urlscan.io logo urlscan.io
SecurityTrails logo

www.zscaler.com Open in urlscan Pro
2606:4700::6813:d53e  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Submission: On January 27 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 6 countries across 23 domains to perform 86 HTTP transactions. The main IP is 2606:4700::6813:d53e, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.zscaler.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on April 8th 2019. Valid for: 2 years.
This is the only time www.zscaler.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
41 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 152.195.132.202 15133 (EDGECAST)
1 172.217.18.162 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
3 93.184.220.178 15133 (EDGECAST)
3 95.100.134.54 16625 (AKAMAI-AS)
1 163.171.132.119 54994 (QUANTILNE...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a05:f500:11:... 14413 (LINKEDIN)
1 1 2a05:f500:11:... 14413 (LINKEDIN)
1 54.173.179.199 14618 (AMAZON-AES)
2 95.101.176.176 16625 (AKAMAI-AS)
8 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 52.57.44.100 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 206.19.49.24 17225 (ATT-CERFN...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 192.28.144.124 15224 (OMNITURE)
1 2 52.21.56.60 14618 (AMAZON-AES)
86 24
41    2606:4700::6813:d53e (United States)

ASN13335 (CLOUDFLARENET, US)
www.zscaler.com
1    2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:815::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
4    152.195.132.202 (United States)

ASN15133 (EDGECAST, US)
cdn.cookielaw.org
1    172.217.18.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f2.1e100.net
www.googleadservices.com
3    2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a02:26f0:10c:38f::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
1    2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
3    93.184.220.178 (London, United Kingdom)

ASN15133 (EDGECAST, US)
cdn.bizible.com
3    95.100.134.54 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-134-54.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
1    163.171.132.119 (Germany)

ASN54994 (QUANTILNETWORKS, US)
trk.techtarget.com
1    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s.ytimg.com
2    2a05:f500:11:101::b93f:9005 (Ireland)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    2a05:f500:11:101::b93f:9001 (Ireland)

ASN14413 (LINKEDIN, US)
www.linkedin.com
1    54.173.179.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-173-179-199.compute-1.amazonaws.com
t.sf14g.com
2    95.101.176.176 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-101-176-176.deploy.static.akamaitechnologies.com
munchkin.marketo.net
8    2a00:1450:4001:821::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
3    2a00:1450:4001:81b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    52.57.44.100 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-44-100.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
2    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    206.19.49.24 (United States)

ASN17225 (ATT-CERFNET-BLOCK, US)
apt.techtarget.com
1    2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
306-zej-256.mktoresp.com
2    52.21.56.60 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-56-60.compute-1.amazonaws.com
tracking.leadlander.com
Domain Requested by
41 www.zscaler.com www.zscaler.com
www.google-analytics.com
8 fonts.gstatic.com www.zscaler.com
4 cdn.cookielaw.org www.zscaler.com
cdn.cookielaw.org
3 www.google.de www.zscaler.com
3 www.google.com 1 redirects www.zscaler.com
3 cdn.bizible.com www.googletagmanager.com
www.zscaler.com
cdn.bizible.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.zscaler.com
2 tracking.leadlander.com 1 redirects www.zscaler.com
2 googleads.g.doubleclick.net www.googleadservices.com
2 epsilon.6sense.com j.6sc.co
www.zscaler.com
2 munchkin.marketo.net www.zscaler.com
munchkin.marketo.net
2 px.ads.linkedin.com 1 redirects www.zscaler.com
1 306-zej-256.mktoresp.com munchkin.marketo.net
1 geolocation.onetrust.com www.zscaler.com
1 apt.techtarget.com www.zscaler.com
1 b.6sc.co www.zscaler.com
1 c.6sc.co j.6sc.co
1 stats.g.doubleclick.net 1 redirects
1 t.sf14g.com www.zscaler.com
1 www.linkedin.com 1 redirects
1 s.ytimg.com www.youtube.com
1 trk.techtarget.com www.zscaler.com
1 j.6sc.co www.zscaler.com
1 www.youtube.com www.zscaler.com
1 sjs.bizographics.com www.googletagmanager.com
1 www.googleadservices.com www.googletagmanager.com
1 www.googletagmanager.com www.zscaler.com
1 fonts.googleapis.com www.zscaler.com
86 28
Subject Issuer Validity Valid
zscaler.com
DigiCert SHA2 Extended Validation Server CA		 2019-04-08 -
2021-06-30		 2 years crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
sa437gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2018-05-17 -
2020-08-19		 2 years crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
*.google.com
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
cdn.bizible.com
Go Daddy Secure Certificate Authority - G2		 2019-03-14 -
2021-04-13		 2 years crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA		 2020-01-07 -
2021-04-07		 a year crt.sh
trk.techtarget.com
Sectigo RSA Domain Validation Secure Server CA		 2019-02-15 -
2020-02-15		 a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-05-29 -
2021-06-29		 2 years crt.sh
t.sf14g.com
Go Daddy Secure Certificate Authority - G2		 2019-07-09 -
2020-09-07		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2018-12-24 -
2020-03-24		 a year crt.sh
www.google.de
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
*.6sense.com
Amazon		 2019-08-16 -
2020-09-16		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA		 2019-10-25 -
2021-10-24		 2 years crt.sh
*.onetrust.com
DigiCert SHA2 Secure Server CA		 2018-03-12 -
2020-06-14		 2 years crt.sh
www.google.com
GTS CA 1O1		 2020-01-07 -
2020-03-31		 3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2022-01-21		 2 years crt.sh
*.leadlander.com
Go Daddy Secure Certificate Authority - G2		 2019-07-09 -
2020-09-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Frame ID: 21BA055C9FC7ADACC2329B662CEBF5B4
Requests: 86 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /munchkin\.marketo\.net\/munchkin\.js/i

Page Statistics

86
Requests

100 %
HTTPS

58 %
IPv6

23
Domains

28
Subdomains

24
IPs

6
Countries

3999 kB
Transfer

5905 kB
Size

15
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fresearch%252Fqealler-new-jar-based-information-stealer%26time%3D1580117210075%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075&liSync=true
Request Chain 62
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&gjid=178009223&_gid=1360401698.1580117210&_u=aGDAgEADQ~&z=1701302840 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840&slf_rd=1&random=492695311
Request Chain 81
  • https://tracking.leadlander.com/api/tracking?accountId=14146&page=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&referer=&fp=46b0604f6a632a0d294665c9ac64fb79 HTTP 302
  • https://tracking.leadlander.com/tracking.png

