f8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3990
gif.gif
ibc-flow.techtarget.com/a/
43 B
470 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1691761433295&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
2334982
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
via
1.1 google
x-guploader-uploadid
ADPycdtMRWzH5kxQ9Xuhfh97r7m6r0BuZJyYrG8QnBkcIa1q4Dfs4kfP3leEJrT3SiOc77R6T3Kc-j8o8nFZj7OxYcOlzNGFFfwJ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Fri, 11 Aug 2023 14:43:53 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=2334982&r=1691761433295&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 11 Aug 2023 13:43:53 GMT
expires
Fri, 11 Aug 2023 13:43:53 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ADPycduKSK62wvt_GGTmymk20VmUE3v0RGvJ7vWA4VSyTOHhP7syMHM4-czvWnICFmSGtzajRjacNc1FY-swf75J4Xo72bPjF0ib
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ULSJHTPGTZGY3EPPZSKHKS/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
786 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

X-Amz-Version-Id
e6mCeG7.PAM9gYrIJBIXJohubS3UVCEK
Date
Thu, 10 Aug 2023 05:42:18 GMT
Via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
Age
115296
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 03 Aug 2023 18:30:18 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Wj19VDXtqLb4hBOOdlItQpjN1S4-1qrM_3EPywicrbOXvq2hN0tF4Q==

Redirect headers

Date
Thu, 10 Aug 2023 14:54:23 GMT
Via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
Age
82169
X-Amz-Cf-Pop
FRA60-P4
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
tefion2VRlKXpJwfT3CCI8ZdQkJE2Uk3vY577cVUAu69iL2AccD08Q==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
757 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date
Thu, 10 Aug 2023 04:41:30 GMT
Via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
Age
118944
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
ge5ptNnrqAz-DS8meX3YCaamtfq_V_cGPtquneKje0Fll5akn_Ojuw==

Redirect headers

Date
Thu, 10 Aug 2023 14:54:24 GMT
Via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
Age
82169
X-Amz-Cf-Pop
FRA60-P4
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
iKYyg8PWdh1SjlOEzpjwW3TaDAlLDQ40dC8K4N7Sz0PBxxVxWtwvGg==
index.js
s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/
0
809 B
Script
General
Full URL
https://s.adroll.com/j/pre/ULSJHTPGTZGY3EPPZSKHKS/22OEOVE2YNFA3EKSRERISY/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

X-Amz-Version-Id
lV19nW2p0ciDCZ4yDrMhwLtKnfL7Er01
Date
Fri, 11 Aug 2023 13:16:17 GMT
Via
1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
Age
2112
X-Amz-Cf-Pop
FRA60-P4
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Thu, 10 Aug 2023 11:31:27 GMT
Server
AmazonS3
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Max-Age
600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
UTE36qLbKIcSwrPrj-vY27DBfwnxP-dnv08xWQecyJf7OhxXQd_-JQ==
token
cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/
38 B
378 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/33962/domain/zscaler.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2248:3000:2:53b2:240:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:30:20 GMT
content-encoding
gzip
via
1.1 cbb1b4dc70fc5f87e7b215dd4f3252e0.cloudfront.net (CloudFront)
x-amz-cf-pop
MXP63-P3
age
813
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
SVEQwcr3tHgyZq6lG1Iu8AoDpChlAFaYQG3d5GdMfyou2_WxdMk1Ug==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26time%3D1691761433309%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblog...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTes...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest=true&liSync=true&e_ipv6=AQKWvGLWOkba6wAAAYnk1t44d1I0Fbr2CFx1rH8WoaogaEWsQCyYiD4DviPIc2ZOjXffwEc
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: C1220E35C5C4409B93A333C714EF50DF Ref B: FRAEDGE1308 Ref C: 2023-08-11T13:43:54Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYCpedXbSjuMcnxHUMDDg==

