www.menlosecurity.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Submission: On October 06 via api (October 6th 2023, 8:08:54 pm UTC) from ES — Scanned from ES

Summary HTTP 234 Redirects Links 36 Behaviour Indicators

Summary

This website contacted 44 IPs in 5 countries across 37 domains to perform 234 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.menlosecurity.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on June 12th 2023. Valid for: a year.

This is the only time www.menlosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
12	2606:4700::68... 2606:4700::6812:83ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:21c... 2600:9000:21c7:b800:13:a3bc:6800:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
20	23.53.43.58 23.53.43.58	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
1	52.222.139.110 52.222.139.110	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:350... 2a02:26f0:3500:16::215:1491	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	184.31.85.59 184.31.85.59	16625 (AKAMAI-AS) (AKAMAI-AS)
6	54.184.63.179 54.184.63.179	16509 (AMAZON-02) (AMAZON-02)
71	13.227.219.60 13.227.219.60	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:249... 2600:9000:2490:ec00:9:14eb:6280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:24c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:129	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	146.75.122.109 146.75.122.109	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c03::9a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
2	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
1	13.227.219.71 13.227.219.71	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:710... 2a02:26f0:7100::5f64:87f1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	44.217.5.70 44.217.5.70	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:220... 2600:9000:2204:8200:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	52.59.43.42 52.59.43.42	16509 (AMAZON-02) (AMAZON-02)
1	185.89.211.12 185.89.211.12	29990 (ASN-APPNEX) (ASN-APPNEX)
4	52.222.139.75 52.222.139.75	16509 (AMAZON-02) (AMAZON-02)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	52.48.140.7 52.48.140.7	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	54.183.36.230 54.183.36.230	16509 (AMAZON-02) (AMAZON-02)
12	54.147.21.139 54.147.21.139	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:8d:... 2a04:4e42:8d::720	54113 (FASTLY) (FASTLY)
234	44

38 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

www.menlosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6812:83ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.menlosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21c7:b800:13:a3bc:6800:93a1 (United States)

ASN16509 (AMAZON-02, US)

hubfront.hushly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 23.53.43.58 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-43-58.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.139.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-110.ams50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:16::215:1491 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.85.59 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-85-59.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.184.63.179 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-184-63-179.us-west-2.compute.amazonaws.com

app.hushly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

71 13.227.219.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-60.ams54.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:ec00:9:14eb:6280:93a1 (United States)

ASN16509 (AMAZON-02, US)

d2i34c80a0ftze.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:24c4 (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:129 (United States)

ASN13335 (CLOUDFLARENET, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.122.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

extend.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c03::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.219.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-71.ams54.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100::5f64:87f1 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.217.5.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-217-5-70.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2204:8200:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.59.43.42 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-43-42.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.211.12 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.139.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-75.ams50.r.cloudfront.net

st.fullcircleinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

281-owv-899.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.48.140.7 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-140-7.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.183.36.230 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-183-36-230.us-west-1.compute.amazonaws.com

csp.menlosecops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 54.147.21.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-21-139.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
flow.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:8d::720 (United States)

ASN54113 (FASTLY, US)

driftt.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
71	driftt.com js.driftt.com — Cisco Umbrella Rank: 6698	859 KB
44	menlosecurity.com www.menlosecurity.com info.menlosecurity.com	1 MB
22	6sc.co j.6sc.co — Cisco Umbrella Rank: 6581 c.6sc.co — Cisco Umbrella Rank: 9925 ipv6.6sc.co — Cisco Umbrella Rank: 6931 b.6sc.co — Cisco Umbrella Rank: 4494	26 KB
12	drift.com bootstrap.api.drift.com — Cisco Umbrella Rank: 7746 metrics.api.drift.com — Cisco Umbrella Rank: 7572 event.api.drift.com — Cisco Umbrella Rank: 8286 targeting.api.drift.com — Cisco Umbrella Rank: 7872 flow.api.drift.com — Cisco Umbrella Rank: 13565	9 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 385	174 KB
7	hushly.com hubfront.hushly.com — Cisco Umbrella Rank: 348912 app.hushly.com — Cisco Umbrella Rank: 87773	219 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 416 www.linkedin.com — Cisco Umbrella Rank: 708 px4.ads.linkedin.com — Cisco Umbrella Rank: 6066	5 KB
5	gstatic.com fonts.gstatic.com	120 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	21 KB
4	fullcircleinsights.com st.fullcircleinsights.com — Cisco Umbrella Rank: 114064	4 KB
4	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 10864	1 KB
4	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2714 www.google.com — Cisco Umbrella Rank: 2	865 B
4	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 stats.g.doubleclick.net — Cisco Umbrella Rank: 98	2 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 49	3 KB
3	google.es www.google.es — Cisco Umbrella Rank: 21165	669 B
3	salesloft.com scout-cdn.salesloft.com — Cisco Umbrella Rank: 11695 scout.salesloft.com — Cisco Umbrella Rank: 14215	4 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 28664 ibc-flow.techtarget.com — Cisco Umbrella Rank: 25250	2 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3987	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 187	89 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 981	9 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 901 script.hotjar.com — Cisco Umbrella Rank: 1101	60 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	197 KB
1	imgix.net driftt.imgix.net — Cisco Umbrella Rank: 18407	918 B
1	menlosecops.com csp.menlosecops.com	159 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 116	185 B
1	hotjar.io content.hotjar.io — Cisco Umbrella Rank: 7121	161 B
1	mktoresp.com 281-owv-899.mktoresp.com	318 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 542	580 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1230	397 B
1	t.co t.co — Cisco Umbrella Rank: 614	376 B
1	vimeocdn.com extend.vimeocdn.com — Cisco Umbrella Rank: 11319	6 KB
1	cloudfront.net d2i34c80a0ftze.cloudfront.net	11 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 792	15 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 655	303 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 250	7 KB
0	zi-scripts.com Failed js.zi-scripts.com Failed
0	twitter.com Failed analytics.twitter.com Failed
234	37

	Domain	Requested by
71	js.driftt.com	www.menlosecurity.com js.driftt.com
38	www.menlosecurity.com	www.menlosecurity.com
15	b.6sc.co	www.menlosecurity.com
12	cdn.cookielaw.org	www.menlosecurity.com cdn.cookielaw.org
6	app.hushly.com	www.menlosecurity.com app.hushly.com
6	info.menlosecurity.com	www.menlosecurity.com info.menlosecurity.com
5	fonts.gstatic.com	fonts.googleapis.com
4	targeting.api.drift.com	js.driftt.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	st.fullcircleinsights.com	d2i34c80a0ftze.cloudfront.net
4	epsilon.6sense.com	j.6sc.co
4	fonts.googleapis.com	www.menlosecurity.com info.menlosecurity.com
3	px.ads.linkedin.com	3 redirects
3	c.6sc.co	j.6sc.co
3	www.google.es	www.menlosecurity.com
2	flow.api.drift.com	js.driftt.com
2	event.api.drift.com	js.driftt.com
2	metrics.api.drift.com	js.driftt.com
2	bootstrap.api.drift.com	js.driftt.com
2	scout.salesloft.com	scout-cdn.salesloft.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	ipv6.6sc.co	j.6sc.co
2	www.google.com	www.menlosecurity.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	region1.analytics.google.com	www.googletagmanager.com
2	munchkin.marketo.net	www.menlosecurity.com munchkin.marketo.net
2	connect.facebook.net	www.menlosecurity.com connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	j.6sc.co	www.menlosecurity.com www.googletagmanager.com
2	www.googletagmanager.com	www.menlosecurity.com www.googletagmanager.com
1	driftt.imgix.net
1	csp.menlosecops.com	www.menlosecurity.com
1	www.facebook.com	www.menlosecurity.com
1	content.hotjar.io	script.hotjar.com
1	281-owv-899.mktoresp.com	munchkin.marketo.net
1	secure.adnxs.com	j.6sc.co
1	px4.ads.linkedin.com	www.menlosecurity.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	script.hotjar.com	static.hotjar.com
1	t.co	www.menlosecurity.com
1	extend.vimeocdn.com	www.googletagmanager.com
1	scout-cdn.salesloft.com	www.menlosecurity.com
1	trk.techtarget.com	www.menlosecurity.com
1	d2i34c80a0ftze.cloudfront.net	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	hubfront.hushly.com	www.menlosecurity.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	cdnjs.cloudflare.com	www.menlosecurity.com
0	js.zi-scripts.com Failed	www.menlosecurity.com
0	analytics.twitter.com Failed	www.menlosecurity.com
234	53

This site contains links to these domains. Also see Links.

Domain
info.menlosecurity.com
resources.menlosecurity.com
jobs.ashbyhq.com
csportal.menlosecurity.com
www.linkedin.com
twitter.com
www.facebook.com
github.com
www.resecurity.com
www.proofpoint.com
learn.microsoft.com
www.boredhackerblog.info
www.darkreading.com
www.microsoft.com
try.menlosecurity.com
www.youtube.com
www.instagram.com
www.onetrust.com

Subject Issuer	Validity	Valid
www.menlosecurity.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-12` - `2024-07-12`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
info.menlosecurity.com Cloudflare Inc ECC CA-3	`2023-03-31` - `2024-03-30`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.hushly.com Amazon RSA 2048 M02	`2023-02-28` - `2023-12-16`	10 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
6sc.co R3	`2023-08-19` - `2023-11-17`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-15` - `2023-10-13`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-18`	a year	crt.sh
*.vimeocdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-18` - `2024-03-21`	a year	crt.sh
*.google.es GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-11-14` - `2023-11-14`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2023-09-21` - `2023-12-20`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
aws-st.fullcircleinsights.com Amazon RSA 2048 M01	`2023-05-30` - `2024-06-26`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M02	`2023-03-02` - `2024-03-30`	a year	crt.sh
csp.menlosecops.com Amazon RSA 2048 M02	`2023-04-27` - `2024-05-26`	a year	crt.sh
*.imgix.com GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-03-05` - `2024-04-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Frame ID: 820347B5DEAA71216D0DC0C5FD30CCEF
Requests: 146 HTTP requests in this frame

Frame: https://info.menlosecurity.com/index.php/form/XDFrame
Frame ID: 5829BCFAA909661F4CB33111FF480544
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
Frame ID: A15469AF600496B324DE899AAE7606D7
Requests: 41 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
Frame ID: 9306395126BE1DEF364D844166AE6C25
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

EvilProxy Phishing Attack Strikes Indeed - Blog | Menlo SecurityBack ButtonFilter Button

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Lodash (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

lodash.*\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

234
Requests

98 %
HTTPS

52 %
IPv6

37
Domains

53
Subdomains

44
IPs

5
Countries

3209 kB
Transfer

8385 kB
Size

43
Cookies

36 Outgoing links

These are links going to different origins than the main page.

URL: https://info.menlosecurity.com/FedRAMP-authorized.html
Title: Learn more

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/all-content/spending-more-and-losing-more-addressing-the-modern-security-conundrum%20
Title: Spending more and losing more: Solving the modern cybersecurity conundrum

Search URL Search Domain Scan URL

URL: https://info.menlosecurity.com/How-cybercriminals-evade-detection-and-compromise-web-browsers-eBook.html
Title: Anatomy of highly evasive threats: 4 ways threat actors are getting past your security stack

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/solution-brief/put-the-security-into-sase
Title: Need to implement SASE, ASAP?

Search URL Search Domain Scan URL

URL: https://info.menlosecurity.com/Examples-and-analysis-of-HEAT-eBook.html
Title: Hiding in plain sight: Examples and analysis of highly evasive threat campaigns

Search URL Search Domain Scan URL

URL: https://info.menlosecurity.com/Menlo-Security_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_eBook
Title: The Ultimate Buyer’s Guide: Zero Trust Network Access

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/all-content
Title: All Resources

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/white-paper
Title: White Papers

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/data-sheet
Title: Data Sheets

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/solution-brief
Title: Solution Briefs

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/case-study
Title: Case Studies / Customer Stories

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/ebook
Title: eBooks

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/reports
Title: Reports

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/video
Title: Videos

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/infographics
Title: Infographics

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/webinars
Title: On-Demand Webinars

Search URL Search Domain Scan URL

URL: https://jobs.ashbyhq.com/menlosecurity
Title: Job Openings

Search URL Search Domain Scan URL

URL: https://csportal.menlosecurity.com/hc/en-us
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/&title=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Search URL Search Domain Scan URL

URL: https://resources.menlosecurity.com/heat-shield/heat-shield-prevent-zero-hour-phishing-attacks
Title: HEAT Shield

Search URL Search Domain Scan URL

URL: https://github.com/fingerprintjs/fingerprintjs/blob/master/src/sources/dom_blockers.ts
Title: https://github.com/fingerprintjs/fingerprintjs/blob/master/src/sources/dom_blockers.ts

Search URL Search Domain Scan URL

URL: https://www.resecurity.com/blog/article/evilproxy-phishing-as-a-service-with-mfa-bypass-emerged-in-dark-web
Title: https://www.resecurity.com/blog/article/evilproxy-phishing-as-a-service-with-mfa-bypass-emerged-in-dark-web

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/email-and-cloud-threats/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level
Title: https://www.proofpoint.com/us/blog/email-and-cloud-threats/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/aspnet/ajax/cdn/overview
Title: https://learn.microsoft.com/en-us/aspnet/ajax/cdn/overview

Search URL Search Domain Scan URL

URL: http://www.boredhackerblog.info/2022/11/looking-for-evilproxy-notes.html
Title: http://www.boredhackerblog.info/2022/11/looking-for-evilproxy-notes.html