86 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request qealler-new-jar-based-information-stealer
www.zscaler.com/blogs/research/ 		102 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ce4614edc9c9c4f87bd503b1d0274cd3bfa06eb1d0754aa8ba3f75e1072aa63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
www.zscaler.com
:scheme
https
:path
/blogs/research/qealler-new-jar-based-information-stealer
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Mon, 27 Jan 2020 09:26:49 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d593686def5388ca4569cad98c5a9976d1580117209; expires=Wed, 26-Feb-20 09:26:49 GMT; path=/; domain=.www.zscaler.com; HttpOnly; SameSite=Lax
cache-control
max-age=31536000, public
x-drupal-dynamic-cache
MISS
link
<https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer>; rel="canonical" <https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer>; rel="revision"
x-ua-compatible
IE=edge
content-language
en
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
expires
Sun, 19 Nov 1978 05:00:00 GMT
last-modified
Mon, 27 Jan 2020 05:29:05 GMT
vary
X-UA-Device,Accept-Encoding
x-request-id
v-ef514834-40c5-11ea-9508-8313587dbf9a
x-ah-environment
prod
age
14261
via
varnish
x-cache
HIT
x-cache-hits
10
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; preload
server
cloudflare
cf-ray
55b9afec6e24971e-FRA
content-encoding
br
css_zT08A3VvkeejjebO3s3YaML9OZljXL8Ai6IkCdYzSeg.css
www.zscaler.com/sites/default/files/css/ 		9 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/sites/default/files/css/css_zT08A3VvkeejjebO3s3YaML9OZljXL8Ai6IkCdYzSeg.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd3d3c03756f91e7a38de6cedecdd868c2fd3999635cbf008ba22409d63349e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1515403
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-dd4c1d46-331c-11ea-8fc8-877015b31b63
last-modified
Fri, 27 Dec 2019 07:30:59 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
text/css
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c04971e-FRA
x-cache-hits
2
css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
www.zscaler.com/sites/default/files/css/ 		965 KB
113 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c83896ca4970564102d6466ba8b2c2e8b96ac5038380e01ca96b1627d882ba7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
448284
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-4e6af910-3cd3-11ea-8fbb-072e532eafef
last-modified
Wed, 22 Jan 2020 04:54:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
text/css
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c05971e-FRA
x-cache-hits
6
css
fonts.googleapis.com/ 		18 KB
1023 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
36b9d75325e3e2addf711c2024361ef378f94f88a41653641c8f6f836fdb81de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 27 Jan 2020 09:26:49 GMT
server
ESF
access-control-allow-origin
*
date
Mon, 27 Jan 2020 09:26:49 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Mon, 27 Jan 2020 09:26:49 GMT
zscaler-hdr-logo.svg
www.zscaler.com/themes/custom/zscaler/images/shared/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/zscaler-hdr-logo.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9889de61b49684c87111bcc4c726a73c3e6d799ca8eefa7f3dc109d533e92470
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514975
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-63d3dd04-331d-11ea-8684-1b8793240112
last-modified
Thu, 21 Nov 2019 05:31:29 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c08971e-FRA
x-cache-hits
30
zscaler-header-logo-white.png
www.zscaler.com/themes/custom/zscaler/images/shared/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/zscaler-header-logo-white.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
840353e97eda0d0721411f79be9b32cf832898137e52e3de834e4a1ccc0f62c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514639
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
2348
x-request-id
v-643cf9d8-331d-11ea-b5c2-33c60224847b
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/png
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c09971e-FRA
x-cache-hits
32
picture-6631-1553593061.jpg
www.zscaler.com/sites/default/files/pictures/ 		71 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/pictures/picture-6631-1553593061.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
263b401a4ec83c1a85ceb67552d812787430be0c9d312a0dfbb0ba57c0dc121a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
343855
cf-polished
origSize=74658, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
72290
x-request-id
v-8b590ad0-3dc6-11ea-8212-c30badb14e18
last-modified
Tue, 26 Mar 2019 09:37:41 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c0d971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-1.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		122 KB
123 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-1.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce35f5c29247a1196ecea5b3240cfac09bf2a4629a4844bba09d6cd92967e229
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218325
cf-polished
origSize=167999, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
125249
x-request-id
v-d1816b68-3eea-11ea-a2f7-a3e9b860b1e7
last-modified
Thu, 31 Jan 2019 18:52:42 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c0f971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-2.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		48 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-2.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c2314a9c882eb6997e7199a57ecbbdc628cda32b0d8dd20f193055ef49e71ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
79265
cf-polished
origSize=82996, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
49427
x-request-id
v-9770562e-402e-11ea-8935-f723303d5733
last-modified
Thu, 31 Jan 2019 18:53:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c10971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-3.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		136 KB
136 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-3.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9bf0d990ed8fe52c6b7669baa37e0751da5de711a69a1c009083f734510eb38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
79265
cf-polished
origSize=169961, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
138857
x-request-id
v-9771856c-402e-11ea-a89a-7b389e95966e
last-modified
Thu, 31 Jan 2019 18:53:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c11971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-4.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		203 KB
204 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-4.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d4852d4f8f762f926fa78511eb8f45de7afdf20afde77c38e33a3df39bc29c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:51 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
MISS
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
208340
x-request-id
v-9771aab0-402e-11ea-b646-1fe96874525f
last-modified
Thu, 31 Jan 2019 18:54:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c12971e-FRA
x-cache-hits
5
Q-image-5.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		162 KB
162 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-5.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00d23d732218fe75800d99cb6de1e7ae27f7517d62057782fef92cb038d83f5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218322
cf-polished
origSize=199439, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
165752
x-request-id
v-d31a0886-3eea-11ea-a1f7-334a56c11197
last-modified
Thu, 31 Jan 2019 18:54:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c13971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-6.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		177 KB
177 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-6.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af3a44157f470a88d48094365d3cc4c191d8fb2dce75fb6c2bed9b88d57a6fb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218321
cf-polished
origSize=217420, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
181282
x-request-id
v-355789ae-3ed9-11ea-bce1-1ff3ca3cb3c0
last-modified
Thu, 31 Jan 2019 18:55:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c15971e-FRA
x-cache-hits
1
Q-image-7.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		106 KB
107 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-7.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a35cd326b2cf07e0fa65ddfc1e1845a115d47391f645b05ea89eff473b436a6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218321
cf-polished
origSize=143948, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
109011
x-request-id
v-14ea42da-3ee1-11ea-a64c-e38f571bc767
last-modified
Thu, 31 Jan 2019 18:55:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c17971e-FRA
x-cache-hits
1
Q-image-8.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-8.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29797557f2a832d3dccb94f9de057083e4af261cc7073911186c1a907dced7fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218320
cf-polished
origSize=68676, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
44145
x-request-id
v-d4012dd8-3eea-11ea-ab4b-8b0ba09447e7
last-modified
Thu, 31 Jan 2019 18:56:07 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c19971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-9.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		129 KB
129 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-9.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
728ad5841f2e6db4e4715e23710cf7b27ad748d0ee71820e2f21bebe3451b330
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
79265
cf-polished
origSize=174112, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
132220
x-request-id
v-97736de6-402e-11ea-85d5-872f6cac6948
last-modified
Thu, 31 Jan 2019 18:56:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c1b971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-10.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		200 KB
200 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-10.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0713b82eeb70267ec6eb59d401260e1dbca6fe8a4c3b9e1d830b8deb8459af5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218319
cf-polished
origSize=238574, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
204787
x-request-id
v-d4c1f16c-3eea-11ea-836a-37881dbc0f16
last-modified
Thu, 31 Jan 2019 18:57:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c1c971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-11.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		137 KB
138 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-11.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f6bf99f8e9314c7a993b156d0b9e393a687b003c5b77f3e42a7573d110650cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218319
cf-polished
origSize=184531, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
140686
x-request-id
v-d4c817f4-3eea-11ea-a45a-ebb5a7a71466
last-modified
Thu, 31 Jan 2019 18:57:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c1d971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-12.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		127 KB
127 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-12.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d47ad89bdcc8d61a0168b76474ce044b5d5cd9efe021f26f741881170a2fc1f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:51 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
MISS
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
130180
x-request-id
v-97762680-402e-11ea-b9fe-473dea927231
last-modified
Thu, 31 Jan 2019 18:58:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c21971e-FRA
x-cache-hits
4
Q-image-13.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		178 KB
179 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-13.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a97d3e9898dc000c85c7c60b093d02c12e93cfce3a3d36e64c9e262a1a774a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218318
cf-polished
origSize=216247, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
182529
x-request-id
v-d5b0ace4-3eea-11ea-a270-bf99e0ce54d0
last-modified
Thu, 31 Jan 2019 18:59:03 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c22971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-14.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		116 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-14.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f5bc5ffb8a741105348a42379151dc246dfd5648233559418fc8537310b3ff2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
79265
cf-polished
origSize=153048, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
118384
x-request-id
v-97734f50-402e-11ea-94e2-dfecbacda42d
last-modified
Thu, 31 Jan 2019 18:59:31 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c23971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
Q-image-15.jpg
www.zscaler.com/sites/default/files/images/blogs/ 		322 KB
322 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/Q-image-15.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
824fb9832dee1f034e5162adc0a5324f14cd873470b0a3e413f06d2abdd489cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218316
cf-polished
origSize=379321, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
329335
x-request-id
v-d65ad610-3eea-11ea-97a9-3b23d722c165
last-modified
Thu, 31 Jan 2019 19:00:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c26971e-FRA
expires
Mon, 17 Feb 2020 09:26:49 GMT
gtm.js
www.googletagmanager.com/ 		135 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ac725fc84ab92dddf998effdf46f808138df4b75e3fdf61143e2d7cba844bb0e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
content-encoding
br
last-modified
Mon, 27 Jan 2020 09:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
36551
x-xss-protection
0
expires
Mon, 27 Jan 2020 09:26:49 GMT
mail-icon.svg
www.zscaler.com/themes/custom/zscaler/images/blog/ 		1021 B
664 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/blog/mail-icon.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac87ad7a2bef0649ec3f84eebacf1e02bd48647caa281c1da27cc26263abc75b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1513616
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-aab75736-331e-11ea-a987-5fc997568479
last-modified
Fri, 20 Sep 2019 09:57:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c28971e-FRA
x-cache-hits
17
facebook-icon.svg
www.zscaler.com/themes/custom/zscaler/images/blog/ 		1 KB
834 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/blog/facebook-icon.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7221be22d59bd95b5c1e47590a48d06d367a965213a39ca929241e4a6f9ee7ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1513616
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-dd4b4b64-331c-11ea-a2ec-3bfcfeb5a9e7
last-modified
Fri, 20 Sep 2019 09:57:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c2b971e-FRA
x-cache-hits
18
linkedin-icon.svg
www.zscaler.com/themes/custom/zscaler/images/blog/ 		1 KB
892 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/blog/linkedin-icon.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
391f4dc402b6ecb016765b0eae6e508d409b577b79e87dd1dbade260d4495581
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1513616
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-dd4be7fe-331c-11ea-baa3-0b38c3c515a4
last-modified
Fri, 20 Sep 2019 09:57:45 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c2c971e-FRA
x-cache-hits
19
twitter-icon.svg
www.zscaler.com/themes/custom/zscaler/images/blog/ 		1 KB
814 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/blog/twitter-icon.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8abaf8f630ae4af089de7c1b5d7d8f54cec867b3ecf76256db2f5a9fffe7c0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1513616
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-dd4e1d26-331c-11ea-9951-4b07c20bc722
last-modified
Fri, 20 Sep 2019 09:57:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c2e971e-FRA
x-cache-hits
18
zscaler-blog-encryption-1.jpg
www.zscaler.com/sites/default/files/images/blogs/----category-images/encryption/ 		61 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/----category-images/encryption/zscaler-blog-encryption-1.jpg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4513908a9872ced2ef23ab364f0cf81a750d278cb46c644b86993ed0107b5d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
340121
cf-polished
origSize=121050, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
62975
x-request-id
v-64dbb060-3dcb-11ea-8eb1-139e04693e49
last-modified
Wed, 28 Feb 2018 11:18:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c30971e-FRA
x-cache-hits
1
RSA-blog.png
www.zscaler.com/sites/default/files/images/blogs/ 		500 KB
500 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/RSA-blog.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10a14dc88e6d31f394be3467fc50145060f54fec6758180d5cac3260b23cd11f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
908521
cf-polished
origSize=531799, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
511668
x-request-id
v-990e00a4-38a3-11ea-95a2-9f01b05bbbd8
last-modified
Thu, 16 Jan 2020 21:02:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/png
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff24c31971e-FRA
x-cache-hits
5
email-decode.min.js
www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
824 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Thu, 23 Jan 2020 12:56:12 GMT
server
cloudflare
etag
W/"5e2997ec-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800, public
strict-transport-security
max-age=31536000; preload
cf-ray
55b9aff24c29971e-FRA
expires
Wed, 29 Jan 2020 09:26:49 GMT
js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
www.zscaler.com/sites/default/files/js/ 		727 KB
192 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/sites/default/files/js/js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
899d8efa2ae0a52ee197619bee041d625bc28762c50799c074105bf49d6460b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:49 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
443708
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-6185014e-3cd3-11ea-ae1b-ab69f1b5af37
last-modified
Wed, 22 Jan 2020 04:54:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
text/javascript
expires
Mon, 17 Feb 2020 09:26:49 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff24c2a971e-FRA
x-cache-hits
27
92ede4fc-c076-4245-8c3f-85e672763690.js
cdn.cookielaw.org/langswitch/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/langswitch/92ede4fc-c076-4245-8c3f-85e672763690.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lha/8D87) /
Resource Hash
3e630c1952503eb5a33e15aad315e03ae9d699c1c03ec1027c234933b37c9671