Redirect headers

date
Fri, 11 Aug 2023 13:43:53 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 0B8AA3E78D364ABD9EB17DEEB005E1F6 Ref B: DUS30EDGE0313 Ref C: 2023-08-11T13:43:54Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&time=1691761433309&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cookiesTest=true&liSync=true&e_ipv6=AQKWvGLWOkba6wAAAYnk1t44d1I0Fbr2CFx1rH8WoaogaEWsQCyYiD4DviPIc2ZOjXffwEc
x-li-proto
http/2
content-length
0
x-li-uuid
AAYCpedT7S3104NSRzcrUA==
26354555.js
bat.bing.com/p/action/
0
117 B
Script
General
Full URL
https://bat.bing.com/p/action/26354555.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Fri, 11 Aug 2023 13:43:53 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5122E65238214225BE9C2E5EC8F3CF8F Ref B: FRA31EDGE0605 Ref C: 2023-08-11T13:43:53Z
x-cache
CONFIG_NOCACHE
1778897272132032
connect.facebook.net/signals/config/
386 KB
110 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1778897272132032?v=2.9.121&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f7dc1e7e6ef516bfc31ba5c7a9c4125ccd63e8008f1e2691e3d7a115adbaa554
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 11 Aug 2023 13:43:53 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
112213
x-xss-protection
0
pragma
public
x-fb-debug
42HiaS9ow+2T56EItTTwG3dW8PWTiNcWAAPuwaw4h3AeTJOEVa7/x3LDjknVAFzHcvJmWrsWWKAn6pQpju4zww==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
646.9e7a6b8d-1.237.1.min.js
js-agent.newrelic.com/
8 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/646.9e7a6b8d-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de72c7056110de6c12aefd6fedb26a0e323d4cfab62d84c64db52e168af372e5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
J93EXw1eqMtGdXxiO91RJ8N7Vb2Flihy
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VJ869YA1CC3394
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3460
x-amz-id-2
7fIhRwbqln0AFC4AK5A665eA4jDD4mVUfLc87VlErCNtrPMQrbVJjBEkcCgJ8km/2QVNwyxyw+E=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:07 GMT
server
AmazonS3
x-timer
S1691761433.383081,VS0,VE0
etag
"ec83dba32689d4a796844e10a31121ff"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3411
page_view_event-aggregate.4988d952-1.237.1.min.js
js-agent.newrelic.com/
11 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.4988d952-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7662a5a8640648c39b824f101e232d34b73499503492d05394988f00ab79f1b4
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
97KO3uF7bK0xbSFbyTLOB.IfHKJDnJRG
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VRE94K7XRRMEKF
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4294
x-amz-id-2
Yz1zUSno2wNxfKe4XnAb95sfluvgftG6IT0ySvYWfSXH/AG7aUpLcOpFzZakSBkiNwYvHyaC5gk=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1691761433.382744,VS0,VE0
etag
"82daa027f82e87cd1c2fdffd51598981"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3987
page_view_timing-aggregate.7b2a53ee-1.237.1.min.js
js-agent.newrelic.com/
15 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.7b2a53ee-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a1c8bf8b428570336332bf63dd4efaf9e41b95dd4d83e324592d87d3042f747e
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
9V3_HBwcuGR4s0SRIPY4jJi2AWvILXpO
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VYTC65XAS3WA5V
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5638
x-amz-id-2
2WR1q1UWLCH5CBEXlilo1jPYP4cR1ZF8dL5IU8GOnsi9ZlRtZC6OgyISGCycUyId7zIRsJp8hpc=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1691761433.382659,VS0,VE0
etag
"be733f239fd67b0efd24d572dfe8263c"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4001
metrics-aggregate.b86cefcf-1.237.1.min.js
js-agent.newrelic.com/
9 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/metrics-aggregate.b86cefcf-1.237.1.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
141c410edab90686e098d4a827e8b79d8c8e295694508ddb4e3003f955127b65
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-amz-version-id
dqbxt2r61x_OSAHoWthSPNHI9j_y3Vhk
content-encoding
br
via
1.1 varnish
date
Fri, 11 Aug 2023 13:43:53 GMT
strict-transport-security
max-age=300
x-amz-request-id
M1VZ3551HKA05NVV
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3060
x-amz-id-2
mwGokb8xilNe2NDwDN/oGsjr0G6h0rybiuYfofj8129iB+pgsDGxKsFVv3svieqzkZFXUjpUfk4=
x-served-by
cache-fra-eddf8230087-FRA
last-modified
Wed, 02 Aug 2023 19:59:08 GMT
server
AmazonS3
x-timer
S1691761433.383782,VS0,VE0
etag
"41c470a0065b8af87ec8b24a5a1862ca"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3983
ULSJHTPGTZGY3EPPZSKHKS
d.adroll.com/consent/check/
474 B
567 B
Script
General
Full URL
https://d.adroll.com/consent/check/ULSJHTPGTZGY3EPPZSKHKS?pv=87505276112.14516&arrfrr=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&_s=638a57c247608d9d7196020115912c5a&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe05:e058:1984:7346:6b74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
c741c889cc259649f22be99dc5c3d1482490b124841e7f568d2095358f38e1e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
server
nginx/1.22.1
content-length
474
content-type
application/javascript
NRJS-686f86ac307898cabed
bam.nr-data.net/1/
40 B
405 B
XHR
General
Full URL
https://bam.nr-data.net/1/NRJS-686f86ac307898cabed?a=1353557264&v=1.237.1&to=YlxUMEJRWEFTVBALDlsWdwdEWVlcHXMWFxFUVWoKX1RTbnFYChYTWlVaAUJseF1WUjILBEJ6WQpEQlleXlIWT19DUFMT&rst=2883&ck=0&s=30ce0f33ab001cc2&ref=https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat&qt=1&ap=3328&be=309&fe=2012&dc=742&at=ThtXRgpLS08%3D&perf=%7B%22timing%22:%7B%22of%22:1691761430677,%22n%22:0,%22f%22:158,%22dn%22:158,%22dne%22:159,%22c%22:159,%22s%22:198,%22ce%22:244,%22rq%22:244,%22rp%22:309,%22rpe%22:540,%22di%22:991,%22ds%22:992,%22de%22:1050,%22dc%22:2317,%22l%22:2317,%22le%22:2321%7D,%22navigation%22:%7B%7D%7D&fp=653&fcp=653
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/async-api.e9f77430-1.237.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
Content-Length
40
x-served-by
cache-fra-eddf8230131-FRA
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1778897272132032&ev=PageView&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&rl=&if=false&ts=1691761433605&sw=1600&sh=1200&v=2.9.121&r=stable&ec=0&o=30&fbp=fb.1.1691761433584.16815361&cs_est=true&it=1691761433357&coo=false&exp=a1&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 11 Aug 2023 13:43:53 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
oribili.js
cdn.linkedin.oribi.io/33962/
74 KB
24 KB
Script
General
Full URL
https://cdn.linkedin.oribi.io/33962/oribili.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2248:3000:2:53b2:240:93a1 , United States, ASN (),
Reverse DNS
Software
/
Resource Hash
d4dd31271c7b882e6247ba6349a11cd49ffc7bb59f1856c315878153d60cd2db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:40:05 GMT
content-encoding
gzip
via
1.1 032d5acf8b9877b36c8078e2a86a3836.cloudfront.net (CloudFront)
x-amz-cf-pop
MXP63-P3
age
228
vary
accept-encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript;charset=UTF-8
cache-control
public, max-age=300
x-amz-cf-id
SToraejQVNijd1RtSMUycKtuIxlWgOpdHca1J-NATCt28xIKQK-WMA==
munchkin.js
munchkin.marketo.net/163/
11 KB
6 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Fri, 11 Aug 2023 13:43:53 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sun, 19 Nov 2023 13:43:53 GMT
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/
0
0
Fetch
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by
Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
application/json
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
server
Google Frontend
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-powered-by
Express
access-control-allow-methods
GET, POST
content-type
text/html
access-control-allow-origin
*
x-cloud-trace-context
2d3cac3074bed0d09103f285d5f06708
function-execution-id
n2zpdl02f1oy
access-control-allow-headers
Content-Type, Accept
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame
0
0
Preflight
General
Full URL
https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Accept
access-control-allow-methods
GET, POST
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-length
22
content-type
text/html; charset=utf-8
date
Fri, 11 Aug 2023 13:43:53 GMT
etag
W/"2-ROqGvmcGDXooyAXFZHZ+i4au1yQ"
function-execution-id
c0ndh98egrpj
server
Google Frontend
x-cloud-trace-context
e188ae192a400773aa21f605a8efd249
x-powered-by
Express
6si.min.js
j.6sc.co/
48 KB
14 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/j/6934ae2b-4c76-4229-97d0-8f637b004b88.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jul 2023 16:27:10 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64b9605e-bf6f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14190
expires
Fri, 11 Aug 2023 13:43:53 GMT
getuidj
secure.adnxs.com/
11 B
571 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
an-x-request-uuid
b2bb15a5-2402-4d50-be39-f93fa9ef4acf
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zscaler.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
80.255.7.101; 80.255.7.101; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
11
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
193 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
19 B
308 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:22::1726:62ed Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.zscaler.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:1338:92::5
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1691761433840_389993773_588681164_20_885_38_0_219";dur=1
content-length
19
expires
Fri, 11 Aug 2023 13:43:53 GMT
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-44.fra2.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Fri, 11 Aug 2023 13:43:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-apigw-id
Jf4sHGuUvHcF1xA=
x-amz-cf-id
D3nQIGyH6qVelI5NC44zpOzBwv__gZDkfu0H2r0CqgHs6jna_YhiGw==
x-amz-cf-pop
FRA2-C1
x-amzn-requestid
76b9a2b1-807a-439d-a245-d2cb661dfb9b
x-cache
Miss from cloudfront
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-44.fra2.r.cloudfront.net
Software
/
Resource Hash
141594a1fee23e384f27676ab795d9b0fc3b5f732e7d4443ce861d11ae33a1e6