Search URL Search Domain Scan URL

URL: https://www.darkreading.com/vulnerabilities-threats/evilproxy-commodifies-reverse-proxy-tactic-phishing-bypassing-2fa
Title: https://www.darkreading.com/vulnerabilities-threats/evilproxy-commodifies-reverse-proxy-tactic-phishing-bypassing-2fa

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/
Title: https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/

Search URL Search Domain Scan URL

URL: https://try.menlosecurity.com/
Title: Try Menlo Free

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/menlo-security/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Menlo-Security-411677528985544/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCN0AikN5dKnhEhmtQddAYqg

Search URL Search Domain Scan URL

URL: https://twitter.com/menlosecurity?lang=en

Search URL Search Domain Scan URL

URL: https://www.instagram.com/menlosecurity/

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 96

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1696622927229%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%252Fblog%252Fevilproxy-phishing-attack-strikes-indeed%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=true&e_ipv6=AQKjiD2Obnw_swAAAYsGm2Ews4ixjOARHVcqF_QNunmbMjvvqn_Cn5tJTkiLxzamBjbL

234 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/ 94 KB
19 KB 1159ms
1060ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

b36f04f424a688d1f2f6371da9ec078aaedd729f623c8ad123e997951f0bf749

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 812089bd8f633150-MAD
content-encoding: br
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-type: text/html; charset=UTF-8
date: Fri, 06 Oct 2023 20:08:45 GMT
link: <https://www.menlosecurity.com/wp-json/>; rel="https://api.w.org/" <https://www.menlosecurity.com/wp-json/wp/v2/posts/5957>; rel="alternate"; type="application/json" <https://www.menlosecurity.com/?p=5957>; rel=shortlink
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains;
vary: Accept-Encoding Accept-Encoding Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-pass-why: custom-path
x-pingback: https://www.menlosecurity.com/xmlrpc.php
x-powered-by: WP Engine

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/ 24 KB
5 KB 129ms
55ms Script
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/OtAutoBlock.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d7cf3e0541293b73d644c724dd833a87c4e9a15566814e97d5d998437d7cb39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 34362
content-md5: RgNWkk/7E9gvfgEYaG7jMA==
content-length: 4485
x-ms-lease-status: unlocked
last-modified: Wed, 27 Sep 2023 00:38:43 GMT
server: cloudflare
etag: 0x8DBBEF21A34E514
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: ec93f19a-f01e-0066-47db-f076a3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089c4ab1d1baf-MAD
expires: Sat, 07 Oct 2023 20:08:45 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 118ms
44ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d62ad0f23c60258f120e52cf68b2e1adff5c1bf5bde5ac8f8d6e5f4c4c64f34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: h6ThlO7ea17v6JNPXbI1zQ==
age: 77070
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6822
x-ms-lease-status: unlocked
last-modified: Thu, 05 Oct 2023 06:23:34 GMT
server: cloudflare
etag: 0x8DBC56B9A6B87F1
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 97221694-301e-000b-33c5-f7c2e8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089c4ab201baf-MAD

GET
H2 200 lodash.min.js Show response
cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/ 18 KB
7 KB 104ms
37ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/lodash.min.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 7864596
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6419
last-modified: Mon, 04 May 2020 16:12:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ed2-464d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gMq4I%2BmIGSInEVNLLxs3sxDkjvUpFROtPbZWFCO5pftlLwzkfE5FnzEbX2SApwiNnHybvXoE7FvsbtflHaBeaSvneneuEpRIAq2Vv%2FPdkOw%2FBKWLOF%2FWDh7obdfoCXAxN2JgX9Hi0bdvZXch0zgvz7RO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 812089c4983837df-MAD
expires: Wed, 25 Sep 2024 20:08:45 GMT

GET
H2 200 autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
www.menlosecurity.com/wp-content/cache/autoptimize/1/css/ 444 KB
64 KB 498ms
497ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4230a318e0da81b2d5a52d7cf1ac911d61974c79cc28ab84040e15a22df36ea

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:45 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 06 Oct 2023 11:56:25 GMT
server: cloudflare
etag: W/"651ff5e9-6ef71"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c42ae33150-MAD

GET
H2 200 dashicons.min.css
www.menlosecurity.com/wp-includes/css/ 58 KB
35 KB 506ms
505ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-includes/css/dashicons.min.css?ver=6.3

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:45 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 03 Mar 2021 21:16:22 GMT
server: cloudflare
etag: W/"603ffca6-e688"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c43ae73150-MAD

GET
H2 200 jquery.min.js Show response
www.menlosecurity.com/wp-includes/js/jquery/ 85 KB
31 KB 509ms
508ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:45 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 26 May 2023 11:33:35 GMT
server: cloudflare
etag: W/"6470990f-155ba"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c43ae93150-MAD

GET
H3 200 icon-search.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/ 384 B
2 KB 484ms
483ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-search.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-180"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d1e3848-MAD

GET
H3 200 icon-close.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/ 577 B
2 KB 452ms
450ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-close.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-241"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d1f3848-MAD

GET
H3 200 Video_DelOroHEAT_NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/ 49 KB
50 KB 600ms
598ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2022/10/Video_DelOroHEAT_NavImg-200x196.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c54a4d70398e66017625cccc15d6d0338b7f64ed0c197083d9c01607a964dba6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 49886
last-modified: Thu, 02 Feb 2023 13:59:16 GMT
server: cloudflare
etag: "63dbc1b4-c2de"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d213848-MAD

GET
H3 200 eBook_Anatomy-of-highly-evasive-threats-Navimg-200x196.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/03/ 7 KB
9 KB 455ms
453ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/03/eBook_Anatomy-of-highly-evasive-threats-Navimg-200x196.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f59ad64243b7d8ea410db10bf3e9b1decd131e24aa59d41b5966b60fc6e33c7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 7520
last-modified: Wed, 29 Mar 2023 12:02:48 GMT
server: cloudflare
etag: "642428e8-1d60"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d223848-MAD

GET
H3 200 eBook_Examples-and-analysis-of-highly-evasice-threat-campaigns-NavImg-200x196.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/03/ 7 KB
9 KB 486ms
484ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/03/eBook_Examples-and-analysis-of-highly-evasice-threat-campaigns-NavImg-200x196.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4cb43a37cc7a0cd47b7267f7d8abc84f6bc0f59fb640a1f8d80394a67a61443

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 7308
last-modified: Wed, 29 Mar 2023 12:02:48 GMT
server: cloudflare
etag: "642428e8-1c8c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d233848-MAD

GET
H3 200 eBook_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_NavImg-200x196.png
www.menlosecurity.com/wp-content/uploads/2022/10/ 56 KB
58 KB 598ms
596ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2022/10/eBook_The-Ultimate-Buyer-Guide-Zero-Trust-Network-Access_NavImg-200x196.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fa14d124f186dd1ee8b0d2564bf1457ebe1fd5d2c971cff7b4ca73ba5ada204

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 57561
last-modified: Thu, 02 Feb 2023 13:59:16 GMT
server: cloudflare
etag: "63dbc1b4-e0d9"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d263848-MAD

GET
H2 200 Menlo_Labs_Nav_image.png
www.menlosecurity.com/wp-content/uploads/2022/10/ 324 KB
325 KB 609ms
609ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2022/10/Menlo_Labs_Nav_image.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa987fcd4cdc8223dadb3967767d387e2c82e1a290c88d92ed90ca84f4dafe56

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 331938
last-modified: Thu, 02 Feb 2023 13:59:14 GMT
server: cloudflare
etag: "63dbc1b2-510a2"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c43aea3150-MAD

GET
H3 200 icon-question.svg
www.menlosecurity.com/wp-content/uploads/2021/05/ 1 KB
2 KB 495ms
493ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2021/05/icon-question.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:35 GMT
server: cloudflare
etag: W/"63dbc1c7-430"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d273848-MAD

GET
H3 200 Email_Contact_Nav.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/ 470 B
2 KB 515ms
513ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/Email_Contact_Nav.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e58a7a5dfea7aa85806f87b03c5c5aa4de018eaddbc7e8b6e61b6ee5f2eaa53

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 470
last-modified: Wed, 27 Sep 2023 12:04:38 GMT
server: cloudflare
etag: "65141a56-1d6"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d2b3848-MAD

GET
H3 200 Phishing_Indeed_blog-thumbnail.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/ 30 KB
32 KB 517ms
515ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/Phishing_Indeed_blog-thumbnail.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc8f587e3095c0c067bc4a0393dc98fd4a795ca73a05c3ab628cfa218521f6c6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 30780
last-modified: Tue, 03 Oct 2023 11:58:45 GMT
server: cloudflare
etag: "651c01f5-783c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d2d3848-MAD

GET
H3 200 Email_Customer-1024x311.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/ 31 KB
32 KB 495ms
493ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/Email_Customer-1024x311.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5579738226ab34a5c3f0d6d9a8dce0935aee53fc9deb02b7426ce417d04124c5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 31686
last-modified: Tue, 03 Oct 2023 11:58:44 GMT
server: cloudflare
etag: "651c01f4-7bc6"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c94d343848-MAD

GET
H3 200 Distribution_of_verticals_targeted_outline.svg
www.menlosecurity.com/wp-content/uploads/2023/09/ 112 KB
14 KB 552ms
550ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2023/09/Distribution_of_verticals_targeted_outline.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ef57649dac2bfdab04aa540057152d57a6c5937af34b635e2dafa4daf705e68

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 03 Oct 2023 11:58:46 GMT
server: cloudflare
etag: W/"651c01f6-1c014"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d353848-MAD

GET
H3 200 Phishing_Attack_Chain_fig2_outline.svg
www.menlosecurity.com/wp-content/uploads/2023/09/ 206 KB
23 KB 558ms
556ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Attack_Chain_fig2_outline.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d72983b238351d09721849a10a2d5d051b2ce68e5584b4955bc77233b5a9426f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 03 Oct 2023 11:58:50 GMT
server: cloudflare
etag: W/"651c01fa-3363f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d363848-MAD

GET
H3 200 Phishing_Redirection_Chain_fig5_outline.svg
www.menlosecurity.com/wp-content/uploads/2023/09/ 100 KB
14 KB 559ms
557ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Redirection_Chain_fig5_outline.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ecf2df4e67c353430286abf942883f821bf53cdd1c9a691c1cc7d42d04a95c3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 03 Oct 2023 11:58:50 GMT
server: cloudflare
etag: W/"651c01fa-18e46"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d383848-MAD

GET
H3 200 email-decode.min.js Show response
www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
871 B 36ms
36ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 05 Oct 2023 12:54:04 GMT
server: cloudflare
etag: W/"651eb1ec-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 812089c80b0f3848-MAD
expires: Sun, 08 Oct 2023 20:08:46 GMT

GET
H2 200 forms2.min.js Show response
info.menlosecurity.com/js/forms2/js/ 208 KB
70 KB 337ms
207ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Sep 2023 05:56:12 GMT
server: cloudflare
etag: "1e01486-34099-604be84687700"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 812089ca0f4637df-MAD
expires: Sat, 07 Oct 2023 00:08:46 GMT

GET
H3 200 autoptimize_ceb1b49bbe7447939b854ea09f58359a.js Show response
www.menlosecurity.com/wp-content/cache/autoptimize/1/js/ 237 KB
65 KB 580ms
578ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_ceb1b49bbe7447939b854ea09f58359a.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e11f14c199be97ad9f7d697f3cc87b50a4286784a0a88fb33588bb1ccfbf591

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 24 Aug 2023 06:31:04 GMT
server: cloudflare
etag: W/"64e6f928-3b37b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c94d393848-MAD

GET
H2 200 1a750de4-f18f-43d4-8b13-4ead3aa824f4.json Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/ 5 KB
2 KB 145ms
81ms XHR
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/1a750de4-f18f-43d4-8b13-4ead3aa824f4.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d73e2d840909264d25d4de2508bda7b8b76a75018b5f40367dc6e3558766ab7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: 0rrE39O9uakc+BAF5tsaSw==
content-length: 1661
x-ms-lease-status: unlocked
last-modified: Wed, 27 Sep 2023 00:38:43 GMT
server: cloudflare
etag: 0x8DBBEF21A44C149
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: a304e6b8-001e-003f-60db-f0f120000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089c58e7a215a-MAD
expires: Sat, 07 Oct 2023 20:08:45 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 303 KB
101 KB 216ms
85ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

89b282ab54cdefb3f4f9f88314b84a51784580ad273b0276363f815da2cdd549

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103169
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 67 B
303 B 123ms
48ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ccfd8491a4f2101549ea6031091edc3616340f714216323f1f604f674749239

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 812089c6889b1bb9-MAD
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202308.2.0/ 421 KB
101 KB 44ms
42ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee39d0cbc9e9cd88b7dac8ebca680b89e8879081f855152f21772c7834474437

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: B7RJGeSCnZZuAb1NQkB81w==
age: 18109
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 103637
x-ms-lease-status: unlocked
last-modified: Wed, 20 Sep 2023 06:26:02 GMT
server: cloudflare
etag: 0x8DBB9A2763B37CA
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 21d158e6-101e-007e-2a3b-eca9c4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089c94a811baf-MAD

GET
H2 200 css2
fonts.googleapis.com/ 10 KB
766 B 189ms
69ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f6595a6cae5eae5be3d15f0f8a7a15ba74bc27f6140b101eb12ae167f598bddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 20:08:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 187ms
68ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 19:42:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
742 B 188ms
68ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b8f578b678ec838f50338b1bc5ad8e4eec8f35bc614f32830a4e00599f4fa749