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
content-md5
wNMyoZp2a7YtIJ5FlCf5Pg==
age
2317
x-cache
HIT
status
200
content-length
737
x-ms-lease-status
unlocked
last-modified
Mon, 22 Apr 2019 21:38:32 GMT
server
ECAcc (lha/8D87)
etag
0x8D6C76ADDE64110
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
efb7d976-301e-015a-48ee-d49832000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Mon, 27 Jan 2020 13:26:50 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s29-in-f2.1e100.net
Software
cafe /
Resource Hash
e70adb67bcdec61516ea9e7174456c50effa918e43b3c8663baf1aa762f705de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9920
x-xss-protection
0
server
cafe
etag
4870430129932666244
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 27 Jan 2020 09:26:50 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6515
date
Mon, 27 Jan 2020 07:38:15 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Mon, 27 Jan 2020 09:38:15 GMT
insight.min.js
sjs.bizographics.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 16:41:31 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=79259
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
iframe_api
www.youtube.com/ 		859 B
923 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
c44de212bde358b79a506e193d2884e6bdd2f4a1c8e2a33c5aa6bc76bfe44d5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
content-type
application/javascript
status
200
cache-control
no-cache
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
bizible.js
cdn.bizible.com/scripts/ 		86 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SLZFK
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (lcy/1D3F) / ASP.NET
Resource Hash
cdfad57db2880222da0a5b5d756c3e306f7620ff4c3a40bffb351d5182f3e9b7