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.59
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amzn-trace-id
Root=1-64d63b1a-6fcc3df831daee9a0f8080bc;Sampled=0;lineage=7c392b7c:0
x-amzn-requestid
e34927a8-641f-4372-ac38-1b49702dfaa6
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Jf4sIH_EvHcFe-Q=
content-length
1406
x-amz-cf-id
U9mZJXBF__ynfuV_wqmusnQVkDmtP1Smz_uEiFkVOZsOHur-M-w59Q==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1691761433848&cv=11&fst=1691761433848&bg=ffffff&guid=ON&async=1&gtm=45be3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&hn=www.googleadservices.com&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&auid=1589828845.1691761432&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-812494211
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bb1460abe1177a5d1f8d69a5a7fcbc59a129d91a06a571abccb1e438834cdc98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1375
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
event
gw.linkedin.oribi.io/
0
186 B
XHR
General
Full URL
https://gw.linkedin.oribi.io/event
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.149.190.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-149-190-242.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.zscaler.com
date
Fri, 11 Aug 2023 13:43:54 GMT
access-control-allow-credentials
true
content-length
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain
/
px.ads.linkedin.com/ws_collect/
0
278 B
Image
General
Full URL
https://px.ads.linkedin.com/ws_collect/?pid=33962&timestamp=1691761433910&raw_event_id=33962-b37191ae-8612-0aad-9ea8-94ecf7ccc712-1691761433902
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:53 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: E15C32FD3167490C90C478F8CC30A241 Ref B: DUS30EDGE0313 Ref C: 2023-08-11T13:43:53Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYCpedRJSoEDsUHsveHjA==
8ea33570-33b4-4010-b49c-1db2cbb0dc2f
https://www.zscaler.com/
43 B
0
Image
General
Full URL
blob:https://www.zscaler.com/8ea33570-33b4-4010-b49c-1db2cbb0dc2f
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22ab9750bca4342498694e239e304dd3a9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%221dc729230d6b8d19bab5e6236d81f60c4dca0823%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%226934ae2b-4c76-4229-97d0-8f637b004b88%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/
726 B
572 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.67.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-67-224.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 1dc729230d6b8d19bab5e6236d81f60c4dca0823
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
X-6s-CustomID
WebTag 6934ae2b-4c76-4229-97d0-8f637b004b88