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 18:56:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H2 200 embed.js Show response
hubfront.hushly.com/ 196 KB
58 KB 781ms
618ms Script
application/javascript 2600:9000:21c7:b800:13:a3bc:6800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hubfront.hushly.com/embed.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21c7:b800:13:a3bc:6800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7c53dc802273a2dbc35c73b0627e8e7a075b979b95a622f8f6b04945079bb55e

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
via: 1.1 1bc76a14967a660022b25f573baec632.cloudfront.net (CloudFront)
last-modified: Thu, 03 Aug 2023 09:55:12 GMT
server: nginx
x-amz-cf-pop: AMS54-C1
etag: W/"64cb7980-31188"
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: GLBNZJEJxCiYRtkJ4G_5i2--61kHfOu5BRD1fcLbFvBE3mFE7AadZg==

GET
H3 200 logo.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/ 5 KB
3 KB 562ms
562ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:26 GMT
server: cloudflare
etag: W/"63dbc1be-134c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c96d563848-MAD

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 203ms
60ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 57714
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 04:06:52 GMT

GET
H3 200 arrow-dropdown.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 207 B
2 KB 560ms
560ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/arrow-dropdown.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-cf"
vary: Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c96d613848-MAD

GET
H3 200 globe-icon-purple.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/ 671 B
2 KB 558ms
557ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon-purple.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8b2d5d8e420ee3d3ac1cbaa1cce0809e1a3d20a9584f7f259d973d328d28d06

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 671
last-modified: Thu, 02 Feb 2023 13:59:26 GMT
server: cloudflare
etag: "63dbc1be-29f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c96d6c3848-MAD

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v29/ 47 KB
47 KB 212ms
74ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 18:18:24 GMT
x-content-type-options: nosniff
age: 93022
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48208
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2024 18:18:24 GMT

GET
H3 200 section-article-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 190 B
2 KB 557ms
557ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-be"
vary: Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c96d703848-MAD

GET
H3 200 section-article-pattern2.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 4 KB
2 KB 558ms
558ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern2.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-1133"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c96d713848-MAD

GET
H3 200 article-single-right-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 569 B
2 KB 557ms
557ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-right-pattern.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-239"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c97d743848-MAD

GET
H3 200 article-single-left-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 595 B
2 KB 558ms
557ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-left-pattern.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-253"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c97d763848-MAD

GET
H3 200 section-contact-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 2 KB
2 KB 558ms
558ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-contact-pattern.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-892"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089c97d773848-MAD

GET
H2 200 zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ 19 KB
19 KB 305ms
171ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 06:49:41 GMT
x-content-type-options: nosniff
age: 47945
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19156
x-xss-protection: 0
last-modified: Tue, 02 May 2023 16:04:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Oct 2024 06:49:41 GMT

GET
H3 200 fa-solid-900.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/ 76 KB
78 KB 601ms
601ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 78196
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: "63dbc1bf-13174"
vary: Accept-Encoding
x-frame-options: DENY
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c97d793848-MAD

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 319ms
186ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 13:37:19 GMT
x-content-type-options: nosniff
age: 541887
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 13:37:19 GMT

GET
H3 200 fa-brands-400.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/ 107 KB
109 KB 599ms
599ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-brands-400.woff2

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 109808
last-modified: Fri, 06 Oct 2023 11:56:15 GMT
server: cloudflare
etag: "651ff5df-1acf0"
vary: Accept-Encoding
x-frame-options: DENY
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c97d7e3848-MAD

GET
H3 200 Illustration-3.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/ 106 KB
107 KB 601ms
600ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/Illustration-3.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

33da1c851e3d9059fb26a83434dcc64cebd5419d7b1c7125b598a8f4a56a7530

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 108468
last-modified: Tue, 03 Oct 2023 11:58:45 GMT
server: cloudflare
etag: "651c01f5-1a7b4"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c9adf13848-MAD

GET
H3 200 Illustration-4-1920x1380.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/ 16 KB
18 KB 527ms
526ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/09/Illustration-4-1920x1380.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0137473b2caef46e3f7d56e7fc3eaad0f4283d75d3db901ecf7cd0fded972cf3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 16402
last-modified: Tue, 03 Oct 2023 11:58:45 GMT
server: cloudflare
etag: "651c01f5-4012"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089c9adf43848-MAD

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/dc74ce06-9a6b-4b0d-b927-351a98b6edc7/ 112 KB
22 KB 88ms
87ms Fetch
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/dc74ce06-9a6b-4b0d-b927-351a98b6edc7/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1c259ad7ec16db8f44cd5a795202083058eaa996e4b3b7a9f29af88c552b41e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: RMUruixokdvVpnETabHx0Q==
content-length: 22519
x-ms-lease-status: unlocked
last-modified: Wed, 27 Sep 2023 00:38:51 GMT
server: cloudflare
etag: 0x8DBBEF21F28A4B1
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 789b672f-401e-00a8-56e1-f0a72d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089c9dd50215a-MAD
expires: Sat, 07 Oct 2023 20:08:46 GMT

GET
H2 200 otFloatingFlat.json Show response
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/ 10 KB
3 KB 76ms
76ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/otFloatingFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: qNZIf2wrV+F9WXKqOQcW5g==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2707
x-ms-lease-status: unlocked
last-modified: Wed, 20 Sep 2023 06:25:55 GMT
server: cloudflare
etag: 0x8DBB9A272682A63
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 381b175a-c01e-0042-7489-f08003000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089ca8eb9215a-MAD

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/v2/ 63 KB
14 KB 72ms
71ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8f71867a6991d5a1ba2b9cd33000e8d8691f6ba8864516946b62087de93aa85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Khkd455ZpdtosraqZ3Qb4w==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13595
x-ms-lease-status: unlocked
last-modified: Wed, 20 Sep 2023 06:25:57 GMT
server: cloudflare
etag: 0x8DBB9A2738A1198
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 664af672-f01e-002b-51db-f0b94f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089ca8eba215a-MAD

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/ 21 KB
4 KB 84ms
84ms Fetch
text/css 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: c7xAZ9MSGAobGaTYg/Qtag==
x-ms-lease-status: unlocked
last-modified: Wed, 20 Sep 2023 06:26:05 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 2fb0a9a8-f01e-0092-11db-f0bd55000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 812089ca8ebb215a-MAD

GET
H2 200 getForm Show response
info.menlosecurity.com/index.php/form/ 22 KB
5 KB 799ms
799ms Script
application/javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://info.menlosecurity.com/index.php/form/getForm?munchkinId=281-OWV-899&form=2571&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&callback=jQuery11240049619363383529125_1696622926649&_=1696622926650
Requested by: Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d08677147d91dbb2607b77428b90c0d2ecc19bb9bd79f09253be2e008517a207

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-form-service-request-id: 117ea#18b069b5c11
x-marketo-source: Form Service
cf-ray: 812089cbd99d37df-MAD
cached: false

GET
H2 200 6si.min.js Show response
j.6sc.co/ 60 KB
16 KB 258ms
63ms Script
application/javascript 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

847df18ba757f7e15431ae68bf68db0b4d4166b5602815468c09420c66bc4cd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 06 Oct 2023 05:56:32 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "651fa190-ef73"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 16308
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H2 200 9d098b8d-9cde-40ee-beab-3b850059beba.js Show response
j.6sc.co/j/ 4 KB
2 KB 650ms
458ms Script
application/javascript 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/9d098b8d-9cde-40ee-beab-3b850059beba.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-43-58.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b28577e9ac71e71f647be12dbed2c7646de798aa5cd64ce2a9648ec6712bec73

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-amz-version-id: Lif_OywgEG7EisXG0oYn6PI3b0vJHXk_
content-encoding: gzip
date: Fri, 06 Oct 2023 20:08:47 GMT
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 1176
pragma: no-cache
last-modified: Tue, 09 May 2023 20:50:47 GMT
server: AmazonS3
etag: "d9652868e053f925c0af63b40eb84154"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: 2yOsZIaLSWdE9EwDJjKe6bm5IK2TnPvhorN-zG56tNiayXtFbqN8uw==
expires: Fri, 06 Oct 2023 20:08:47 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 194ms
59ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230039-FRA

GET
H2 200 hotjar-1854968.js Show response
static.hotjar.com/c/ 10 KB
4 KB 241ms
94ms Script
application/javascript 52.222.139.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1854968.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.139.110 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-139-110.ams50.r.cloudfront.net

Software

Resource Hash

65c83173b67ae74899203be738f66cfe1e21405bf49b9d0670349451c8b74e47

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 552d1a24616d6b8d6e3fbbdf18a54b6a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
etag: W/3911d50e34cb49c367c40198641ee93d
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: hymoplD6GfAVt2gUoyimKGfRbhv-5VpSpBjtdF7DrsQwJsReVmJ4QA==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/ 43 B
571 B 199ms
71ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/?random=1696622926712&cv=11&fst=1696622926712&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&hn=www.googleadservices.com&frm=0&tiba=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&rdp=1&auid=1762760204.1696622927&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 12 KB
4 KB 227ms
72ms Script
application/x-javascript 2a02:26f0:3500:16::215:1491
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1491 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

28a26321734fb5f8c8fe42b5503f162fdf1469bf97e2d9c503a83cc2b3c534cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 05 Sep 2023 13:41:52 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=37138
accept-ranges: bytes
content-length: 3822

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10976805707/ 3 KB
1 KB 197ms
72ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10976805707/?random=1696622926716&cv=11&fst=1696622926716&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&hn=www.googleadservices.com&frm=0&tiba=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&auid=1762760204.1696622927&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0f13ed756ef9286099a3b05ddbd538aa467fddaff881bb261fe8d40615005f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1367
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 198 KB
53 KB 183ms
59ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 06 Oct 2023 20:08:46 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 53356
x-xss-protection: 0
pragma: public
x-fb-debug: 2jJk+3l/BAnIk6eAxy3kqpAFGDA3Dhs9AA8mvySKisPsjOSWKJi2utRci6CX50vP9e3SNASUygDRpiXo0Uk2dQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 202ms
63ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Fri, 06 Oct 2023 20:08:46 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 widget.js Show response
app.hushly.com/runtime/ 1 KB
2 KB 615ms
206ms Script
text/javascript 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/runtime/widget.js?aid=83162
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 517381e9702df6a6b6bf7921e93447d4b7d626a45fc55d31934a8392946b79c5

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-type: text/javascript;charset=utf-8
pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 trrsm2wf4gwm.js Show response
js.driftt.com/include/1696623000000/ 215 KB
61 KB 326ms
193ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1696623000000/trrsm2wf4gwm.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6b59be2f48490e7fab65a6fa43c99851ed0026b9c651ffa9937f49ad57cc2a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-amz-version-id: l.B85eaiR5sX7u8JchWT4_t6lV2e1Zf2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 27
last-modified: Tue, 19 Sep 2023 20:16:03 GMT
server: istio-envoy
etag: W/"cfd0f6983bb181a781dd1c9ca318f995"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gE1A3Z1o5ICkBkijOAq5kEIjl9ZDTcsZTCF5IFRmE_v-AFeCBuNQVQ==

GET
H2 200 fullcircle.js Show response
d2i34c80a0ftze.cloudfront.net/ 32 KB
11 KB 207ms
72ms Script
application/json 2600:9000:2490:ec00:9:14eb:6280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:ec00:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5f8ece9fc3c316bd78480ef2f48dc82b47f84a1a2a39ddd4a0fec27a720cae41

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 09:02:46 GMT
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront), 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-C1, FRA56-P6
age: 39961
x-amzn-requestid: 2ac319fd-d459-4c8c-92a6-4b7168b4335f
x-amzn-trace-id: Root=1-651fcd36-4292342d4e53a1c7015b4ac1;Sampled=0;lineage=be50798f:0
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: MX0AjFa8vHcFRcA=
x-amz-cf-id: K9arIJRihQoHWUD_6Yn63JIkH_S7_TS7tEa3XrcUeY9rkeXfRiFFBw==

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 142ms
48ms Script
text/javascript 2606:4700:4400::6812:24c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trk.techtarget.com/tracking.js
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:24c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
server: cloudflare
age: 10301
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 812089cdf87f1bb7-MAD
expires: Fri, 06 Oct 2023 20:28:47 GMT

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 181ms
41ms Script
application/javascript 2606:4700::6811:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://scout-cdn.salesloft.com/sl.js

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:129 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 891XYQ22KSJ498EG
age: 3052
alt-svc: h3=":443"; ma=86400
x-amz-id-2: YL7eAJCZSxDUI4ChxTCJMmxmHZ7+ooY9394g8JxTGDNgJiaKQZj+iX0ljpkW7HGKWoQfsmuXYqI=
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: cloudflare
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 812089ce5be02fa1-MAD
expires: Sat, 07 Oct 2023 00:08:47 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 299 KB
95 KB 83ms
82ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a1df262a204435f75a376f9306eb4095b7ceb8373bfdcdb7a191394e4410a3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97643
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 06 Oct 2023 20:08:46 GMT

GET
H3 200 footer-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/ 657 B
2 KB 490ms
490ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/footer-pattern.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:27 GMT
server: cloudflare
etag: W/"63dbc1bf-291"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089cc29e23848-MAD

GET
H3 200 logo-footer.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/ 4 KB
3 KB 186ms
186ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo-footer.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:46 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Feb 2023 13:59:26 GMT
server: cloudflare
etag: W/"63dbc1be-105f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 812089cc29e33848-MAD

GET
H3 200 globe-icon.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/ 2 KB
4 KB 491ms
491ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1a125e0538c7f978c8ca3c7c591a7309c25eb9d3231b04931d1df36980b39c3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_45c4b007adf17cc0df8a8f2cc71c7c6f.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 2060
last-modified: Thu, 02 Feb 2023 13:59:26 GMT
server: cloudflare
etag: "63dbc1be-80c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089cc29e43848-MAD