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
last-modified
Fri, 17 Jan 2020 00:52:53 GMT
server
ECS (lcy/1D3F)
age
289714
x-powered-by
ASP.NET
etag
"638b4b73d0ccd51:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
status
200
accept-ranges
bytes
content-length
33400
6si.min.js
j.6sc.co/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
95.100.134.54 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-134-54.deploy.static.akamaitechnologies.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
92dea0037946ab7baf6fa695b397e14e78ab4702a3a1526729ac43c6457fe310

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Dec 2019 01:37:18 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"5de70dce-389e"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
5948
tracking.js
trk.techtarget.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
163.171.132.119 , Germany, ASN54994 (QUANTILNETWORKS, US),
Reverse DNS
Software
PWS/8.3.1.0.8 /
Resource Hash
8b51552f523ecd57ca4f82df5ab10610349f91cacb7c0f72d0290bed3cc37e4e

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jun 2019 20:11:17 GMT
Server
PWS/8.3.1.0.8
Age
463
X-Ws-Request-Id
5e2eacda_PSdgflkfFRA2lp7_41424-59623
Content-Type
text/javascript
Via
1.1 VMmgnyNY2gh45:1 (W), 1.1 PSdgflkfFRA1hb199:0 (W), 1.1 PSdgflkfFRA2gb73:3 (W)
Cache-Control
max-age=600
X-Px
ht PSdgflkfFRA2gb73FRA
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1711
Expires
Mon, 27 Jan 2020 09:29:07 GMT
zscaler-home-navigation-dropDown-products.jpg
www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/zscaler-home-navigation-dropDown-products.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8521546462c374cd8318bbfbe95ff5c775195d06afb71b4d44eea64a3e42b020
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514634
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
21040
x-request-id
v-a7201eaa-331e-11ea-83c8-93aad7f969d3
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc8b971e-FRA
x-cache-hits
28
zscaler-home-navigation-dropDown-solutions.jpg
www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/zscaler-home-navigation-dropDown-solutions.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52ae784bbd156dfe8f7311c85d5753314cbd9d963ec95a62e6665c99d0268a7b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514634
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
17746
x-request-id
v-a72067d4-331e-11ea-92eb-b7082e2628f5
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc8c971e-FRA
x-cache-hits
28
zscaler-home-navigation-dropDown-resources.jpg
www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/zscaler-home-navigation-dropDown-resources.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7dd3f4c3fcd4d440cd3aa820cc4da361dd28a055f0a05bf60dbac778c3528a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514634
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
22243
x-request-id
v-a72313e4-331e-11ea-ae92-f7cf039a1302
last-modified
Fri, 20 Sep 2019 09:57:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc8e971e-FRA
x-cache-hits
28
zscaler-home-navigation-dropDown-company.jpg
www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/menu-backgrounds/zscaler-home-navigation-dropDown-company.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9622a721ead53a7e422bf180cb5a0aab8a5190b678bc3a1e1a29bc02a5314e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514634
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
21662
x-request-id
v-a72166ca-331e-11ea-b042-0fe52e212ef7
last-modified
Fri, 20 Sep 2019 09:57:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc8f971e-FRA
x-cache-hits
28
zscaler-blog-post-hero-zero-day.jpg
www.zscaler.com/themes/custom/zscaler/images/blog/post-images/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/blog/post-images/zscaler-blog-post-hero-zero-day.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
787e361212d8323feabd26f3dee955db6960983f3b9d18f9cb0bbd348017ef44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
138526
cf-polished
origSize=33874, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
31947
x-request-id
v-8c831f66-3fa3-11ea-b7da-cfad6f13683e
last-modified
Fri, 20 Sep 2019 09:57:45 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc92971e-FRA
x-cache-hits
1
phishing-spam-2%402x.jpg
www.zscaler.com/sites/default/files/images/blogs/----category-images/phishing-spam/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/default/files/images/blogs/----category-images/phishing-spam/phishing-spam-2%402x.jpg
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b94ac4868ab5a80127158fe2a26e28c3c7972a5873e3d5a02877c4ccca3cfb6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
218323
cf-polished
origSize=106665, status=vary_header_present
x-cache
MISS
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
104125
x-request-id
v-d2c44d9c-3eea-11ea-89d1-73ed9595df52
last-modified
Wed, 28 Feb 2018 10:03:25 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/jpeg
cf-bgj
imgq:100
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff2bc93971e-FRA
expires
Mon, 17 Feb 2020 09:26:50 GMT
js
www.google-analytics.com/gtm/ 		63 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-5KQJVPX&t=gtm1&cid=1699201997.1580117210
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9f8f6d28a5dce26b642642a1254c3698680d565bf45926c31c9229cd1935b09d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
br
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23635
x-xss-protection
0
expires
Mon, 27 Jan 2020 09:26:50 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vfleSrT7y/ 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vfleSrT7y/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1e3482f9a3a582ab789faacf7c391aa49bd21f5f0fd4ca2d8ee8b3951bdb971b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Sun, 26 Jan 2020 23:44:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
34958
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10209
x-xss-protection
0
last-modified
Thu, 23 Jan 2020 10:03:32 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Mon, 03 Feb 2020 23:44:12 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D33962%26url%3Dhttps%253A%252F%252Fwww.zscaler.com%252Fblogs%252Fresearch%252Fqeal...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075&liSync=true
0
87 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075&liSync=true
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lor1
status
200
x-li-proto
http/2
x-li-pop
prod-tln1
content-type
application/javascript
content-length
20
x-li-uuid
nFFFMDu07RVg/i/T3yoAAA==

Redirect headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-tln1
content-length
20
x-li-uuid
OE2mJTu07RUgyNV0qSsAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=33962&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&time=1580117210075&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
sf14g.js
t.sf14g.com/ 		37 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t.sf14g.com/sf14g.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.173.179.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-173-179-199.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd
Security Headers
Name Value
Strict-Transport-Security max-age=2592000

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
last-modified
Tue, 16 Oct 2018 18:33:02 GMT
server
Kestrel
etag
"1d4657eab9c909b"
strict-transport-security
max-age=2592000
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
37787
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-176-176.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2a6ce7e8796b3ad20ebca195d3424b34e0397063ae0fa76e340ca1c263694f99

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Jan 2020 02:01:16 GMT
Server
Apache
ETag
"0b691ed6f4fce14e966035ea72b61af4:1578967276"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
75590e24-f605-4d9c-b92c-ca09a93d469f.js
cdn.cookielaw.org/consent/ 		107 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/75590e24-f605-4d9c-b92c-ca09a93d469f.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/langswitch/92ede4fc-c076-4245-8c3f-85e672763690.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lha/8C98) /
Resource Hash
ac68bb7dc5704e99d44c73c67f609a3c8fb6105fae418687b80ec13d9b370114