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
content-length
387
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.67.224 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-67-224.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.zscaler.com
access-control-max-age
1800
date
Fri, 11 Aug 2023 13:43:54 GMT
server
nginx
up
insight.adsrvr.org/track/ Frame 3DFF
0
0

visitWebPage
306-zej-256.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1691761433937&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1691761433937-43575&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Fri, 11 Aug 2023 13:43:54 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
eb05c01e-8992-43ff-bde4-f29d9da46a71
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.google.com/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1691761433848&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45be3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1100197023&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1691761433848&cv=11&fst=1691758800000&bg=ffffff&guid=ON&async=1&gtm=45be3890&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&frm=0&tiba=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1100197023&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:53 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame 0251
0
72 B
Document
General
Full URL
https://www.facebook.com/tr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.zscaler.com
Referer
https://www.zscaler.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.zscaler.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Fri, 11 Aug 2023 13:43:54 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
queue
st.fullcircleinsights.com/v1/visits/
2 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-44.fra2.r.cloudfront.net
Software
/
Resource Hash
1b321dabcadc3f90412440ef780fa5171ccbddb29ffb22f604820a975477b390

Request headers

origin-fci
https://www.zscaler.com
Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.59
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
x-api-key
qJ5ZUG1BW44UIJbuBg8oP93ofs3xOFTZ7XFCqaSv
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amzn-trace-id
Root=1-64d63b1a-0a352d7140e2f04d16d6b9a1;Sampled=0;lineage=adebd93c:0
x-amzn-requestid
fcd8680b-4af9-4047-9db2-188c6b3b1991
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
x-amz-apigw-id
Jf4sPFCIPHcF-Ng=
content-length
2055
x-amz-cf-id
eNQd1LB0En53qTEdOr6oL3UkDfxZjwRKx_yvoq5erI8pnnfTMAIhiw==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-44.fra2.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.zscaler.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.zscaler.com
content-length
1
content-type
application/json
date
Fri, 11 Aug 2023 13:43:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-apigw-id
Jf4sOHKsvHcFm4A=
x-amz-cf-id
GC8rC9YbMrPlxQpSlQe09OM1AI_a9NQHYLAWJvaGxVl75FzBEXaL4g==
x-amz-cf-pop
FRA2-C1
x-amzn-requestid
ee072fa9-66d5-4b91-b6b7-c28b48ff62b4
x-cache
Miss from cloudfront
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A53%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:54 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:55 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:56 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
st
px.mountain.com/
2 KB
2 KB
Script
General
Full URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1%3BG-10SPJ4YJL9&ga_client_id=1257529249.1691761432&shpt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&ga_info=%7B%22status%22%3A%22One%20or%20more%20failures%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%3BG-10SPJ4YJL9%22%2C%22ga_client_id%22%3A%221257529249.1691761432%22%2C%22shpt%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%2C%22dcm_cid%22%3A%221257529249.1691761432%22%2C%22dcm_gid%22%3A%221960830698.1691761432%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A29%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1257529249.1691761432&dcm_gid=1960830698.1691761432&available_ga=%5B%7B%22id%22%3A%22UA-6177009-1%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22G-10SPJ4YJL9%22%2C%22sess_id%22%3A%221691761432%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=21718526323252640term%3Dvalue&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat
Requested by
Host: dx.mountain.com
URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=21718526323252640term=value
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.81.173.170 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-81-173-170.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
06bfe4f3162ed314ecd36a9d0b1f0ea5a484ea42ed828793b6bc907015cb5cab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:57 GMT
content-encoding
gzip
server
istio-envoy
transfer-encoding
chunked
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
x-envoy-upstream-service-time
2
connection
close
collect
region1.analytics.google.com/g/
0
54 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-10SPJ4YJL9&gtm=45je3890&_p=1057947138&cid=1257529249.1691761432&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1691761432&sct=1&seg=0&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&dt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&_s=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-10SPJ4YJL9&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zscaler.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 11 Aug 2023 13:43:57 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.zscaler.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:57 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
gs
gs.mountain.com/
144 B
733 B
Script
General
Full URL
https://gs.mountain.com/gs
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/security-research/statc-stealer-decoding-elusive-malware-threat
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.81.162.201 -, , ASN (),
Reverse DNS
Software
istio-envoy /
Resource Hash
158ecdc8dab0ef789b4f4af14e83f483ea1fe55011c2921412c7255010700f7d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:58 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
cache-control
public, max-age=31536000
x-envoy-upstream-service-time
0
connection
close
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
content-length
144
x-application-context
application:prod:8080
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=null&visitor=f25fa26a-ef1e-4400-8ca8-b1a246e8a22d&session=54c7ebfc-cf91-4793-8af1-75354d8c7452&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2011%20Aug%202023%2013%3A43%3A57%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Beware%20of%20Statc%20Stealer%3A%20Hidden%20in%20ads%2C%20it%20unleashes%20malicious%20files.%20Stay%20vigilant%2C%20protect%20your%20devices%20and%20data%20from%20this%20stealthy%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&pageViewId=b7107f41-e6fb-4e03-883f-f01cb486bffb&an_uid=0&webTagId=6934ae2b-4c76-4229-97d0-8f637b004b88&v=1.1.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.zscaler.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Fri, 11 Aug 2023 13:43:58 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
st
px.mountain.com/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
insight.adsrvr.org
URL
https://insight.adsrvr.org/track/up?adv=5gm3a7p&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&upid=27hmsyx&upv=1.1.0
Domain
px.mountain.com
URL
https://px.mountain.com/st?ga_tracking_id=UA-6177009-1%3BG-10SPJ4YJL9&ga_client_id=1257529249.1691761432&shpt=Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog&ga_info=%7B%22status%22%3A%22One%20or%20more%20failures%22%2C%22ga_tracking_id%22%3A%22UA-6177009-1%3BG-10SPJ4YJL9%22%2C%22ga_client_id%22%3A%221257529249.1691761432%22%2C%22shpt%22%3A%22Statc%20Stealer%20%7C%20Zscaler%20ThreatLabz%20Blog%22%2C%22dcm_cid%22%3A%221257529249.1691761432%22%2C%22dcm_gid%22%3A%221960830698.1691761432%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A29%2C%22getClientIdByCookie%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_cid%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=1257529249.1691761432&dcm_gid=1960830698.1691761432&available_ga=%5B%7B%22id%22%3A%22UA-6177009-1%22%2C%22sess_id%22%3Anull%7D%2C%7B%22id%22%3A%22G-10SPJ4YJL9%22%2C%22sess_id%22%3A%221691761432%22%7D%5D&hardcoded_ga=&dxver=4.0.0&shaid=32329&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&shadditional=adroll%3Dtrue%2Cgoogletagmanager%3Dtrue%2Cga4%3Dtrue%2Clanguage%3Den&shoid=%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=1691761437917179&shguid=2be08edb-e416-39fc-8277-48360c7b02d1&shgts=1691761438799