GET
H2 200 79031691.js Show response
extend.vimeocdn.com/ga/ 17 KB
6 KB 195ms
61ms Script
text/javascript 146.75.122.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://extend.vimeocdn.com/ga/79031691.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.122.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Apache /
Resource Hash: 6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-cache-hits: 57914
date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
via: 1.1 varnish
age: 30289531
x-cache: HIT
content-length: 5579
x-served-by: cache-fra-etou8220112-FRA
last-modified: Thu, 20 Oct 2022 22:49:15 GMT
server: Apache
x-timer: S1696622927.120324,VS0,VE0
etag: "421e-5eb7f2274b0c0-gzip"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
x-vimeo-dc: ge
x-bapp-server: assets-769d499c7b-6rkpw
cache-control: max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Oct 2032 06:23:15 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 138ms
53ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je3a40&_p=94103696&_gaz=1&cid=2029641293.1696622927&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1696622926&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&dt=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 212ms
77ms Ping
text/plain 2a00:1450:400c:c03::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-C2G0PCSJKE&cid=2029641293.1696622927&gtm=45je3a40&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.es/ads/ 42 B
107 B 219ms
99ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.es/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-C2G0PCSJKE&cid=2029641293.1696622927&gtm=45je3a40&aip=1&z=1057927812

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Browsing_Blind_Blog.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/07/ 28 KB
29 KB 484ms
484ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/07/Browsing_Blind_Blog.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_ceb1b49bbe7447939b854ea09f58359a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

017c3225be669ab0ea7c4536450f6ab9eeee60e41e33058cf7d6cb16f18d7cfa

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 28492
last-modified: Mon, 10 Jul 2023 12:05:57 GMT
server: cloudflare
etag: "64abf425-6f4c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089cdfcb33848-MAD

GET
H3 200 VLOG%E2%80%94Unmasking-Common-web-browser-vulnerabilities-targeted-by-attackers.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/07/ 35 KB
36 KB 451ms
450ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/07/VLOG%E2%80%94Unmasking-Common-web-browser-vulnerabilities-targeted-by-attackers.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_ceb1b49bbe7447939b854ea09f58359a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

efe0158313c7c4a51647245388b73eed8e7f7a24fedb59fc82d43279050ba1c8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 35610
last-modified: Thu, 20 Jul 2023 12:08:01 GMT
server: cloudflare
etag: "64b923a1-8b1a"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089cdfcb53848-MAD

GET
H3 200 Menlo_Browser-Extensions_Dangers_blog.png.webp
www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/08/ 22 KB
23 KB 452ms
452ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.menlosecurity.com/wp-content/webp-express/webp-images/uploads/2023/08/Menlo_Browser-Extensions_Dangers_blog.png.webp

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_ceb1b49bbe7447939b854ea09f58359a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3db29c686974ac99facae2d3fe9d4c7a5e077ed35accbf9be4ea40f3398b3b4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://*.gartner.com https://*.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://*.vimeocdn.com https://*.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://*.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://*.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.clickagy.com https://googletagmanager.com https://*.brighttalk.com https://player.vimeo.com https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains;
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 22286
last-modified: Thu, 24 Aug 2023 11:47:18 GMT
server: cloudflare
etag: "64e74346-570e"
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 812089cdfcb63848-MAD

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 41ms
40ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 73629
x-ms-lease-status: unlocked
last-modified: Thu, 05 Oct 2023 06:23:39 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 9b314a72-701e-0025-6059-f790ff000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 812089ce29d41baf-MAD

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
510 B 74ms
74ms Fetch
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
x-ms-lease-status: unlocked
last-modified: Thu, 05 Oct 2023 06:23:38 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 343d3bb7-e01e-0037-06a7-f7eb2f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 812089ce2be1215a-MAD

GET
H2 200 Logo_MenloSecurity_Signature_Purple_RGB.png
cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/ 12 KB
12 KB 44ms
44ms Image
image/png 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/Logo_MenloSecurity_Signature_Purple_RGB.png

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: lwzbnoHyDnRH4s89KRrv8A==
age: 34362
content-length: 12496
x-ms-lease-status: unlocked
last-modified: Tue, 29 Jun 2021 19:44:30 GMT
server: cloudflare
etag: 0x8D93B364FFCA162
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 7ebec280-801e-0047-33e1-5a078d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 812089ce39fa1baf-MAD

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 45ms
45ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 76468
x-ms-lease-status: unlocked
last-modified: Thu, 05 Oct 2023 06:23:39 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8dae64dd-f01e-0092-0ab6-f7bd55000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 812089ce39fe1baf-MAD

GET
H2 200 adsct
t.co/i/ 43 B
376 B 367ms
233ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=da313c89-98b3-426e-9d79-ad097d2770d4&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de116faa-52fa-4ba3-b4b5-5286ed0b99a3&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-response-time: 172
date: Fri, 06 Oct 2023 20:08:46 GMT
strict-transport-security: max-age=0
server: tsa_f
content-type: image/gif;charset=utf-8
x-transaction-id: 802473c794a33e01
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 1b64ade21d0d0ebe7555c657d081daba1da774f35474e4100c81118e95a0cca5
content-length: 43

GET adsct
analytics.twitter.com/i/ 0
0

GET
H2 200 1626328370711236 Show response
connect.facebook.net/signals/config/ 136 KB
35 KB 272ms
272ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1626328370711236?v=2.9.132&r=stable&domain=www.menlosecurity.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef3162a29ec6486e3baa2b24b6cc4fe0ac4dabf9068d4b458b114ebfaaea1abd

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 06 Oct 2023 20:08:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: rzEshhul/MpO138WRbSKWM/Ds0vkQxs2WibhDtF8yNL3RJCPvK3smjf+7O8tCGm3782G2LkrnqvPRWEjVpk9BA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10976805707/ 42 B
455 B 236ms
84ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10976805707/?random=1696622926716&cv=11&fst=1696622400000&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&frm=0&tiba=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&fmt=3&is_vtc=1&random=1600822992&rmt_tld=0&ipr=y

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.es/pagead/1p-user-list/10976805707/ 42 B
455 B 71ms
70ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.es/pagead/1p-user-list/10976805707/?random=1696622926716&cv=11&fst=1696622400000&bg=ffffff&guid=ON&async=1&gtm=45He3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&frm=0&tiba=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&fmt=3&is_vtc=1&random=1600822992&rmt_tld=1&ipr=y

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 245ms
244ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Fri, 06 Oct 2023 20:08:47 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sun, 14 Jan 2024 20:08:47 GMT

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 75ms
75ms Script
application/x-javascript 2a02:26f0:3500:16::215:1491
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1491 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 28 Aug 2023 12:14:15 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=61025
accept-ranges: bytes
content-length: 4862

GET
H2 200 modules.9b99185f84da153d26eb.js Show response
script.hotjar.com/ 226 KB
55 KB 190ms
64ms Script
application/javascript 13.227.219.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.9b99185f84da153d26eb.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.71 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-71.ams54.r.cloudfront.net

Software

Resource Hash

09048873cebefcb0b837c6962a0a053ef6700472bd37ff9b049e9b73e684f1ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 13:20:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 edd6d90087c4f2b49e182778a2273adc.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 24521
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56061
last-modified: Fri, 06 Oct 2023 13:19:11 GMT
etag: "9dacd935854d62b77318d5bf10d72c47"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Mw3my4A0nEgGAFKaY5MBe17fcuTQtPkQeUFaGP-d2hqBrH9QGIwxFQ==

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 86ms
60ms XHR
text/html 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-43-58.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 17 B
310 B 293ms
66ms XHR
text/html 2a02:26f0:7100::5f64:87f1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::5f64:87f1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e393c611c654ea00ed25aff28de5cad1e84d0b18e44f1b894472df7a84c32a5

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:23:d::12
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1696622927288_1600423917_179695484_119_732_61_0_219";dur=1
content-length: 17
expires: Fri, 06 Oct 2023 20:08:47 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 272ms
262ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22978e5d07c2a3a90aa4884115fca62376%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22cb6b946368e1bb01c6dac9732a72e3bc7e1fdd12%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
471 B 152ms
151ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1696622927154&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 16648054
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
via: 1.1 google
x-guploader-uploadid: ADPycdu35172zYSu2sMbYwVZx8LB23IO2YUJyVhN0KIB4uDxZbU8bpHMEaGrir1HjX-NdhP6ksYRFV9UNFLck-n_AM0fjNqTsEdH
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Fri, 06 Oct 2023 21:08:47 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 230ms
141ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=16648054&r=1696622927154&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 06 Oct 2023 20:08:47 GMT
expires: Fri, 06 Oct 2023 20:08:47 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ADPycdtP_WqXHngm-0pYRRWXz4wKM-CBhm0jX_LRW3ZKu6MiOvT3fQPB-h0E_GOeykoa2XBOMZURUXFfSGWG-DXu8FZlWjMTWEVz

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
361 B 346ms
110ms XHR
application/json 44.217.5.70
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDE5Njd9.V7I-NpOKgrht5OkLlxuCbuX4T0bDGUNKoOfji96SmgY

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.217.5.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-217-5-70.compute-1.amazonaws.com

Software

Resource Hash

aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: d6c282472cab9909022720303de7935a

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/474058/domain/menlosecurity.com/ 36 B
397 B 210ms
66ms XHR
application/json 2600:9000:2204:8200:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/474058/domain/menlosecurity.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:8200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 01 Oct 2023 21:12:01 GMT
content-encoding: gzip
via: 1.1 182732bb63f7d4f88e7cac0874b0cfee.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
age: 428206
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=86400
x-amz-cf-id: SA8UrdlLH4d-LmK_d05CGRvFWqTclMGb-kuVuYT7eDU-3QVLwjtbmQ==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1696622927229%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=tr...

0
266 B

328ms
184ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=true&e_ipv6=AQKjiD2Obnw_swAAAYsGm2Ews4ixjOARHVcqF_QNunmbMjvvqn_Cn5tJTkiLxzamBjbL
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D81FD8E1195849F1B45C1DD9977A5B2E Ref B: MAD30EDGE0707 Ref C: 2023-10-06T20:08:48Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYHEc74NCp5ssu3k/ga3Q==

Redirect headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C71ABEBB43CC4317BC1E0A5E81FEAD8A Ref B: MAD30EDGE0412 Ref C: 2023-10-06T20:08:48Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1696622927229&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&cookiesTest=true&liSync=true&e_ipv6=AQKjiD2Obnw_swAAAYsGm2Ews4ixjOARHVcqF_QNunmbMjvvqn_Cn5tJTkiLxzamBjbL
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYHEc7zji4hEvFN3gUWRg==

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 722 B
574 B 394ms
263ms XHR
application/json 52.59.43.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.43.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-43-42.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a06e74d8087e82597aa565a8641337658c9c1b32eeecd24a4ea5671e95d236bd

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
Authorization: Token cb6b946368e1bb01c6dac9732a72e3bc7e1fdd12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
X-6s-CustomID: WebTag1.0 978e5d07c2a3a90aa4884115fca62376

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
content-length: 385

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 190ms
60ms Preflight 52.59.43.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.43.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-43-42.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.menlosecurity.com
access-control-max-age: 1800
date: Fri, 06 Oct 2023 20:08:47 GMT
server: nginx

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
580 B 187ms
65ms XHR
application/json 185.89.211.12
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
an-x-request-uuid: 0492728e-3846-49ea-9422-4c18d18c926f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.183.106.148; 185.183.106.148; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 59ms
59ms XHR
text/html 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-43-58.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 252ms
251ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22978e5d07c2a3a90aa4884115fca62376%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22209%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 262ms
262ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22cdcc21c50eb45b5f1adbb9f4723fd8296ded280b%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22210%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 270ms
270ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22211%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 256ms
256ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22212%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 473ms
473ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%229d098b8d-9cde-40ee-beab-3b850059beba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22212%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 439ms
439ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22212%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 276ms
275ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=s_update&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Fri%2C%2006%20Oct%202023%2020%3A08%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%22214%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

OPTIONS
H2 200 create
st.fullcircleinsights.com/v1/visitors/ Frame 0
0 625ms
457ms Preflight
application/json 52.222.139.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-75.ams50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.menlosecurity.com
content-length: 1
content-type: application/json
date: Fri, 06 Oct 2023 20:08:47 GMT
via: 1.1 fd4c476aa3616f643565cbbf3a891a78.cloudfront.net (CloudFront)
x-amz-apigw-id: MZVkhHLSvHcFViQ=
x-amz-cf-id: Ps4ynSjjWKbrXE83B-hnyUk609XpSPwrtSa_7W57Svd3I1PPuhLfwA==
x-amz-cf-pop: AMS50-C1
x-amzn-requestid: 9ed89b4e-8340-4289-be7a-1821e219c14e
x-cache: Miss from cloudfront

POST
H2 200 create Show response
st.fullcircleinsights.com/v1/visitors/ 1 KB
2 KB 572ms
571ms XHR
application/json 52.222.139.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visitors/create
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-75.ams50.r.cloudfront.net
Software: /
Resource Hash: 5aaf5321af8262d7cb4fd75f55f36147846fa26b0da1b9c8f89941a93cc7c6fb