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
content-md5
u1OHPxwcyLXNxp1DCtacfg==
age
2127
x-cache
HIT
status
200
content-length
17894
x-ms-lease-status
unlocked
last-modified
Mon, 22 Apr 2019 21:38:35 GMT
server
ECAcc (lha/8C98)
etag
0x8D6C76ADF89B5D5
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
8b315cb3-c01e-00e1-23ee-d43f93000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Mon, 27 Jan 2020 13:26:50 GMT
zscaler-zl-promo-background.png
www.zscaler.com/sites/all/themes/zscaler/images/home-page/slider/ 		76 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/sites/all/themes/zscaler/images/home-page/slider/zscaler-zl-promo-background.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b46904309f1ba6c5b0a40c3c2d4ea15bb5a1110e2a33d16e35d5961773a68a99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514637
cf-polished
origSize=114671, status=vary_header_present
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
78093
x-request-id
v-a8f933ec-331e-11ea-9a75-e342845959bf
last-modified
Fri, 20 Sep 2019 09:57:45 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/png
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff37d75971e-FRA
x-cache-hits
32
fa-brands-400.woff2
www.zscaler.com/themes/custom/zscaler/vendor/font-awesome/webfonts/ 		73 KB
73 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/themes/custom/zscaler/vendor/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03b742a6efdb17797c84c2b5db25f5cda6a3361fa5e62b98662e321b26f77331
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Origin
https://www.zscaler.com

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514351
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
74800
x-request-id
v-64049688-331d-11ea-9846-efb374aa4237
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
access-control-allow-origin
*
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff38d85971e-FRA
x-cache-hits
50
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Origin
https://www.zscaler.com

Response headers

date
Thu, 23 Jan 2020 19:10:31 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
310579
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Fri, 22 Jan 2021 19:10:31 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Origin
https://www.zscaler.com

Response headers

date
Sat, 18 Jan 2020 01:07:50 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
807540
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11020
x-xss-protection
0
expires
Sun, 17 Jan 2021 01:07:50 GMT
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Origin
https://www.zscaler.com

Response headers

date
Thu, 23 Jan 2020 10:12:15 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:52 GMT
server
sffe
age
342875
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11180
x-xss-protection
0
expires
Fri, 22 Jan 2021 10:12:15 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Origin
https://www.zscaler.com

Response headers

date
Thu, 23 Jan 2020 06:22:35 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
age
356655
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11056
x-xss-protection
0
expires
Fri, 22 Jan 2021 06:22:35 GMT
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 		12 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,500,500i,700,700i
Origin
https://www.zscaler.com

Response headers

date
Thu, 23 Jan 2020 06:21:38 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
age
356712
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12680
x-xss-protection
0
expires
Fri, 22 Jan 2021 06:21:38 GMT
fa-solid-900.woff2
www.zscaler.com/themes/custom/zscaler/vendor/font-awesome/webfonts/ 		115 KB
115 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.zscaler.com/themes/custom/zscaler/vendor/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5538a328926c9517ffb8670fccce94f6137d58c21ff4b10ecd772abfa16a012b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Origin
https://www.zscaler.com

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514351
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
117536
x-request-id
v-63f71828-331d-11ea-9cbc-63c54b27e6b0
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
access-control-allow-origin
*
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9aff38d8c971e-FRA
x-cache-hits
52
BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rm.ttf
fonts.gstatic.com/s/robotoslab/v10/ 		38 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/robotoslab/v10/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rm.ttf
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fe3e7f49ad91c50337d4821bd2750a17513d1ed0b7acbd17aec5b7835113ae9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Origin
https://www.zscaler.com

Response headers

date
Thu, 23 Jan 2020 10:18:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
342485
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
23391
x-xss-protection
0
last-modified
Thu, 14 Nov 2019 22:01:53 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Jan 2021 10:18:45 GMT
BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjo0oSmb2Rm.ttf
fonts.gstatic.com/s/robotoslab/v10/ 		38 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/robotoslab/v10/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjo0oSmb2Rm.ttf
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bf95036dc6eeffa23a4b3f22af6f38cdc49004ea931908cc05af11a45241b72c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Origin
https://www.zscaler.com

Response headers

date
Thu, 19 Dec 2019 20:30:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3329800
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
23487
x-xss-protection
0
last-modified
Thu, 14 Nov 2019 22:02:04 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Dec 2020 20:30:10 GMT
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v20/ 		35 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxP.ttf
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
Origin
https://www.zscaler.com

Response headers

date
Sat, 18 Jan 2020 01:15:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
807077
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20742
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 17 Jan 2021 01:15:33 GMT
collect
www.google-analytics.com/ 		35 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j79&a=1347077320&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&ul=en-us&de=UTF-8&dt=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAgEADQ~&jid=1941341183&gjid=178009223&cid=1699201997.1580117210&tid=UA-6177009-1&_gid=1360401698.1580117210&gtm=2wg1f15SLZFK&z=636817794
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 21 Nov 2019 18:11:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
5757319
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&gjid=178009223&_gid=1360401698.1580117210&_u=aGDAgEADQ~&z=1701302840
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840&slf_rd=1&random=492695311
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840&slf_rd=1&random=492695311
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-6177009-1&cid=1699201997.1580117210&jid=1941341183&_v=j79&z=1701302840&slf_rd=1&random=492695311
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
details
epsilon.6sense.com/v1/company/ 		0
220 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v1/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.44.100 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-44-100.eu-central-1.compute.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
GET
Origin
https://www.zscaler.com
Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers
authorization

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
server
nginx/1.4.6 (Ubuntu)
access-control-allow-origin
https://www.zscaler.com
access-control-max-age
1800
access-control-allow-methods
OPTIONS,GET
status
200
access-control-allow-credentials
true
access-control-allow-headers
authorization
/
c.6sc.co/ 		47 B
371 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
95.100.134.54 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-134-54.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a9a0d18c79372626c3fbd5f4b4b5b1ea817e0a828124803b9da1492fd684abc4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Origin
https://www.zscaler.com

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zscaler.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
img.gif
b.6sc.co/v1/beacon/ 		43 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=ab9750bca4342498694e239e304dd3a9&svisitor=&visitor=bc1af419-50bc-4a96-8485-ea10205e45db&session=90b8b672-84f7-419d-8ef4-e0aabe254391&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Zscaler%20ThreatLabZ%20has%20observed%20a%20rise%20in%20the%20malware%27s%20activity%2C%20which%20was%20detected%20in%20the%20Zscaler%20Cloud%20Sandbox.%20%5C%22Qealler%5C%22%20a%20new%20piece%20of%20malware%2C%20is%20written%20in%20Java%20and%20designed%20to%20silently%20steal%20credentials%20in%20infected%20machines.%20Read%20more.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5C%22Qealler%5C%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler%22%7D&cb=17210373&r=&thirdParty=%7B%7D
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
95.100.134.54 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-134-54.deploy.static.akamaitechnologies.com
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 19 Oct 2018 10:50:03 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"5bc9b6db-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973777747/?random=1580117210375&cv=9&fst=1580117210375&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4dc68873a67e90da506b9bfb1539a274a7e33395eacd74d42ea4bc0cf732bffa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1051
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/812494211/?random=1580117210377&cv=9&fst=1580117210377&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0e997bad0de8de66ac4d8330ce46d500f7d1404a9e5eca846d5a51e15ae5993e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1051
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activity.gif
apt.techtarget.com/activity/ 		43 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=2334982&version=2.0&ref=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&r=1580117210377
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
ETag
"2b-5850384023492"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=76
Content-Length
43
optanon.css
cdn.cookielaw.org/skins/4.7.0/default_responsive_alert_bottom_two_button_white/v2/css/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/skins/4.7.0/default_responsive_alert_bottom_two_button_white/v2/css/optanon.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/consent/75590e24-f605-4d9c-b92c-ca09a93d469f.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lha/8D67) /
Resource Hash
bc14b8a5bdb868d718c59e30703d928b218050d4c2a891d8d85ece159e523b23