Verdicts & Comments Add Verdict or Comment

127 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA object| OneTrustStub function| OptanonWrapper function| once function| _typeof function| ownKeys function| _objectSpread function| _defineProperty function| _toPropertyKey function| _toPrimitive function| $ function| attachFailoverAssets function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| exposedFiltersUi function| jQuery function| ES6Promise object| drupalSettings object| Drupal function| dBlazy function| Bio function| BioMedia object| tabbable function| Popper object| Cookies object| APP object| UTIL object| IPv6 object| punycode object| SecondLevelDomains function| URI function| URITemplate object| lazySizes function| Sifter object| MicroPlugin function| Selectize function| loadjs object| bootstrap string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| MktoForms2 object| _wq object| zsForms object| Optanon object| OneTrust function| addCaptchaScript object| jQuery112405791916411437934 object| _utm_data object| utm_data object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| authorArray object| GooglebQhCsO string| GoogleAnalyticsObject function| ga function| doMarketoGASetup object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady function| process6senseData string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _linkedin_data_partner_id function| fbq function| _fbq object| techtargetic function| pdst number| sf14gv string| adroll_sid object| adroll object| __adroll boolean| adroll_optout object| adroll_loaded object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback function| lintrk boolean| _already_called_lintrk function| UET function| UET_init function| UET_push object| ueto_a019f11806 object| uetq object| __adroll_consent_data object| adroll_exp_list function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country object| _6si object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API object| $jscomp object| fcdsc function| fcdscLoad function| gtag function| ttd_dom_ready function| TTDUniversalPixelApi object| ORIBILI boolean| _storagePopulated object| MunchkinTracker string| dcm_cid undefined| dcm_tid undefined| dcm_gid object| gaUA object| irongate