Request headers

origin-fci: https://www.menlosecurity.com
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
js-version: 1.0.59
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
x-api-key: uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 06 Oct 2023 20:08:48 GMT
via: 1.1 fd4c476aa3616f643565cbbf3a891a78.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
x-amzn-trace-id: Root=1-65206950-69948a2a417fa1f506e263ad;Sampled=0;lineage=7c392b7c:0
x-amzn-requestid: df04dc29-cdf7-4387-8088-a143b049499d
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
x-amz-apigw-id: MZVkmFZ8vHcFQWw=
content-length: 1426
x-amz-cf-id: _WSy4Knm7edadmQc4E-YfGeKzhQD9TqWUyrAxdKfRAOZXNZdBS4QQw==

GET
H2 200 / Show response
c.6sc.co/ 7 B
197 B 60ms
59ms XHR
text/html 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-43-58.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 17 B
311 B 73ms
65ms XHR
text/html 2a02:26f0:7100::5f64:87f1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::5f64:87f1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e393c611c654ea00ed25aff28de5cad1e84d0b18e44f1b894472df7a84c32a5

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:47 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.menlosecurity.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:23:d::12
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1696622927414_1600423917_179695485_17_799_61_126_219";dur=1
content-length: 17
expires: Fri, 06 Oct 2023 20:08:47 GMT

POST
H/1.1 200
OK visitWebPage
281-owv-899.mktoresp.com/webevents/ 2 B
318 B 1402ms
215ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://281-owv-899.mktoresp.com/webevents/visitWebPage?_mchNc=1696622927399&_mchCn=&_mchId=281-OWV-899&_mchTk=_mch-menlosecurity.com-1696622927398-39242&_mchHo=www.menlosecurity.com&_mchPo=&_mchRu=%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date: Fri, 06 Oct 2023 20:08:48 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: bbece9d4-b44c-41c7-b44b-49a647167cf1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 266ms
265ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A23%3Ad%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.7

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 562ms
207ms XHR
application/json 52.48.140.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.9b99185f84da153d26eb.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.48.140.7 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-48-140-7.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: fee4d039e94ad990d7dda71ba3c31837e903239eeeaa3fb8421052b6e3d7e5f3

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Fri, 06 Oct 2023 20:08:48 GMT
content-length: 56
vary: Origin
content-type: application/json

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
468 B 110ms
109ms XHR
application/json 44.217.5.70
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.217.5.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-217-5-70.compute-1.amazonaws.com

Software

Resource Hash

0eccd324a6b84c9c53f0f4c1c29243742cd3e18241e4ea759f6b731c57d40163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.menlosecurity.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 065b8063a7d0d3e6654c7390d972ee75

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 722 B
575 B 2589ms
2569ms XHR
application/json 52.59.43.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.43.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-43-42.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d3d4743801b05f2c918e65a6244cb6eebe0c4cc728c69a1383795cb3bc4b2ee4

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
Authorization: Token cdcc21c50eb45b5f1adbb9f4723fd8296ded280b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
X-6s-CustomID: WebTag 9d098b8d-9cde-40ee-beab-3b850059beba

Response headers

date: Fri, 06 Oct 2023 20:08:50 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
access-control-allow-credentials: true
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 60ms
59ms Preflight 52.59.43.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.43.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-43-42.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.menlosecurity.com
access-control-max-age: 1800
date: Fri, 06 Oct 2023 20:08:47 GMT
server: nginx

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 396ms
56ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1626328370711236&ev=PageView&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&rl=&if=false&ts=1696622927557&sw=1600&sh=1200&v=2.9.132&r=stable&ec=0&o=30&fbp=fb.1.1696622927554.430304572&cs_est=true&ler=empty&it=1696622927137&coo=false&exp=a0&rqm=GET

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 06 Oct 2023 20:08:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 forms2.css
info.menlosecurity.com/js/forms2/css/ 13 KB
3 KB 332ms
331ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/css/forms2.css

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Sep 2023 05:56:12 GMT
server: cloudflare
etag: "1e0143f-3437-604be84687700"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 812089d168de37df-MAD
content-length: 2623
expires: Sat, 07 Oct 2023 00:08:47 GMT

GET
H2 200 forms2-theme-plain.css
info.menlosecurity.com/js/forms2/css/ 828 B
365 B 331ms
330ms Stylesheet
text/css 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Sep 2023 05:56:12 GMT
server: cloudflare
etag: "1e01442-33c-604be84687700"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 812089d168e137df-MAD
content-length: 246
expires: Sat, 07 Oct 2023 00:08:47 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
651 B 69ms
68ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c127a7f93d3ea162c7086632dba913392b83faf29d513c9952f32ead527a2f41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 06 Oct 2023 19:49:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 06 Oct 2023 20:08:47 GMT

GET
BLOB 200
OK 8b158635-3875-481a-92e8-897a2eba3f4c
https://www.menlosecurity.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://www.menlosecurity.com/8b158635-3875-481a-92e8-897a2eba3f4c
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: es-ES,es;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 widget-6ea6e06aafd7e8688a9682af475fc7db.js Show response
app.hushly.com/assets/ 423 KB
126 KB 515ms
514ms Script
application/javascript 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/assets/widget-6ea6e06aafd7e8688a9682af475fc7db.js
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/runtime/widget.js?aid=83162
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 50727bb494fe5a7a0caa0f700d257698e7b4cc84171e6658ba286a1e42f59178

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:47 GMT
content-encoding: gzip
last-modified: Sat, 09 Sep 2023 08:46:16 GMT
etag: "widget-6ea6e06aafd7e8688a9682af475fc7db.js"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
cache-control: public, max-age=31536000
content-length: 128357

GET
H2 200 1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
fonts.gstatic.com/s/raleway/v29/ 22 KB
22 KB 281ms
280ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v29/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ec1e2ebe080ec8fbfbdc7dd9c0c25449e1d98e4e947c11a00fd770d8841698b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.menlosecurity.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 18:39:44 GMT
x-content-type-options: nosniff
age: 91743
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22420
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:56:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Oct 2024 18:39:44 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 192ms
59ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 06 Oct 2023 19:51:33 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1035
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 06 Oct 2023 21:51:33 GMT

GET
H2 200 XDFrame Show response
info.menlosecurity.com/index.php/form/ Frame 5829 2 KB
761 B 200ms
200ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/index.php/form/XDFrame

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 812089d41cf237df-MAD
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 06 Oct 2023 20:08:48 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
213 B 67ms
67ms XHR
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=94103696&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&ul=en-us&de=UTF-8&dt=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=990670548&gjid=149658365&cid=2029641293.1696622927&tid=UA-41161362-2&_gid=1293776008.1696622928&_r=1&_slc=1&gtm=45He3a40n81WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1795983161

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 256ms
256ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:48 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 53ms
53ms XHR
text/plain 2a00:1450:400c:c03::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-41161362-2&cid=2029641293.1696622927&jid=990670548&gjid=149658365&_gid=1293776008.1696622928&_u=YADAAEAAAAAAACAAI~&z=933627400

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c03::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

94dcf5556e059d9e35d347a9fdd7c295ec5d8001d8c00693dfc2a7d18f9fb0f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 06 Oct 2023 20:08:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.min.js Show response
info.menlosecurity.com/js/forms2/js/ Frame 5829 208 KB
69 KB 48ms
48ms Script
application/x-javascript 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.menlosecurity.com/js/forms2/js/forms2.min.js

Requested by

Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://info.menlosecurity.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 07 Sep 2023 05:56:12 GMT
server: cloudflare
age: 2
etag: "1e01486-34099-604be84687700"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 812089d56e8d37df-MAD
expires: Sat, 07 Oct 2023 00:08:48 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 111ms
110ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-41161362-2&cid=2029641293.1696622927&jid=990670548&_u=YADAAEAAAAAAACAAI~&z=1148115446

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.es/ads/ 42 B
107 B 94ms
94ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.es/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-41161362-2&cid=2029641293.1696622927&jid=990670548&_u=YADAAEAAAAAAACAAI~&z=1148115446

Requested by

Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widget-365e4fc9661820c90743b852a36fef3c.css
app.hushly.com/assets/ 69 KB
12 KB 195ms
195ms Stylesheet
text/css 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/assets/widget-365e4fc9661820c90743b852a36fef3c.css
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-6ea6e06aafd7e8688a9682af475fc7db.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: d8b080802cba44025db6515c924fd17cfba0f2d9123093aaa779d43f8a04a522

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:48 GMT
content-encoding: gzip
last-modified: Sat, 09 Sep 2023 08:46:16 GMT
etag: "widget-365e4fc9661820c90743b852a36fef3c.css"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
cache-control: public, max-age=31536000
content-length: 11756

POST
H2 200 83162 Show response
app.hushly.com/runtime/widgets/ 60 B
782 B 636ms
253ms XHR
application/json 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/runtime/widgets/83162
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-6ea6e06aafd7e8688a9682af475fc7db.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: a8331d520e307081359e060643052b00e5529d0062b5ce516c251f4da1b9fae2

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://www.menlosecurity.com
date: Fri, 06 Oct 2023 20:08:49 GMT
content-encoding: gzip
access-control-allow-credentials: true
x-robots-tag: noindex
vary: Accept-Encoding
content-type: application/json

GET
H2 200 83162 Show response
app.hushly.com/runtime/visitor/ 40 B
642 B 212ms
212ms Script
text/javascript 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/runtime/visitor/83162?callback=hushlyVisitorCallback&sid=b1084e65-f1c6-48c7-a6f7-cad01b287b24&vid=3465632c-a39e-48c6-90fc-ba333375d0f5&version=2&hly-ip-address=&_=1696622928483
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-6ea6e06aafd7e8688a9682af475fc7db.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 02837c1c83835a7fa5c081c8a7a00db394bb0d3a742eb15cca5db3d8845fd596

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:48 GMT
cache-control: max-age=31536000, public
content-encoding: gzip
x-robots-tag: noindex
vary: Accept-Encoding
content-type: text/javascript

OPTIONS
H2 200 queue
st.fullcircleinsights.com/v1/visits/ Frame 0
0 591ms
591ms Preflight
application/json 52.222.139.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-75.ams50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: js-version,origin-fci,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.menlosecurity.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods: OPTIONS,POST
access-control-allow-origin: https://www.menlosecurity.com
content-length: 1
content-type: application/json
date: Fri, 06 Oct 2023 20:08:48 GMT
via: 1.1 fd4c476aa3616f643565cbbf3a891a78.cloudfront.net (CloudFront)
x-amz-apigw-id: MZVksFD9PHcFqzw=
x-amz-cf-id: 3oU8du4n-zGcJpTY0gb4VXntXV35SdNBcr_0bNTKdUV7QEAldlb9dA==
x-amz-cf-pop: AMS50-C1
x-amzn-requestid: 4f4d2458-bb9c-4a45-9f39-6a64718ed636
x-cache: Miss from cloudfront

POST
H2 200 queue Show response
st.fullcircleinsights.com/v1/visits/ 2 KB
2 KB 518ms
517ms XHR
application/json 52.222.139.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://st.fullcircleinsights.com/v1/visits/queue
Requested by: Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-75.ams50.r.cloudfront.net
Software: /
Resource Hash: 0dd8dd2d9dd64be26e1131ac6585c4325fdf043a546cb1479a6e6835574dfb56

Request headers

origin-fci: https://www.menlosecurity.com
Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
js-version: 1.0.59
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
x-api-key: uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 06 Oct 2023 20:08:49 GMT
via: 1.1 fd4c476aa3616f643565cbbf3a891a78.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
x-amzn-trace-id: Root=1-65206951-1ff3acc23b0bd7de70af213d;Sampled=0;lineage=adebd93c:0
x-amzn-requestid: 64a1deda-3c26-453f-b26c-c171b65f12ca
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: https://www.menlosecurity.com
x-amz-apigw-id: MZVkyH8MPHcF1Kw=
content-length: 2040
x-amz-cf-id: PDJ2yu74jv251R2An9Wd61Gn4lz8VdmDM0BwLlEmtmX66U3KPlSOWA==

GET
H2 200 core Show response
js.driftt.com/ Frame A154 2 KB
1 KB 162ms
162ms Document
text/html 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1696623000000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

014c54f9c69b24966b07631c7e8e558f5539ec546d75a475defe14337d28e152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 06 Oct 2023 20:08:48 GMT
etag: W/"00133a3cf34b34b4e4ff44f62b5986b1"
last-modified: Tue, 19 Sep 2023 20:15:27 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-id: mpoOcZ3cCc9JzV2-PYX6Li8IGRkh4myBLrjuugMRsqBslOp3XkRw5w==
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-amz-version-id: ZNXLNC0ssKOxmDh5pl9NDq6HqHehrwEr
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 19

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 9306 2 KB
1 KB 155ms
155ms Document
text/html 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1696623000000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

014c54f9c69b24966b07631c7e8e558f5539ec546d75a475defe14337d28e152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 06 Oct 2023 20:08:48 GMT
etag: W/"00133a3cf34b34b4e4ff44f62b5986b1"
last-modified: Tue, 19 Sep 2023 20:15:27 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-id: A088hxW832Hm9MbMO4lT9JbEESddgjYOg2a4cDoNmjuebyTHQTpeIQ==
x-amz-cf-pop: AMS54-C1
x-amz-server-side-encryption: AES256
x-amz-version-id: ZNXLNC0ssKOxmDh5pl9NDq6HqHehrwEr
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 11

POST
H/1.1 200
OK 32d687c5-44d6-54e9-9793-d0965364f03a
csp.menlosecops.com/ 0
159 B 1145ms
429ms Other
application/octet-stream 54.183.36.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Requested by: Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.183.36.230 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-183-36-230.us-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/csp-report

Response headers

Date: Fri, 06 Oct 2023 20:08:49 GMT
Server: awselb/2.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/octet-stream