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
content-md5
NYS8lY5d5dnS26QwLdV6bA==
age
2126
x-cache
HIT
status
200
content-length
3587
x-ms-lease-status
unlocked
last-modified
Thu, 19 Sep 2019 20:24:15 GMT
server
ECAcc (lha/8D67)
etag
0x8D73D3F576177AF
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
d5e1e544-001e-0170-2bee-d4ed77000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Mon, 27 Jan 2020 13:26:50 GMT
EU
geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/ 		32 B
221 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery34106701322429148875_1580117210133&_=1580117210134
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
55b9aff4ee85c2f9-FRA
content-length
32
icon-enlarge-btn.svg
www.zscaler.com/themes/custom/zscaler/images/resources/ransomware/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/resources/ransomware/icon-enlarge-btn.svg
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
07ccf8d6d38b3753c3420a0d4a9311372de4ad8301dffe9cca751a67f884d923
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1478958
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-encoding
br
x-request-id
v-6f7f7a62-331f-11ea-b0c9-c7fe54829bee
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/svg+xml
expires
Mon, 17 Feb 2020 09:26:50 GMT
cache-control
public, max-age=1814400
cf-ray
55b9aff4ff25971e-FRA
x-cache-hits
30
munchkin.js
munchkin.marketo.net/156/ 		9 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/156/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.176.176 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-176-176.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e6cf48bc1bfd904673cda470939d69e4c555779587d2361e65d03869b26eeebf

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 20:22:41 GMT
Server
Apache
ETag
"24e78e4d5137c385c6e3393d80cfd6bf:1568751761"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4198
Expires
Wed, 06 May 2020 09:26:50 GMT
ipv
cdn.bizible.com/m/ 		43 B
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=c2ab1941263b46d394dcbec8a9f89723&_biz_s=1bf09a&_biz_l=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&_biz_t=1580117210414&_biz_i=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&_biz_n=0&rnd=326486&cdn_o=a&_biz_z=1580117210416
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (lcy/1D2F) / ASP.NET
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
x-aspnet-version
4.0.30319
age
459508
x-powered-by
ASP.NET
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
content-length
43
pragma
no-cache
x-aspnetmvc-version
5.2
last-modified
Wed, 22 Jan 2020 01:48:22 GMT
server
ECS (lcy/1D2F)
content-type
Image/GIF
cache-control
no-cache, no-store
accept-ranges
bytes
expires
-1
/
www.google.com/pagead/1p-user-list/973777747/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/973777747/?random=1580117210375&cv=9&fst=1580115600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&async=1&fmt=3&is_vtc=1&random=4188443118&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/973777747/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/973777747/?random=1580117210375&cv=9&fst=1580115600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&async=1&fmt=3&is_vtc=1&random=4188443118&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/812494211/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/812494211/?random=1580117210377&cv=9&fst=1580115600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&async=1&fmt=3&is_vtc=1&random=1548355598&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/812494211/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/812494211/?random=1580117210377&cv=9&fst=1580115600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg1f1&sendb=1&frm=0&url=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&tiba=%22Qealler%22%20a%20new%20JAR-based%20Information%20Stealer%20%7C%20Zscaler&async=1&fmt=3&is_vtc=1&random=1548355598&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 27 Jan 2020 09:26:50 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
BizibleAcct.js
cdn.bizible.com/ 		378 B
523 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.bizible.com/BizibleAcct.js?_biz_u=c2ab1941263b46d394dcbec8a9f89723&_biz_h=-1906410348&cdn_o=a&jsVer=4.19.11.01
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
610b2e5d59e7e80f080477711d56aaabfb80c4bc9c57a943aff43e37f8ceb9c9

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
x-aspnetmvc-version
5.2
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
etag
9DB49EC1
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
private, must-revalidate, max-age=21600
content-type
text/javascript; charset=utf-8
content-length
325
visitWebPage
306-zej-256.mktoresp.com/webevents/ 		2 B
303 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://306-zej-256.mktoresp.com/webevents/visitWebPage?_mchNc=1580117210455&_mchCn=&_mchId=306-ZEJ-256&_mchTk=_mch-zscaler.com-1580117210455-20877&_mchHo=www.zscaler.com&_mchPo=&_mchRu=%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&_mchPc=https%3A&_mchVr=156&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/156/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
akka-http/10.1.7 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Origin
https://www.zscaler.com

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 27 Jan 2020 09:26:50 GMT
Content-Encoding
gzip
Server
akka-http/10.1.7
Transfer-Encoding
chunked
X-Request-Id
b09d80b6-37c5-45ee-a3fc-2b4a270a0e5a
Content-Type
text/plain; charset=UTF-8
details
epsilon.6sense.com/v1/company/ 		760 B
634 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v1/company/details
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.44.100 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-44-100.eu-central-1.compute.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
d857330b286360ce051b883a13d47c263d9e1160d67dcba3f932aee575fe478f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Origin
https://www.zscaler.com
Authorization
Token d9a28eea7120bf0c47191c72d2fdf42c4de8fc4e

Response headers

date
Mon, 27 Jan 2020 09:26:50 GMT
content-encoding
gzip
server
nginx/1.4.6 (Ubuntu)
status
200
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.zscaler.com
access-control-allow-credentials
true
content-length
438
tracking.png
tracking.leadlander.com/
Redirect Chain
  • https://tracking.leadlander.com/api/tracking?accountId=14146&page=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&referer=&fp=46b0604f6a632a0d294665c9ac...
  • https://tracking.leadlander.com/tracking.png
68 B
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tracking.leadlander.com/tracking.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.56.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-56-60.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
Security Headers
Name Value
Strict-Transport-Security max-age=2592000

Request headers

Referer
https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 27 Jan 2020 09:26:50 GMT
Last-Modified
Wed, 26 Sep 2018 16:48:51 GMT
Server
Kestrel
ETag
"1d455b8cd761bc4"
Strict-Transport-Security
max-age=2592000
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
68