36 Cookies

Domain/Path Name / Value
.info.zscaler.com/ Name: __cf_bm
Value: DRuddtMB3ZHntkFI6IamukeoZXA_4ozKnz3JAwNg5rw-1691761431-0-AT2ewHSJhHh+vZJqcXECqlJsjMKNwpfl8qg8UELPMQdgAule4lq1FEqW7IRZDAvn08VXwtQoqxTu1qP1XYsLW08=
.zscaler.com/ Name: _gcl_au
Value: 1.1.1589828845.1691761432
info.zscaler.com/ Name: BIGipServerabmweb-nginx-app_https
Value: !MyCOmOlGRSt7NW6kCIQPm+cqSAXSEUvhEJUUs0SQCpMRVjQsa7c9Ce607pZbEjPfvx4xGWhKwRRVgQ==
.www.zscaler.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Fri+Aug+11+2023+15%3A43%3A52+GMT%2B0200+(Central+European+Summer+Time)&version=6.39.0&isIABGlobal=false&landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H36%3A1%2CH59%3A1%2CH109%3A1%2CH45%3A1%2CH46%3A1%2CH100%3A1%2CH82%3A0%2CH106%3A0%2CH116%3A0%2CH4%3A0%2CH102%3A0%2CH76%3A0%2CH103%3A0%2CH60%3A0%2CH96%3A0%2CH20%3A0%2CH22%3A0%2CH97%3A0%2CH98%3A0%2CH108%3A0%2CH65%3A0%2CH83%3A0%2CH110%3A0%2CH111%3A0%2CH112%3A0%2CH114%3A0%2CH101%3A0%2CH52%3A0%2CH104%3A0%2CH105%3A0%2CH14%3A0%2CH15%3A0%2CH17%3A0%2CH113%3A0%2CH115%3A0&genVendors=
.zscaler.com/ Name: _gid
Value: GA1.2.1960830698.1691761432
.zscaler.com/ Name: _dc_gtm_UA-6177009-1
Value: 1
.zscaler.com/ Name: _ga
Value: GA1.2.1257529249.1691761432
.zscaler.com/ Name: _gat_UA-6177009-1
Value: 1
.zscaler.com/ Name: _ga_10SPJ4YJL9
Value: GS1.1.1691761432.1.0.1691761433.59.0.0
.techtarget.com/ Name: __cf_bm
Value: C2pQ5_aGG1d2hrsLIX7ycaml.z8KqD25QuPQodjE0EE-1691761433-0-AYJq4Metwl/9RYaZzefhvhWDjZfijYttPkpbIZMjZts7VDwaIkadRs1tqVMhL/FJ6Ri67M/wULxTF0Pvz1riKiU=
.zscaler.com/ Name: _uetsid
Value: 1c48ae10384d11eebc17a74359850cb6
.zscaler.com/ Name: _uetvid
Value: 1c490140384d11ee90703d84e5ffb5a0
.zscaler.com/ Name: _fbp
Value: fb.1.1691761433584.16815361
www.zscaler.com/ Name: ln_or
Value: eyIzMzk2MiI6IjMzOTYyIn0%3D
www.zscaler.com/ Name: __pdst
Value: 35fa3cbc605345d09e372117812446e2
.linkedin.com/ Name: li_sugr
Value: 689acb90-6259-435f-8abf-440ed7711781
.linkedin.com/ Name: bcookie
Value: "v=2&3cea9261-484e-4547-877c-4ba6ff1d4387"
.linkedin.com/ Name: lidc
Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2630:u=1:x=1:i=1691761433:t=1691847833:v=2:sig=AQGQv0uFtX_aYcMyazT45fi3q8Vixx3N"
.zscaler.com/ Name: _biz_uid
Value: 77215a99c1154d42f770d96a2e169126
.zscaler.com/ Name: _biz_sid
Value: 622436
.zscaler.com/ Name: _biz_nA
Value: 1
.zscaler.com/ Name: _biz_pendingA
Value: %5B%22m%2Fipv%3F_biz_r%3D%26_biz_h%3D-1906410348%26_biz_u%3D77215a99c1154d42f770d96a2e169126%26_biz_s%3D622436%26_biz_l%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fsecurity-research%252Fstatc-stealer-decoding-elusive-malware-threat%26_biz_t%3D1691761433795%26_biz_i%3DStatc%2520Stealer%2520%257C%2520Zscaler%2520ThreatLabz%2520Blog%26_biz_n%3D0%26rnd%3D272483%22%5D
.zscaler.com/ Name: _fcdscst
Value: MTY5MTc2MTQzMzgwOQ==
.zscaler.com/ Name: oribili_user_guid
Value: e5bb3250-9f7f-dfe9-09a3-79a59b79e9bd
www.zscaler.com/ Name: _an_uid
Value: 0
.linkedin.com/ Name: UserMatchHistory
Value: AQLJQdMANf8KvwAAAYnk1tz6GbNycLGzzHbidvQGqlo-1a-wfO3brezfiNrMf8XSwbZWe8_9t45xJQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKGQqKMmvHZggAAAYnk1tz60GoikyLywD-owuJt8tR1Hh1yVV5wn0Zd35eOwIsziEEd5PthCNEydcALDjuuEA
www.zscaler.com/ Name: _gd_visitor
Value: f25fa26a-ef1e-4400-8ca8-b1a246e8a22d
www.zscaler.com/ Name: _gd_session
Value: 54c7ebfc-cf91-4793-8af1-75354d8c7452
.zscaler.com/ Name: _mkto_trk
Value: id:306-ZEJ-256&token:_mch-zscaler.com-1691761433937-43575
.doubleclick.net/ Name: IDE
Value: AHWqTUkr_OjFvj56SIG0GaHUMs7LXTlnS0dJttdZaAJt-GvVEJo60RQsu61gNGEx
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230811134354ad81e0e2-dd00-4d89-8103-e8a648f7bfecAQFQA2JufTiQHSQ3HWyn0SmJZ3NJYHq7"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTE3NjE0MzQ7MjswMjFu3xyAEcrcAfapL6dZF1VvjfBHczj6sTDG0KolP/N9TQ==
.6sc.co/ Name: 6suuid
Value: aad01702a06f01001a3bd664b60000009b3f4000
.zscaler.com/ Name: _fcdscv
Value: eyJDdXN0b21lcklkIjoiNzMxYzMxNmEtYzQ2ZS00YTk0LTgxYTktN2NmYzBlYTBkNTNlIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiI0ODBhNmRlOS05MTcxLTQyZDktODNlZi1mMGVhY2JjY2I3NTUifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
.mountain.com/ Name: guid
Value: 1f05b966-384d-11ee-9d35-b3fd656d350a