GET zi-tag.js
js.zi-scripts.com/ 0
0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 60ms
60ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=94103696&t=pageview&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&ul=en-us&de=UTF-8&dt=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=2029641293.1696622927&tid=UA-41161362-2&_gid=1293776008.1696622928&gtm=45He3a40n81WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1941617480

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 18:20:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6527
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 runtime~main.250b8c3b.js Show response
js.driftt.com/core/assets/js/ Frame 9306 6 KB
3 KB 57ms
56ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ab6259024d508e82f2100726285def9d2c67211afc10f9450dbb9efee58db5de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: INmBWBUTI7s8HQHrQELARWPZPG_qc8WA
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468401
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 15 Sep 2023 20:51:10 GMT
server: istio-envoy
etag: W/"187268a131d0fc1896127a07856617bb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: k7dd_fvy9-cl1FOA4E7x_I3lA8iED0LrccVxKmQVOU1vY2dMxtG44g==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 35 KB
13 KB 63ms
63ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id: q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6720640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 20 Jul 2023 18:22:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ALq2WplbapBvYdym2lTAKaIkvRg1pr8QRbMaksZmTghOB3v9SYW1tg==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 7 KB
3 KB 66ms
66ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 04:09:06 GMT
x-amz-version-id: 2zyEGUMzvveqkJzL6nFDTJ0WIZ_8_gTF
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5241582
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Fri, 28 Jul 2023 18:55:12 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: m8M53jV9Aasdpp2lOTupCvldhgZdBMKj6in5qNRI7ZVQqeIJm4ETcQ==

GET
H2 200 runtime~main.250b8c3b.js Show response
js.driftt.com/core/assets/js/ Frame A154 6 KB
3 KB 60ms
60ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ab6259024d508e82f2100726285def9d2c67211afc10f9450dbb9efee58db5de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: INmBWBUTI7s8HQHrQELARWPZPG_qc8WA
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468401
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 15 Sep 2023 20:51:10 GMT
server: istio-envoy
etag: W/"187268a131d0fc1896127a07856617bb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XQFGg60tHJClkYFyOmzuLbf1jH2rICqy_yB6Tic1tpMDYmIRySGK_A==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 35 KB
13 KB 68ms
67ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 01:18:07 GMT
x-amz-version-id: q5pTVpOtKy3mkc3tgJvo47OHqvdilate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6720640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Thu, 20 Jul 2023 18:22:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: F63frwC34sMyPKnGM3sXbZwNEgQh2JUYUedqDeIhP1Y92JQNKbS1fw==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 7 KB
3 KB 69ms
69ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 04:09:06 GMT
x-amz-version-id: 2zyEGUMzvveqkJzL6nFDTJ0WIZ_8_gTF
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5241582
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Fri, 28 Jul 2023 18:55:12 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: i2Og9R3LQGTEMfzIbaGMekbQ9mZ-DLVNrvrZg_7THDaxox7YoPqWfQ==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 23 KB
8 KB 195ms
193ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: QZtKcKkqFh2Uk4IvDTqkNiRMO.MEc6F8
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 21 Aug 2023 14:57:26 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Rtkg_v9rPyU5j0UvlgGt6_bZhKBcA67ZW6SBGmbu0ok3J-5-aL-LaA==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 36 KB
10 KB 201ms
198ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 23:55:35 GMT
x-amz-version-id: .9Z1hFvkMGOKBXSr0z8XOGr_QD6PPYGP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4479194
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Fri, 11 Aug 2023 16:01:20 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DvdRhXe9n5DdS5qleK9_fIKy5AwBvUlB_xy2VC8pUw4SrcOcnsHP0g==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 32 KB
11 KB 207ms
204ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 13 Jul 2023 02:16:45 GMT
x-amz-version-id: b6Bt2g8ryVQoHB7t6bzl84fc0qn29fSy
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7408324
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 28
last-modified: Wed, 12 Jul 2023 14:36:16 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8l0Dq_rOlqXUHBr1g-d-hyl_WSMqmqRbsH-Embn_e5Ap8BF-OeARgg==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 17 KB
6 KB 210ms
207ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 02:11:00 GMT
x-amz-version-id: Au8F3Ar_U1LqcmITQ7kozyIXP1hU0l.o
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6544669
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 61
last-modified: Fri, 21 Jul 2023 20:53:08 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mecddn2aFDet3SZAkAk1mpSvcC0S629PhJBeGHgF9-XjgaQWz4sHyw==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 25 KB
8 KB 215ms
212ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 23:55:35 GMT
x-amz-version-id: Gp2dtlKh208YR70UI5PUzEC2uodfavWf
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4479194
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Fri, 11 Aug 2023 16:01:20 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bMJtxUoh4ArRhWQSuF80AYou8yRYxmCLBLgx4f3uvfidtD812MJr_Q==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 74 KB
23 KB 224ms
221ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:18 GMT
x-amz-version-id: tpgacrQ52XYRAJzwU6or.lrZGF0wZZj1
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228931
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Wed, 26 Jul 2023 13:14:42 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gGyaAiGac7qze3rNHDEa9vTw1vgZjAqJLWXjTgpNAdBMJjUyt-zw1A==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 66 KB
20 KB 238ms
236ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 10:11:06 GMT
x-amz-version-id: QuflpVsRjQoeLsgyzbb2dO87jCp6veQD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5219863
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uXc6fpvZPZyLGmPOnzrfG_hOMfzTB6W5nYGUDa_b-DUhiRYXHkiwTg==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 91 KB
28 KB 255ms
251ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 15 Jul 2023 08:49:23 GMT
x-amz-version-id: ivQMayQoxYPrsJJ_uTz8OzBvhj3ZlBwm
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7211966
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 12 Jul 2023 14:36:15 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PWnt1FBZOu7mD5hQofJhPWu8hSPt3MUDnTT0P2vVcG8x47y4b8aqGg==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 23 KB
7 KB 266ms
262ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: kjsgkmFh.GnFcyw4pHTlnQqAwDZ4.mYa
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Mon, 21 Aug 2023 14:57:24 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Iph66TuHetb6bqQmAcMc5aTMkcoiuhvrcaUiZfKcuwRQg5Msk4Ezeg==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 62 KB
20 KB 275ms
272ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 03:36:34 GMT
x-amz-version-id: fCU1rHK8PZHGjSHZj5aLYRigEERsAl0V
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5243534
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _xS4QgsIgez4f-g63N7RgWDMb2hvjD6Hb98BM1pKI-orlpOGEze0bQ==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 105 KB
34 KB 285ms
282ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id: nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228930
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Wed, 26 Jul 2023 13:14:43 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: js4msVF8730AYGsRevI2g9DbZrDdm-9ShSKipZR2tOCO8C0UZga2Sw==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 12 KB
4 KB 296ms
292ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 19:12:12 GMT
x-amz-version-id: NUGZxvPg7W.acSsa10LtQDbxO8WVBOao
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6224197
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 26 Jul 2023 13:14:42 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9N0Y7fr95YXgYsBxJSkL0SP1FR73xD_gY0b1feyYHBEnVJANHK4Nng==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 13 KB
6 KB 300ms
297ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 22:57:09 GMT
x-amz-version-id: LpOGcCN0tTTni4jtht.pQLzX33GYkDdT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7247500
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Wed, 12 Jul 2023 14:36:16 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2n4-dZK7HPlBN0iCwh_PrzDzimyYML1pyoQnt2ZhRWCnNqIuQoLcSA==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 17 KB
7 KB 303ms
300ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 02:40:25 GMT
x-amz-version-id: rITDjXEpthOTAiahCXONMRPruIsBsv5Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5246904
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CdQbl9IUK5vSVKLBz8BQL0e8UzuCwMUXHRxH_tts2pJCeLAzjx0Eow==

GET
H2 200 8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 31 KB
4 KB 297ms
295ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 05 Sep 2023 18:50:08 GMT
x-amz-version-id: q66dX6dU5ESudoXt4AefzwSKn47c9cKn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2683121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 60
last-modified: Mon, 04 Sep 2023 22:45:58 GMT
server: istio-envoy
etag: W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hhvKgEvYq3o3UKx6CAkr7dN4K5VnJJffTHQZopgcbQ--DTC5EuhfEQ==

GET
H2 200 8.eba5dae8.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 81 KB
26 KB 305ms
303ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.eba5dae8.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c871f116084716e74638906e8f72d572ad0b429fe4ffd1e6524698f8863e6eed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 05 Sep 2023 18:50:08 GMT
x-amz-version-id: mBPubbVlcoGyCFUAJnlHcT2v7IEHPkOa
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2683121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 64
last-modified: Mon, 04 Sep 2023 22:46:02 GMT
server: istio-envoy
etag: W/"e5667c6d6613c671dc878d325651ed30"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: j5wFHQpkagOHJbTrXDGQBG0ktyDVJ6zjS77Mop0EVW4ul1gXIal4TA==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 24 B
698 B 298ms
295ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: vmIEPPGq4GDmFIGfFgKXu0azUGWgZf5j
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
content-length: 24
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: e0jz5yD5i3lEDAMiANb7i7VYx7o8Fn4pNvIX08s-pvW6awdiHZhGZQ==

GET
H2 200 16.8bd9e5a9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 91 KB
24 KB 311ms
308ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.8bd9e5a9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8879c5372c9cdd8a63f0482260b11c03651fb6bf5a216ab4478fdb30394ee24a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: azWfB1X90wpvRalp3qkglEPEIozJI6NM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1424515
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 60
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"ef144ff505a111b4fe4731aaba1cffed"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Aqe1r8W_AlgTIivZJ0FuFKRPrtcp6lbUHwmrvzVeawLfg1aEFuRTsg==

GET
H2 200 24.b8195d6f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 50 KB
14 KB 316ms
313ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.b8195d6f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

13e6d3edf54c6c00bfa34948557a2988bd13c12dfa05426e2f96841e05859f61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: VrlnP2ljCYKV4aqktyeLhDSqfEtxPA8K
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468402
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"28a73cfbb87b842bc4035605050cf485"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xsWgS0-Uzxv0rmTJmEGpz7Ty4grvirJp5JByDHlvrc7MZbKZmPgrZA==

GET
H2 200 17.10f4dc86.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 40 KB
13 KB 318ms
316ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.10f4dc86.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e51a2be6b9ef83a35f3c668ee14a711245586dd5d64abec9609d71586063b5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: wYenZXx3wWk5yohfiJf5T8DgKkEzKw25
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468402
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"73b73361bca65f89bc335da0149e0de6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Zg7d-FbqanyY8mYXzqMWkz_NCRwyAdeTrnw4rAXj6TipnufoLaJQCA==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 23 KB
8 KB 315ms
313ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: QZtKcKkqFh2Uk4IvDTqkNiRMO.MEc6F8
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Mon, 21 Aug 2023 14:57:26 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: C3spKzmo-Mca7C8fOH5RlO-3vLGJw7MSQl_Kv9a6kbiZRrEA2H23og==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 36 KB
10 KB 316ms
314ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 23:55:35 GMT
x-amz-version-id: .9Z1hFvkMGOKBXSr0z8XOGr_QD6PPYGP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4479194
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Fri, 11 Aug 2023 16:01:20 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RNdWAYSIdwUmeSYrwCpL83ZKCGVcx90GVNHnWNW8AWpaXs2kIezn8A==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 32 KB
11 KB 319ms
317ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Thu, 13 Jul 2023 02:16:45 GMT
x-amz-version-id: b6Bt2g8ryVQoHB7t6bzl84fc0qn29fSy
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7408324
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 28
last-modified: Wed, 12 Jul 2023 14:36:16 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6K23QKzYHF5XstYUF2ibc5hc8yl1ThJongbhE60OX6J8_eUwQcF9DQ==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 17 KB
6 KB 320ms
318ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 02:11:00 GMT
x-amz-version-id: Au8F3Ar_U1LqcmITQ7kozyIXP1hU0l.o
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6544669
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 61
last-modified: Fri, 21 Jul 2023 20:53:08 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xsW75KylEAJGvrLWMHd38g31mBs2mhDEJa-iLVSGq6Q76Az0c1I3hQ==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 25 KB
8 KB 322ms
320ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 23:55:35 GMT
x-amz-version-id: Gp2dtlKh208YR70UI5PUzEC2uodfavWf
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4479194
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Fri, 11 Aug 2023 16:01:20 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UUzeJXrGKxmEUdO9NP487dZUErg_YqUo6PvL0UEn1t3BIOQdCba2XA==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 74 KB
23 KB 325ms
323ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:18 GMT
x-amz-version-id: tpgacrQ52XYRAJzwU6or.lrZGF0wZZj1
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228931
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Wed, 26 Jul 2023 13:14:42 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: eGOh6tIXY2baQCB7k1ai7QJ-ZlCqS0sLAERF-L_eX26CPJn8bdPXbw==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 66 KB
20 KB 330ms
328ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 10:11:06 GMT
x-amz-version-id: QuflpVsRjQoeLsgyzbb2dO87jCp6veQD
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5219863
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oswnK-xo48CNs7Hr0Uz4LmVDuYjb4JFdMpyTiJYu9Dw6A3FqyehZmQ==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 91 KB
28 KB 335ms
333ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 15 Jul 2023 08:49:23 GMT
x-amz-version-id: ivQMayQoxYPrsJJ_uTz8OzBvhj3ZlBwm
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7211966
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 12 Jul 2023 14:36:15 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Fdj6-L0VDgVRUoAq65lo8625PYw5bxhkiS3dqDeEqHuEot7H51k7Tw==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 23 KB
7 KB 339ms
337ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: kjsgkmFh.GnFcyw4pHTlnQqAwDZ4.mYa
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Mon, 21 Aug 2023 14:57:24 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OBpaG-C7Uo8WFFm7xSRzzo0R4_OEQVIg91WWZpwWQbblEEWoHuUVIg==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 62 KB
20 KB 342ms
341ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 03:36:34 GMT
x-amz-version-id: fCU1rHK8PZHGjSHZj5aLYRigEERsAl0V
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5243534
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uStpcPDdMCnFu45lVTGJunFRYJV2E-2-OvaD2WJsjLWATAlIRsCiUg==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 105 KB
34 KB 346ms
344ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:19 GMT
x-amz-version-id: nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228930
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Wed, 26 Jul 2023 13:14:43 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WkZJ4hLCirHuzUCgYhn3e3L5de6poDwi12Usr4Y-LbNqPVnibv6aog==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 12 KB
4 KB 350ms
349ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 19:12:12 GMT
x-amz-version-id: NUGZxvPg7W.acSsa10LtQDbxO8WVBOao
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6224197
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Wed, 26 Jul 2023 13:14:42 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ExIHHV3-165z5QIkRG58iru2GxYLJ3jgGzH4a3007NbD9hfemBl82w==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 13 KB
6 KB 352ms
350ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 22:57:09 GMT
x-amz-version-id: LpOGcCN0tTTni4jtht.pQLzX33GYkDdT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7247500
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Wed, 12 Jul 2023 14:36:16 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2RQ5ChGh-ce5E2vjSwX6Yi3hDsnorXQWyiUMw3ozZj7tQtfz5uX5ow==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 17 KB
7 KB 353ms
351ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 02:40:25 GMT
x-amz-version-id: rITDjXEpthOTAiahCXONMRPruIsBsv5Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5246904
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WtleNzpBwvHliKrk5tzOJchz10aGwKksQs1QHFQ0zXicTBbkNjC84A==