Redirect headers

Location
/tracking.png
Date
Mon, 27 Jan 2020 09:26:50 GMT
Server
Kestrel
Connection
keep-alive
Content-Length
0
Strict-Transport-Security
max-age=2592000
zscaler-cookie-icon-close.png
www.zscaler.com/themes/custom/zscaler/images/shared/OneTrust/ 		236 B
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/OneTrust/zscaler-cookie-icon-close.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d94534aa8cc0c365f7a30e88ec2c02207767496c6f6461244e653b4efbe621b8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:51 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514633
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
236
x-request-id
v-aa5f124c-331e-11ea-a1fe-87198673ab0b
last-modified
Fri, 20 Sep 2019 09:57:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/png
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:51 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9affabd24971e-FRA
x-cache-hits
28
zscaler-cookie-icon-asterik.png
www.zscaler.com/themes/custom/zscaler/images/shared/OneTrust/ 		337 B
542 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.zscaler.com/themes/custom/zscaler/images/shared/OneTrust/zscaler-cookie-icon-asterik.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d53e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50886a52a5df5dc5e0ac727bc7e969b3fe9ccf6b3bb23270c51c23cebbdd6329
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zscaler.com/sites/default/files/css/css_LIOJbKSXBWQQLWRmuossLouWrFA4OA4BypaxYn2IK6c.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Mon, 27 Jan 2020 09:26:51 GMT
via
varnish
x-content-type-options
nosniff
cf-cache-status
HIT
age
1514633
cf-polished
status=not_needed
x-cache
HIT
status
200
strict-transport-security
max-age=31536000; preload
x-ah-environment
prod
content-length
337
x-request-id
v-aa622888-331e-11ea-aecb-ef43a4a9973f
last-modified
Fri, 20 Sep 2019 09:57:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
image/png
cf-bgj
imgq:100
expires
Mon, 17 Feb 2020 09:26:51 GMT
cache-control
public, max-age=1814400
accept-ranges
bytes
cf-ray
55b9affacd26971e-FRA
x-cache-hits
30
cookie-collective-black-overlay.png
cdn.cookielaw.org/skins/4.7.0/default_responsive_alert_bottom_two_button_white/v2/images/ 		84 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.cookielaw.org/skins/4.7.0/default_responsive_alert_bottom_two_button_white/v2/images/cookie-collective-black-overlay.png
Requested by
Host: www.zscaler.com
URL: https://www.zscaler.com/sites/default/files/js/js_iZ2O-irgpS7hl2Gb7gQdYlvCh2LFB5nAdBBb9J1kYLk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.132.202 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lha/8D7F) /
Resource Hash
b5b72b34704b3be1098742f3ed587bdd0d89a423a375a3ad3d067eba623047b5

Request headers

Referer
https://cdn.cookielaw.org/skins/4.7.0/default_responsive_alert_bottom_two_button_white/v2/css/optanon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 27 Jan 2020 09:26:51 GMT
content-md5
eOozn7qowjgmAKNqoTzdJA==
age
14366
x-cache
HIT
status
200
content-length
84
x-ms-lease-status
unlocked
last-modified
Thu, 19 Sep 2019 20:27:25 GMT
server
ECAcc (lha/8D7F)
etag
0x8D73D3FC8D6E3F6
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
6c8bf246-101e-00e8-02d2-d4251d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
expires
Mon, 27 Jan 2020 13:26:51 GMT

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| onYouTubeIframeAPIReady function| processEpsilonData object| _6si object| techtargetic object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| YT object| YTConfig function| onYTReady function| lintrk boolean| _already_called_lintrk number| sf14gv undefined| mystripe function| $ function| jQuery object| drupalSettings object| Drupal function| Popper object| MicroPlugin function| Sifter function| inlineStyles function| URI function| rrssbInit function| Waypoint function| eve string| output function| TimeSpan function| TimePeriod function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry function| Tether function| Selectize object| Morris object| FormValidation object| APP object| UTIL object| customerFilter object| webcastFilter object| MarketoApp object| OneTrust string| containerName string| languageSwitcherFileName string| useDocumentLanguage string| languageSwitcherFilePathPart string| languageSwitcherURL function| getLanguageSwitcherScriptPath function| isLanguageSwitcherFile function| OptanonWrapper object| google_optimize object| $Single_OptIn__c_parent object| $Single_OptIn__c object| $slider object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter boolean| _storagePopulated object| true function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO undefined| a undefined| c function| jsonFeed object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| Bizible object| BizTrackingA object| BizA object| MunchkinTracker string| llfp object| _vis_opt_queue object| LC_API

15 Cookies

Domain/Path Name / Value
www.zscaler.com/ Name: _gd_svisitor
Value: 18a9645f86330000daac2e5e5c000000272a0100
.zscaler.com/ Name: _mkto_trk
Value: id:306-ZEJ-256&token:_mch-zscaler.com-1580117210455-20877
.zscaler.com/ Name: _biz_pendingA
Value: %5B%5D
.zscaler.com/ Name: _biz_nA
Value: 1
www.zscaler.com/ Name: _gd_session
Value: 90b8b672-84f7-419d-8ef4-e0aabe254391
.zscaler.com/ Name: _biz_uid
Value: c2ab1941263b46d394dcbec8a9f89723
.zscaler.com/ Name: _dc_gtm_UA-6177009-1
Value: 1
.www.zscaler.com/ Name: OptanonConsent
Value: landingPath=https%3A%2F%2Fwww.zscaler.com%2Fblogs%2Fresearch%2Fqealler-new-jar-based-information-stealer&datestamp=Mon+Jan+27+2020+10%3A26%3A51+GMT%2B0100+(Central+European+Standard+Time)&version=4.7.0&EU=true&groups=101%3A1%2C1%3A1%2C0_138025%3A1%2C122%3A1%2C2%3A1%2C0_137957%3A1%2C116%3A1%2C0_138118%3A1%2C119%3A1%2C3%3A1%2C0_138119%3A1%2C4%3A1%2C121%3A1%2C0_138125%3A1%2C0_138122%3A1%2C0_192188%3A1%2C0_192175%3A1%2C0_192171%3A1%2C0_138160%3A1%2C0_138127%3A1%2C0_138123%3A1%2C0_192189%3A1%2C0_192172%3A1%2C0_138128%3A1%2C0_192190%3A1%2C0_138129%3A1%2C0_192170%3A1%2C102%3A1%2C103%3A1%2C104%3A1%2C105%3A1%2C106%3A1%2C107%3A1%2C108%3A1%2C109%3A1%2C110%3A1%2C111%3A1%2C112%3A1%2C113%3A1%2C114%3A1%2C115%3A1%2C117%3A1%2C118%3A1%2C120%3A1%2C123%3A1%2C124%3A1%2C125%3A1%2C126%3A1%2C127%3A1%2C128%3A1%2C129%3A1%2C130%3A1
.zscaler.com/ Name: _ga
Value: GA1.2.1699201997.1580117210
.zscaler.com/ Name: _biz_sid
Value: 1bf09a
.www.zscaler.com/ Name: __cfduid
Value: d593686def5388ca4569cad98c5a9976d1580117209
.zscaler.com/ Name: _gid
Value: GA1.2.1360401698.1580117210
.zscaler.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22XDomain%22%3A%221%22%7D
www.zscaler.com/ Name: _gd_visitor
Value: bc1af419-50bc-4a96-8485-ea10205e45db
.zscaler.com/ Name: _gcl_au
Value: 1.1.1051364558.1580117210