3 Console Messages

Source Level URL
Text
network error URL: https://t.sf14g.com/sf14g.js
Message:
Failed to load resource: the server responded with a status of 403 ()
security error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=21718526323252640term=value(Line 10)
Message:
Refused to connect to 'https://52.71.121.170/is' because it violates the following Content Security Policy directive: "connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io *.hushly.com https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 fast.wistia.net".
javascript error URL: https://dx.mountain.com/spx?dxver=4.0.0&shaid=32329&tdr=&plh=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fsecurity-research%2Fstatc-stealer-decoding-elusive-malware-threat&cb=21718526323252640term=value(Line 10)
Message:
Refused to connect to 'https://52.71.121.170/is' because it violates the document's Content Security Policy.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.zscaler.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.zscaler.com *.google.com *.google-analytics.com analytics.google.com *.analytics.google.com www.googletagmanager.com cdn.cookielaw.org *.cloudfront.net *.newrelic.com fast.wistia.com fast.wistia.net www.youtube.com bugcrowd.com *.bugcrowdusercontent.com bam.nr-data.net cdn.bizible.com *.mountain.com trk.techtarget.com connect.facebook.net js.driftt.com visitor.reactful.com j.6sc.co snap.licdn.com *.crazyegg.com *.adroll.com bat.bing.com *.doubleclick.net *.clarity.ms *.cloudflare.com *.googleadservices.com *.marketo.net www.gartner.com *.ads-twitter.com *.google.co.in d.adroll.com s.adroll.com d.adroll.mgr.consensu.org dsum-sec.casalemedia.com eb2.3lift.com googleads.g.doubleclick.net p.adsymptotic.com px.ads.linkedin.com px4.ads.linkedin.com pixel.advertising.com pixel.rubiconproject.com image2.pubmatic.com simage2.pubmatic.com snap.licdn.com sync.outbrain.com sync.taboola.com trc.taboola.com ads.yahoo.com ups.analytics.yahoo.com www.facebook.com connect.facebook.net idsync.rlcdn.com ib.adnxs.com x.bidswitch.net cdn.pdst.fm t.sf14g.com cdn.jsdelivr.net unpkg.com assets.adobedtm.com acsbapp.com *.linkedin.oribi.io js.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; object-src 'self' *.zscaler.com; style-src 'self' 'unsafe-inline' *.zscaler.com www.gartner.com *.googleapis.com *.fontawesome.com *.googletagmanager.com cdn.jsdelivr.net cdnjs.cloudflare.com app-abm.marketo.com; img-src 'self' https: data: blob: d2iiunr5ws5ch1.cloudfront.net fast.wistia.net; media-src 'self' blob: *.zscaler.com js.driftt.com fast.wistia.com embedwistia-a.akamaihd.net embed-cloudfront.wistia.com *.wistia.com; frame-src 'self' www.youtube.com bugcrowd.com www.visualize-roi.com *.zscaler.com js.driftt.com www.facebook.com *.doubleclick.net *.cloudfront.net www.gartner.com zscaler-support.force.com accounts.skilljar.com zscalerext.okta.com insight.adsrvr.org match.adsrvr.org https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx zscalermarketing67.netlify.app dev-zscalermarketing67.netlify.app app-abm.marketo.com; frame-ancestors 'self' https://testmydefenses.com https://www.testmydefenses.com https://zscalerext.okta.com; child-src 'self' blob: *.zscaler.com *.doubleclick.net; font-src 'self' data: www.gartner.com *.gstatic.com *.fontawesome.com fast.wistia.com fast.wistia.net; connect-src 'self' blob: *.zscaler.com www.googletagmanager.com *.google-analytics.com cdn.cookielaw.org analytics.google.com *.analytics.google.com stats.g.doubleclick.net optanon.blob.core.windows.net geolocation.onetrust.com *.wistia.com st.fullcircleinsights.com bam.nr-data.net *.litix.io embedwistia-a.akamaihd.net *.reactful.com www.facebook.com secure.adnxs.com *.6sc.co *.6sense.com *.crazyegg.com *.clarity.ms *.mktoresp.com *.cloudfunctions.net www.facebook.com cookies-data.onetrust.io api.zippopotam.us bat.bing.com cdn.linkedin.oribi.io cdn.acsbapp.com ibc-flow.techtarget.com google.com adservice.google.com *.linkedin.oribi.io *.hushly.com https://*.zscaler.com https://*.zscaler.fr https://*.zscaler.de https://*.zscaler.jp https://*.zscaler.es https://*.zscaler.it https://*.zscaler.com.mx 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 fast.wistia.net
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM testmydefenses.com
X-Xss-Protection 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