GET
H2 200 8.7602338c.chunk.css
js.driftt.com/core/assets/css/ Frame A154 31 KB
4 KB 351ms
349ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 05 Sep 2023 18:50:08 GMT
x-amz-version-id: q66dX6dU5ESudoXt4AefzwSKn47c9cKn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2683121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 60
last-modified: Mon, 04 Sep 2023 22:45:58 GMT
server: istio-envoy
etag: W/"76d0343f1f9f445c80d5c68c2a35b6e0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0jKARYmH52c-9NLzgZWicnFusSRWjt2g-s08MsN7pluvued4a2AK3g==

GET
H2 200 8.eba5dae8.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 81 KB
26 KB 355ms
354ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.eba5dae8.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c871f116084716e74638906e8f72d572ad0b429fe4ffd1e6524698f8863e6eed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 05 Sep 2023 18:50:08 GMT
x-amz-version-id: mBPubbVlcoGyCFUAJnlHcT2v7IEHPkOa
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2683121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 64
last-modified: Mon, 04 Sep 2023 22:46:02 GMT
server: istio-envoy
etag: W/"e5667c6d6613c671dc878d325651ed30"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gVVDMCUG94CMOwNdokEdiQlrNWkn-cy6DB_EQBYttNQeJNYbSijcrA==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame A154 24 B
698 B 357ms
356ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 01:45:42 GMT
x-amz-version-id: vmIEPPGq4GDmFIGfFgKXu0azUGWgZf5j
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS54-C1
age: 3435787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
content-length: 24
last-modified: Mon, 21 Aug 2023 14:57:23 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zyy51EUOqbeywD3a3TdVEdfd_UgLL7cIriBNhGQ_qk_JrVypYj8ccQ==

GET
H2 200 16.8bd9e5a9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 91 KB
24 KB 359ms
358ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.8bd9e5a9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8879c5372c9cdd8a63f0482260b11c03651fb6bf5a216ab4478fdb30394ee24a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 08:26:54 GMT
x-amz-version-id: azWfB1X90wpvRalp3qkglEPEIozJI6NM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1424515
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 60
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"ef144ff505a111b4fe4731aaba1cffed"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TywKz9llqwleAlfKqKSiS5tt-DDBWzwh_QL3m3hZKi67aRxb229nKA==

GET
H2 200 24.b8195d6f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 50 KB
14 KB 362ms
361ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.b8195d6f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

13e6d3edf54c6c00bfa34948557a2988bd13c12dfa05426e2f96841e05859f61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: VrlnP2ljCYKV4aqktyeLhDSqfEtxPA8K
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468402
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"28a73cfbb87b842bc4035605050cf485"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YMFjB_cYIk_D0-ZBdFKrhYE5RPhD2xdR2xuK-CTrgPq4CHHh-5e25A==

GET
H2 200 17.10f4dc86.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 40 KB
13 KB 364ms
363ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.10f4dc86.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e51a2be6b9ef83a35f3c668ee14a711245586dd5d64abec9609d71586063b5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 20:15:27 GMT
x-amz-version-id: wYenZXx3wWk5yohfiJf5T8DgKkEzKw25
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 1468402
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Fri, 15 Sep 2023 20:51:06 GMT
server: istio-envoy
etag: W/"73b73361bca65f89bc335da0149e0de6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vRrKT-J1t7NErWxsKCpVFcCUyTW_NeXXLs5FUvVbVr3mJ7OHMXZa3A==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 250ms
250ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:49 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 83162 Show response
app.hushly.com/runtime/countries/ 75 KB
20 KB 199ms
199ms Script
text/javascript 54.184.63.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.hushly.com/runtime/countries/83162?callback=hushlyCountriesCallback&_=1696622928484
Requested by: Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-6ea6e06aafd7e8688a9682af475fc7db.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.184.63.179 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-184-63-179.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:49 GMT
cache-control: max-age=31536000, public
content-encoding: gzip
x-robots-tag: noindex
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 3 KB
1 KB 56ms
55ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 10:11:06 GMT
x-amz-version-id: 1Fvw.FePqdHMTWAULWhHtYDtzjDh8y58
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5219862
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Fri, 28 Jul 2023 18:55:08 GMT
server: istio-envoy
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nIbp3XtZzTGV3FrGaL0jTtxIQ2TWM4TT3zkqU7sxXNDAvupmk3F84w==

GET
H2 200 37.298cbb69.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 3 KB
2 KB 56ms
56ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.298cbb69.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 19 Aug 2023 03:07:53 GMT
x-amz-version-id: JzP5EHa1AgOQDQQqP6XtnDRIZFkYBhy2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4208456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 46
last-modified: Fri, 18 Aug 2023 19:22:22 GMT
server: istio-envoy
etag: W/"86b289eeb2bf9d30034f30d9794e8041"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: I1H-kfk6MZeMxC1MqRkfNWJy6oSIIHxOmpMnB5tLPyZzG5aT3Bv1Ng==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 9 KB
3 KB 56ms
55ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:21 GMT
x-amz-version-id: 11XPwI2xxVbguG7UE_GEw7u.mY1XZ4Ws
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228928
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Wed, 26 Jul 2023 13:14:41 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: efYUf6wy-qAiwy78-uFdQNZEG9Ef2-XO4FpayUMa0SYD0FvKAtgyDw==

GET
H2 200 27.01c2bea5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 35 KB
10 KB 57ms
56ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 04:19:39 GMT
x-amz-version-id: 8ImB2GzfMuOIT4VQ58DA5kzWjWXBsygZ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6277749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 73
last-modified: Tue, 25 Jul 2023 18:08:14 GMT
server: istio-envoy
etag: W/"04a233a42dcf8c50a83bfecea8ba552d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OUsCt9ZJvzP2QZSRq_U6vE-Krbw8D9rZrRhimubcrmMReDKkV7YMyw==

GET
H2 200 28.b5e8f5e1.chunk.css
js.driftt.com/core/assets/css/ Frame A154 8 KB
2 KB 56ms
56ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/28.b5e8f5e1.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 23:24:26 GMT
x-amz-version-id: dWp9miJXOVmUTXcain7mZ7aJqiAGjznQ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2753063
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Mon, 04 Sep 2023 22:45:58 GMT
server: istio-envoy
etag: W/"e7107bc29ccb3c6d928f0f8f10a0f22d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p85BaxbHOi9a2M66R4Fhv32d8Y-INsDBdAVXz7PMq7mc2-lNuoewZg==

GET
H2 200 28.bdd92ff2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 14 KB
6 KB 58ms
58ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.bdd92ff2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 01:08:20 GMT
x-amz-version-id: FvCtLBM3Ax0E94dTAA_8PRI1sla9ZXxV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5252429
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 43
last-modified: Fri, 28 Jul 2023 18:55:10 GMT
server: istio-envoy
etag: W/"260fbabe310bd2cae5c44538f3d833ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: w8pdTVHay2W8XJtru_IHUaajmTRuEypPfi8kaIkxlxqBKk-zagrcNQ==

GET
H2 200 25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame A154 365 B
1 KB 57ms
57ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 23:31:21 GMT
x-amz-version-id: n.AcAAyNdrluKmEb0IgSI_RvtitbHfQj
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS54-C1
age: 6208648
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 68
content-length: 365
last-modified: Wed, 26 Jul 2023 13:12:09 GMT
server: istio-envoy
etag: "06b2963b029c0824382815165bfea73e"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Oh_8kk8z82HNW6EXCTCz9-yx6MFtg2HSPyWqZEh8pWPuxQyUtvXKxA==

GET
H2 200 25.a9a52994.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 91 KB
25 KB 58ms
58ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.a9a52994.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d21b490fa72e9cd90e09db07c73ef43c0d65bf38de6a41dfd1c53338f71549a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 22 Jul 2023 03:40:14 GMT
x-amz-version-id: PYnJad6hGRXYHxmqCJe._oskUh6EdJGy
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6625715
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 75
last-modified: Fri, 21 Jul 2023 20:53:08 GMT
server: istio-envoy
etag: W/"34109a0bf2906f78b21b4a9f5fa4ab8c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NhRi9WaKHMJguIoeuM5UPd39RC-R9Iy1t7ePjwF2Ld6EAizJViAl-w==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 9 KB
3 KB 57ms
56ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:21 GMT
x-amz-version-id: 11XPwI2xxVbguG7UE_GEw7u.mY1XZ4Ws
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228928
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 30
last-modified: Wed, 26 Jul 2023 13:14:41 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NAWCDtJ-1N9IcPfDRMylgI-CHPs292E6b8-swDFXcCcW1f4MdgjjHA==

GET
H2 200 3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 7 KB
2 KB 58ms
56ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 17:53:21 GMT
x-amz-version-id: Ov831I2a5yEZEgVNkzjL3jR4iYT4qeoU
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6228928
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Wed, 26 Jul 2023 13:12:09 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UcCC7fQdUnTjWK8xV6-W0mc0IhyvnSizPOOCFKSHTsOJYgCddLhYWw==

GET
H2 200 3.f50b964b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 54 KB
15 KB 59ms
58ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 09:32:39 GMT
x-amz-version-id: jXTrJe6220Uy3oL4jKw8LE4E7PDU6e2f
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6258970
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 54
last-modified: Tue, 25 Jul 2023 18:08:14 GMT
server: istio-envoy
etag: W/"1ac37bf2b93050f29058b66a9ad43e10"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: x0f195MchvG0fPloZqtJ3AEMlNEjIOknzhDC8QtwqD_qucNK8vb-3g==

GET
H2 200 1.12ba17b6.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 44 KB
7 KB 58ms
57ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 11:27:15 GMT
x-amz-version-id: eSNvdp0yfhg_hVHGVV1T0Cg9aS8M1FwM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 5215294
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Fri, 28 Jul 2023 18:55:08 GMT
server: istio-envoy
etag: W/"3b8ba82e1bac13ee29e9764a55620d99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yRJYJewDVSglJn8Hz8vnnfjoiXCMQziWavCzAIPviGM6rOTDoZywPQ==

GET
H2 200 1.2aebee2c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 54 KB
17 KB 60ms
59ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.2aebee2c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 22:45:31 GMT
x-amz-version-id: bS8baBPItBLwxisqBAsAAbXKmqRySvKy
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2755398
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Mon, 04 Sep 2023 17:29:48 GMT
server: istio-envoy
etag: W/"8dec138e62d799d028f8c7ed0cc19058"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: y1t-quUw6JdZA3_aLazFU4raELsQXfOUo2WNMjzEXzW_I5KTFtIBrA==

GET
H2 200 4.9d776499.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 23 KB
10 KB 60ms
60ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.9d776499.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 18:55:58 GMT
x-amz-version-id: uGJ36CDXFf5jc7zFgfXUohqg1i8mPHWM
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6311571
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 25 Jul 2023 18:08:15 GMT
server: istio-envoy
etag: W/"cc02ad980b6b04f3bba61e68883356d4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RNSBaBbdjywoG4EP8-LZapy3ZDwLtMe0Ck7p1WiyLdDvkJG2tLX_3g==

GET
H2 200 34.0504aac4.chunk.css
js.driftt.com/core/assets/css/ Frame 9306 16 KB
3 KB 61ms
60ms Stylesheet
text/css 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/34.0504aac4.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2b74bc303570faa3cd261b240078960cd0c28f811ae71cb72352809a42d20f6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 02:11:02 GMT
x-amz-version-id: q2speui9tJuSqazhqyXXmusrZlo.6X8E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 6544667
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 50
last-modified: Fri, 21 Jul 2023 20:53:06 GMT
server: istio-envoy
etag: W/"95b017fb41a8751bd7175f8a73f035f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6jwHzI_WfBLlUc0dT10SUur1TAmG0lsFlLOtfCSqqkpY5AtxWO6WmQ==