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

306-zej-256.mktoresp.com
apt.techtarget.com
b.6sc.co
c.6sc.co
cdn.bizible.com
cdn.cookielaw.org
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
j.6sc.co
munchkin.marketo.net
px.ads.linkedin.com
s.ytimg.com
sjs.bizographics.com
stats.g.doubleclick.net
t.sf14g.com
tracking.leadlander.com
trk.techtarget.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.youtube.com
www.zscaler.com
152.195.132.202
163.171.132.119
172.217.18.162
192.28.144.124
206.19.49.24
2606:4700:10::6814:b844
2606:4700::6813:d53e
2a00:1450:4001:800::200e
2a00:1450:4001:808::2002
2a00:1450:4001:815::2008
2a00:1450:4001:816::200e
2a00:1450:4001:81b::2004
2a00:1450:4001:820::200a
2a00:1450:4001:821::2003
2a00:1450:4001:821::200e
2a00:1450:4001:824::2003
2a00:1450:400c:c0c::9a
2a02:26f0:10c:38f::3adf
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
52.21.56.60
52.57.44.100
54.173.179.199
93.184.220.178
95.100.134.54
95.101.176.176
00d23d732218fe75800d99cb6de1e7ae27f7517d62057782fef92cb038d83f5d
03b742a6efdb17797c84c2b5db25f5cda6a3361fa5e62b98662e321b26f77331
0713b82eeb70267ec6eb59d401260e1dbca6fe8a4c3b9e1d830b8deb8459af5b
07ccf8d6d38b3753c3420a0d4a9311372de4ad8301dffe9cca751a67f884d923
0a97d3e9898dc000c85c7c60b093d02c12e93cfce3a3d36e64c9e262a1a774a8
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
0c2314a9c882eb6997e7199a57ecbbdc628cda32b0d8dd20f193055ef49e71ca
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0e997bad0de8de66ac4d8330ce46d500f7d1404a9e5eca846d5a51e15ae5993e
10a14dc88e6d31f394be3467fc50145060f54fec6758180d5cac3260b23cd11f
1e3482f9a3a582ab789faacf7c391aa49bd21f5f0fd4ca2d8ee8b3951bdb971b
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
263b401a4ec83c1a85ceb67552d812787430be0c9d312a0dfbb0ba57c0dc121a
29797557f2a832d3dccb94f9de057083e4af261cc7073911186c1a907dced7fd
2a6ce7e8796b3ad20ebca195d3424b34e0397063ae0fa76e340ca1c263694f99
2c83896ca4970564102d6466ba8b2c2e8b96ac5038380e01ca96b1627d882ba7
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
36b9d75325e3e2addf711c2024361ef378f94f88a41653641c8f6f836fdb81de
391f4dc402b6ecb016765b0eae6e508d409b577b79e87dd1dbade260d4495581
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
3ce4614edc9c9c4f87bd503b1d0274cd3bfa06eb1d0754aa8ba3f75e1072aa63
3e630c1952503eb5a33e15aad315e03ae9d699c1c03ec1027c234933b37c9671
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
4dc68873a67e90da506b9bfb1539a274a7e33395eacd74d42ea4bc0cf732bffa
50886a52a5df5dc5e0ac727bc7e969b3fe9ccf6b3bb23270c51c23cebbdd6329
52ae784bbd156dfe8f7311c85d5753314cbd9d963ec95a62e6665c99d0268a7b
5538a328926c9517ffb8670fccce94f6137d58c21ff4b10ecd772abfa16a012b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
610b2e5d59e7e80f080477711d56aaabfb80c4bc9c57a943aff43e37f8ceb9c9
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6f6bf99f8e9314c7a993b156d0b9e393a687b003c5b77f3e42a7573d110650cf
7221be22d59bd95b5c1e47590a48d06d367a965213a39ca929241e4a6f9ee7ee
728ad5841f2e6db4e4715e23710cf7b27ad748d0ee71820e2f21bebe3451b330
787e361212d8323feabd26f3dee955db6960983f3b9d18f9cb0bbd348017ef44
824fb9832dee1f034e5162adc0a5324f14cd873470b0a3e413f06d2abdd489cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
840353e97eda0d0721411f79be9b32cf832898137e52e3de834e4a1ccc0f62c8
8521546462c374cd8318bbfbe95ff5c775195d06afb71b4d44eea64a3e42b020
86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd
899d8efa2ae0a52ee197619bee041d625bc28762c50799c074105bf49d6460b9
8b51552f523ecd57ca4f82df5ab10610349f91cacb7c0f72d0290bed3cc37e4e
8f5bc5ffb8a741105348a42379151dc246dfd5648233559418fc8537310b3ff2
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
92dea0037946ab7baf6fa695b397e14e78ab4702a3a1526729ac43c6457fe310
9889de61b49684c87111bcc4c726a73c3e6d799ca8eefa7f3dc109d533e92470
9d4852d4f8f762f926fa78511eb8f45de7afdf20afde77c38e33a3df39bc29c0
9f8f6d28a5dce26b642642a1254c3698680d565bf45926c31c9229cd1935b09d
a35cd326b2cf07e0fa65ddfc1e1845a115d47391f645b05ea89eff473b436a6b
a9a0d18c79372626c3fbd5f4b4b5b1ea817e0a828124803b9da1492fd684abc4
ac68bb7dc5704e99d44c73c67f609a3c8fb6105fae418687b80ec13d9b370114
ac725fc84ab92dddf998effdf46f808138df4b75e3fdf61143e2d7cba844bb0e
ac87ad7a2bef0649ec3f84eebacf1e02bd48647caa281c1da27cc26263abc75b
af3a44157f470a88d48094365d3cc4c191d8fb2dce75fb6c2bed9b88d57a6fb7
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
b46904309f1ba6c5b0a40c3c2d4ea15bb5a1110e2a33d16e35d5961773a68a99
b5b72b34704b3be1098742f3ed587bdd0d89a423a375a3ad3d067eba623047b5
b94ac4868ab5a80127158fe2a26e28c3c7972a5873e3d5a02877c4ccca3cfb6b
bc14b8a5bdb868d718c59e30703d928b218050d4c2a891d8d85ece159e523b23
bf95036dc6eeffa23a4b3f22af6f38cdc49004ea931908cc05af11a45241b72c
c44de212bde358b79a506e193d2884e6bdd2f4a1c8e2a33c5aa6bc76bfe44d5e
c8abaf8f630ae4af089de7c1b5d7d8f54cec867b3ecf76256db2f5a9fffe7c0c
cd3d3c03756f91e7a38de6cedecdd868c2fd3999635cbf008ba22409d63349e8
cdfad57db2880222da0a5b5d756c3e306f7620ff4c3a40bffb351d5182f3e9b7
ce35f5c29247a1196ecea5b3240cfac09bf2a4629a4844bba09d6cd92967e229
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d47ad89bdcc8d61a0168b76474ce044b5d5cd9efe021f26f741881170a2fc1f6
d7dd3f4c3fcd4d440cd3aa820cc4da361dd28a055f0a05bf60dbac778c3528a0
d857330b286360ce051b883a13d47c263d9e1160d67dcba3f932aee575fe478f
d94534aa8cc0c365f7a30e88ec2c02207767496c6f6461244e653b4efbe621b8
d9bf0d990ed8fe52c6b7669baa37e0751da5de711a69a1c009083f734510eb38
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4513908a9872ced2ef23ab364f0cf81a750d278cb46c644b86993ed0107b5d0
e6cf48bc1bfd904673cda470939d69e4c555779587d2361e65d03869b26eeebf
e70adb67bcdec61516ea9e7174456c50effa918e43b3c8663baf1aa762f705de
e9622a721ead53a7e422bf180cb5a0aab8a5190b678bc3a1e1a29bc02a5314e3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe3e7f49ad91c50337d4821bd2750a17513d1ed0b7acbd17aec5b7835113ae9b