306-zej-256.mktoresp.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.pdst.fm
connect.facebook.net
d.adroll.com
d2i34c80a0ftze.cloudfront.net
dx.mountain.com
epsilon.6sense.com
geolocation.onetrust.com
googleads.g.doubleclick.net
gs.mountain.com
gw.linkedin.oribi.io
ibc-flow.techtarget.com
info.zscaler.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.adsrvr.org
munchkin.marketo.net
px.ads.linkedin.com
px.mountain.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
stats.g.doubleclick.net
t.sf14g.com
trk.techtarget.com
us-central1-adaptive-growth.cloudfunctions.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.zscaler.com
insight.adsrvr.org
px.mountain.com
104.102.38.132
104.17.70.206
108.138.15.119
13.107.42.14
13.224.189.44
151.101.66.137
152.195.15.58
162.247.243.29
192.28.144.124
2001:4860:4802:32::36
2001:4860:4802:36::36
2600:9000:2176:e400:9:14eb:6280:93a1
2600:9000:2248:3000:2:53b2:240:93a1
2600:9000:225e:f600:6:9280:1080:93a1
2606:4700::6812:1c4a
2606:4700::6812:1d26
2606:4700::6812:1d4a
2606:4700::6812:a972
2606:4700::6812:c9f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:80e::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2004
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2008
2a00:1450:400c:c0a::9b
2a02:26f0:480:22::1726:62ed
2a02:26f0:780::210:a40a
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a05:d018:cc3:fe05:e058:1984:7346:6b74
3.127.67.224
34.111.208.231
35.244.142.80
35.81.162.201
35.81.173.170
37.252.171.149
52.7.151.245
54.145.46.195
54.149.190.242
95.101.111.170
02ef3d4346add95520307127e5cbfbd7b9da8697720a7c9046d44188bd19d1b1
06bfe4f3162ed314ecd36a9d0b1f0ea5a484ea42ed828793b6bc907015cb5cab
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0e7ad47a4bc6ddbb17cb8cbe6167dae4717d0b5962a1d63de2e93e6dc201b9e8
13304f18d81d93df080e863a92efc97fece468560d09e370c090700e84b591ac
141594a1fee23e384f27676ab795d9b0fc3b5f732e7d4443ce861d11ae33a1e6
141c410edab90686e098d4a827e8b79d8c8e295694508ddb4e3003f955127b65
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
158ecdc8dab0ef789b4f4af14e83f483ea1fe55011c2921412c7255010700f7d
1b321dabcadc3f90412440ef780fa5171ccbddb29ffb22f604820a975477b390
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
221b2ab2dc209b559aa7ba48f5d22ed8ada589e5fcd180a3bc3c98ba35b4e632
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
297f95779a7ddf48032664221491a3228529dfbe09233c945a12234d63470527
2dc0e215dc2374fc5cdacf24707fabeabc2e4193e12ec9c0203ac9a52a5daf3e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
370a9e517ef0694db38a18b53a46711e1461912f0074f024db5373ff946fc894
452c86d701fc77989aaf09af7d667885bcaaeaa8943ce356eb77d83d63afcee6
4f9d5ec6f2bd4518b2290c4ba38427c09fe1d3d733654680da7ee72df05bd3ae
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
52272481e0caa74b259f2d54324a5b00e547cc8d35fea3174cc3702f9cc8d516
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
68eb827a2fa6f035eab41392f863522ae5dc0d4c0c31d5245362a7f1a5aed46a
69fe3a3cb8e52c9522e1317a41bfda30f19e6c199fb84c66f083cd9e35e46442
6bd5068ee3f41ad2ed4f003c13c4e939021c77f7a69ac82d25211c72868b520e
6e05dcba80ae0609933e0c93c0d7ce06083dda03785deaa6e40a109a134acdb2
736666a53a4a4805e200de224be9255704ff848fd84d60333b087d50d02490ef
7662a5a8640648c39b824f101e232d34b73499503492d05394988f00ab79f1b4
7967afe13bb4cedec250ae638c4e27ca26a21ac0bc950cce6118130b20b6557d
7eaab25edc8c9c784d6a7591022fc5babfb21a0cd151446f4aa08fa6a4fd9efd
80d6536489126ec494e311b14d0b7f8630fe9f23a77e2635c8f0264492cbc3c7
8124a04347a296f12b1b2f288f064f11aa7cda722ac2d0b50252fabba7649a9d
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8f51d7bb4a7314fbd42bd5a2cec23adcfd23441c6539c3437cac22bc10c285a5
9581d252706f6236028acf67e89cd0c2f8ec64ff46a416bf384b2fd3876080d4
99b5a6256a9ee7c2640c2669ed517975bfb713b36dc3dde5c55b3c2c85885f4c
9b78354357bc04de9fa52562968bad64ef1311b665cc6ea927d2ec08bcc82cd8
a09d0f89e99cf5a081315ff701187632005dabd23f3ca116a75790003faa7e8f
a1c8bf8b428570336332bf63dd4efaf9e41b95dd4d83e324592d87d3042f747e
aa2b8282a1438a0e53971aa29a5c54f2911a3cb79b44cc20f8521ead150c458f
abf7c1c5621ec0eb8743468b6d9c02cf9e9ee9847ac733273c9593b2990fb191
ae3536ecd79c98f87387cee9060be3053e0eb8fe0871e7336554812ef8138772
b3489d8ddd967153384606a9a3445e5ce147f6d895ecff15576cc011c271d395
b81a8f58e7f0d88215001e9ebdb7ce06797849119c2e851a02d226b1c96a692d
b97b49ee323dbccf9a13f15fa3d93188d01681652d52b1ed40ad00c32dfb0513
bb1460abe1177a5d1f8d69a5a7fcbc59a129d91a06a571abccb1e438834cdc98
be56e8099617d98bf0baca0cf02681faf7190434dcb5eac3d6a938f08fac2444
c0aee72df00de1dcfe4d631dd2a72979cee0e756ef7e243b2799856582c44557
c2b66668bbb8fae36b12842672cbeeedc9e7c16562d3c592a6613b6f44aed1b1
c311211146b7d1e26f7807e2131bd1c0787e54cc6dd90b9dd111fd2b4a1c7d77
c3cafb353ffa959edb33bbc7b79625416ef1e7393f7784c6debef4c2f35a65e3
c741c889cc259649f22be99dc5c3d1482490b124841e7f568d2095358f38e1e3
c7cfd5dc386d092ab9afb5af683856ed88121e55e6bf1024333c3151ccc46e36
c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
d132dd3ebfcfaf838e709f20f4c76fe2868ffa0dc22ee126f87af6dd0b4a7adb
d25984848cb59b62095fd6cb563ef08f012a501258c06fd7e64d263a785e1c88
d4dd31271c7b882e6247ba6349a11cd49ffc7bb59f1856c315878153d60cd2db
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd888ef4dda066839f9cb6d29aaf789463cccb55f245fd45d10983a618c77f72
dd9535c4b369928aa5fe4ddebbe42a9f96bb590ba9a70176297599192b9cbab4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de72c7056110de6c12aefd6fedb26a0e323d4cfab62d84c64db52e168af372e5
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4467e5e450f09b28e5f90e57af82e92968e748e34cb0542a123035fa280cca5
e75bb828a464f4b8987fddd4ba8cd008c54f248ebbd941f82a4d47be95960bf6
ec2e22fd918a8ffef0f54f466fb7edd2c586f39dad794cd25a0a97ce36c404d2
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef401955627aaaedffd337dc3a7c4f9ad56f5dcd31f13833772760cda1aaa437
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f641642f73b0d4a76b30723c0dec94325eafbc39620de7e3fc6283e1550829e5
f7dc1e7e6ef516bfc31ba5c7a9c4125ccd63e8008f1e2691e3d7a115adbaa554
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fb71a91ef4937bdac04520d7e7b1852bb28635ae850934d440360ccc8142c1a4
fcd0d01f674bf8bc63ee2236eb16f008bdfaa10ff622806b05b762a88ac3498c
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a