GET
H2 200 34.565cc93a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 13 KB
5 KB 62ms
61ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.565cc93a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 05 Sep 2023 18:50:08 GMT
x-amz-version-id: .CV9Gv7QHuYDZKNfN_Mj0Og0uIzMiBl5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 2683121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Mon, 04 Sep 2023 22:46:01 GMT
server: istio-envoy
etag: W/"57c0a57c3cf808c4592182b4c490b3a0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: J0kNe3z5-XUkqzTwaAMswuf3nNE436VvWVYGyxC1kxCvnCYwUKLxfA==

POST
H2 200 v2 Show response
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame A154 147 B
587 B 352ms
113ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Oct 2023 20:08:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 3ea702eae7f1b0be
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 147

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame A154 25 B
112 B 131ms
121ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Oct 2023 20:08:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 86a5de4f817040de
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 11
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame A154 11 KB
5 KB 292ms
292ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

655c91c206f255edb1c208c75131ed3d4ee3cfdd32ef342bfd2f183071514a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Oct 2023 20:08:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: c7790022a7365030
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 182
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 285ms
284ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:50 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 60ms
59ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=94103696&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&ul=en-us&de=UTF-8&dt=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=2029641293.1696622927&tid=UA-41161362-2&_gid=1293776008.1696622928&gtm=45He3a40n81WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1824966531

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 18:20:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6529
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame A154 645 B
728 B 111ms
111ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

c5ac82b020340006a2a39a016936c48cb16b777d48d278da5095f5ab103ee031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTY4OTQyNDE1OCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3MjgyNDUzMzAsImlhdCI6MTY5NjYyMjkzMH0.YYrORRQIgJ27yTyMz7NgqSQ-lt92x1B1CM_twh2oyOGJM2VyM1TVQ7uHYPqKqfAXNk2JDn_2EXVX7MWimQtlzQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: ad3783739bdee894
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 645

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 117ms
110ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 06 Oct 2023 20:08:50 GMT
requestid: drift9c5940b4557ae08069b0fe7d582
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 200 evaluate_with_log Show response
targeting.api.drift.com/targeting/ Frame A154 460 B
331 B 112ms
112ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

bbf1ec3090884a1878e6ab7b58df66595faef1080ee874e9bfd3f2e2e1d5af87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTY4OTQyNDE1OCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3MjgyNDUzMzAsImlhdCI6MTY5NjYyMjkzMH0.YYrORRQIgJ27yTyMz7NgqSQ-lt92x1B1CM_twh2oyOGJM2VyM1TVQ7uHYPqKqfAXNk2JDn_2EXVX7MWimQtlzQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: 778bb55bbb7ad95b
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 267

OPTIONS
H2 200 evaluate_with_log
targeting.api.drift.com/targeting/ Frame 0
0 119ms
110ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 06 Oct 2023 20:08:50 GMT
requestid: drifte52119b4d359f665aac84fb74f6
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0

OPTIONS
H2 200 render_initial_v3
flow.api.drift.com/flows/ Frame 0
0 116ms
110ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial_v3

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 06 Oct 2023 20:08:51 GMT
requestid: drift210689c42768670c4b8524ee69b
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 200 render_initial_v3 Show response
flow.api.drift.com/flows/ Frame A154 6 KB
3 KB 193ms
192ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial_v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

9ad53aa2ff9112696a0c6a5ec87d7861d417df09a4a63e1ce15ee49c7b590bf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTY4OTQyNDE1OCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3MjgyNDUzMzAsImlhdCI6MTY5NjYyMjkzMH0.YYrORRQIgJ27yTyMz7NgqSQ-lt92x1B1CM_twh2oyOGJM2VyM1TVQ7uHYPqKqfAXNk2JDn_2EXVX7MWimQtlzQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: fb85eb62a6669a7
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 82
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2781

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 252ms
251ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

OPTIONS
H2 200 widget
targeting.api.drift.com/impressions/ Frame 0
0 110ms
110ms Preflight
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Fri, 06 Oct 2023 20:08:51 GMT
requestid: drift8e9eccf4fd5b91d767216b283d5
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 204 widget Show response
targeting.api.drift.com/impressions/ Frame A154 0
37 B 120ms
119ms XHR
text/plain 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTY4OTQyNDE1OCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjEwNDQzMzYiLCJleHAiOjE3MjgyNDUzMzAsImlhdCI6MTY5NjYyMjkzMH0.YYrORRQIgJ27yTyMz7NgqSQ-lt92x1B1CM_twh2oyOGJM2VyM1TVQ7uHYPqKqfAXNk2JDn_2EXVX7MWimQtlzQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 47031eb4f7db478b
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 9
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A154 19 KB
7 KB 56ms
56ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=trrsm2wf4gwm&eId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=876046db-980e-4734-9d11-6beca10edf66&sessionStarted=1696622928.759&campaignRefreshToken=6a612bb2-6274-4690-b7e8-460ee147721d&hideController=false&pageLoadStartTime=1696622925451&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 19 Aug 2023 02:57:26 GMT
x-amz-version-id: RC9wHzNSJSUNxtwIhSrk.IaHgPmrvySk
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4209085
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Fri, 18 Aug 2023 19:22:23 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 82lJnU3XnZRmN0EoDPZj49LZbjfMKcTLBynuwqQTb4RgX7XWrhyXog==

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 9306 19 KB
7 KB 56ms
55ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1696622925451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 19 Aug 2023 02:57:26 GMT
x-amz-version-id: RC9wHzNSJSUNxtwIhSrk.IaHgPmrvySk
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 4209085
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Fri, 18 Aug 2023 19:22:23 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vLTTX_rSiMCeIIz7YcaHFY-HKc8EyZQHP70rII6FGq3VOGFwpeyqPg==

GET
H2 200 https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1193133%252Fb560b8f00aa88f9db3a4e22ecc4dfe8bz5729p78r3ak%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w...
driftt.imgix.net/ Frame A154 588 B
918 B 209ms
69ms Image
image/png 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F1193133%252Fb560b8f00aa88f9db3a4e22ecc4dfe8bz5729p78r3ak%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3Db1bf4f6de2ccd453089f859edf075ec1?fit=max&fm=png&h=200&w=200&s=36c1ab91f635a44e1c80c5b67cfebd98

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

51356fa79699268ffecc5052d61a15c56d95620b54d0c3b2c9238ce84fcc269a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:51 GMT
x-content-type-options: nosniff
age: 1750715
x-cache: HIT, HIT
x-imgix-id: 559a4f3eda2a10f2b13846743b537b9e2cdadb09
cross-origin-resource-policy: cross-origin
content-length: 588
x-served-by: cache-sjc1000104-SJC, cache-fra-eddf8230130-FRA
x-imgix-render-farm: 02.139816
last-modified: Sat, 16 Sep 2023 13:50:16 GMT
server: Google Frontend
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
js.driftt.com/deploy/assets/static/fonts/ Frame 9306 38 KB
39 KB 56ms
56ms Font
font/woff2 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/static/fonts/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/assets/css/8.7602338c.chunk.css
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 17 Jul 2023 09:00:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7038493
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
content-length: 39372
last-modified: Fri, 03 Mar 2023 16:21:38 GMT
server: istio-envoy
etag: "40b6965b5cd26213faf61e5ab6765bb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/font-woff2,font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tY4IPcSurAvufAirUz-SOAQYppqlK3sSCqLDbM7ydwMV7oNd6wCBDw==

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
js.driftt.com/deploy/assets/static/fonts/ Frame A154 38 KB
39 KB 56ms
56ms Font
font/woff2 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/static/fonts/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/css/8.7602338c.chunk.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/assets/css/8.7602338c.chunk.css
Origin: https://js.driftt.com
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Mon, 17 Jul 2023 09:00:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 7038493
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
content-length: 39372
last-modified: Fri, 03 Mar 2023 16:21:38 GMT
server: istio-envoy
etag: "40b6965b5cd26213faf61e5ab6765bb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/font-woff2,font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3TV6_oxrBXkhHIVoqL0opJkd86YPkf_Q9OMMBGdb3zRmeWqB6QKZbw==

GET
H2 200 3.ee35dea2.chunk.js Show response
js.driftt.com/conductor/assets/ 158 B
853 B 56ms
55ms Script
application/javascript 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1696623000000/trrsm2wf4gwm.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 23:38:44 GMT
x-amz-version-id: pMohofQYEF1dohPHFcPmV3oeRzVr6CuK
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS54-C1
age: 6467407
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
content-length: 158
last-modified: Fri, 21 Jul 2023 20:53:14 GMT
server: istio-envoy
etag: "e6714addd36102488fb27a980401fd36"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mtu_bh36X6TJ8mdWYnjG4vIdQeugkGi7q4zk-4pgwRGK-iXCfURBOw==

GET
H2 206 notification.5f7c6014.mp3
js.driftt.com/conductor/assets/media/ 8 KB
8 KB 57ms
57ms Media
audio/mpeg 13.227.219.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-60.ams54.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.menlosecurity.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Range: bytes=0-

Response headers

date: Sun, 21 May 2023 00:48:48 GMT
x-amz-version-id: EyFyYphkTOcSSXRXcLrYiychGEqav89v
via: 1.1 630336d6cdf08cf266841fd503dc03d0.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: AMS54-C1
age: 11992803
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-7754/7755
x-envoy-upstream-service-time: 57
Content-Length: 7755
last-modified: Fri, 19 May 2023 21:02:54 GMT
server: istio-envoy
etag: "5f7c6014cf73831f91963a668b71fbb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: N4uU5yo_Mvp5NVeEEbpdTfnM68REDd_IviW7S_SwlNAw_HCYUuhNZQ==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 253ms
253ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:52 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 bulk Show response
metrics.api.drift.com/monitoring/metrics/event3/ Frame A154 25 B
111 B 122ms
122ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event3/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Oct 2023 20:08:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: f7acfba4d8f0092
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 13
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 55ms
54ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=45je3a40&_p=94103696&cid=2029641293.1696622927&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&sid=1696622926&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&dt=EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.menlosecurity.com/
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 06 Oct 2023 20:08:52 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.menlosecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 258ms
258ms Image
image/gif 23.53.43.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-43-58.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://www.menlosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Fri, 06 Oct 2023 20:08:53 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: analytics.twitter.com
URL: https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=da313c89-98b3-426e-9d79-ad097d2770d4&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=de116faa-52fa-4ba3-b4b5-5286ed0b99a3&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.29

Domain: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=6222f128-bdf7-4a14-8f04-22620a15275e&session=1d0154a9-566a-452f-8238-19d18df1f7cd&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Oct%202023%2020%3A08%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Oct%202023%2020%3A08%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Menlo%20Labs%20identified%20a%20phishing%20campaign%20exploiting%20an%20open%20redirection%20vulnerability%20on%20job%20search%20platform%20Indeed.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22EvilProxy%20Phishing%20Attack%20Strikes%20Indeed%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&pageViewId=248576e8-f87d-442d-8dd6-2dcd8bc3f9d7&an_uid=0&webTagId=9d098b8d-9cde-40ee-beab-3b850059beba&v=1.1.7

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

43 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.info.menlosecurity.com/	1970-01-20 15:17:04	Name: __cf_bm Value: NeiXBvtG.kmfbkfuNj6EsC6YSJ02096pItrclYEBM6w-1696622926-0-AQ2zGHpk9Kzlp7m/Fa21TLL4duN2VmppjzTa5A9DVmG8p81m+vpweTTPbW7QBuiinCVWAKaWrLsQRNnJmFuj49E=
.menlosecurity.com/	1970-01-20 17:26:38	Name: _gcl_au Value: 1.1.1762760204.1696622927
.doubleclick.net/	1970-01-20 15:17:03	Name: test_cookie Value: CheckForPermission
.menlosecurity.com/	1970-01-21 00:02:38	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Fri+Oct+06+2023+21%3A08%3A47+GMT%2B0100+(Western+European+Summer+Time)&version=202308.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=aaf31753-7070-476b-b6fe-1b671157a442&interactionCount=0&landingPath=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fevilproxy-phishing-attack-strikes-indeed%2F&groups=C0003%3A0%2CC0002%3A0%2CC0004%3A0%2CC0001%3A1
.techtarget.com/	1970-01-20 15:17:04	Name: __cf_bm Value: wDPYOWg8bKfxUsteFAQ1yPzr0DMx.iaHr_Rm_Sdg1xQ-1696622927-0-AQG8FxZbjQOSk9Ar5laCFyWjSK/wG84FVoq9u/DOT4R1AanvNjkcIiPKH34EvBTaE0CFsQnOM80snSM0Imklkb8=
www.menlosecurity.com/	1970-01-21 00:53:02	Name: _gd_visitor Value: 6222f128-bdf7-4a14-8f04-22620a15275e
www.menlosecurity.com/	1970-01-20 15:17:17	Name: _gd_session Value: 1d0154a9-566a-452f-8238-19d18df1f7cd
.menlosecurity.com/	1969-12-31 23:59:59	Name: _fcdscst Value: MTY5NjYyMjkyNzM2Nw==
.menlosecurity.com/	1970-01-21 00:53:02	Name: _mkto_trk Value: id:281-OWV-899&token:_mch-menlosecurity.com-1696622927398-39242
.menlosecurity.com/	1970-01-21 00:02:38	Name: _hjSessionUser_1854968 Value: eyJpZCI6IjZmY2NlNTgyLWMwNDUtNWJhYy1iNTY1LTA1NmViMjAxZjcxNSIsImNyZWF0ZWQiOjE2OTY2MjI5Mjc0NjMsImV4aXN0aW5nIjpmYWxzZX0=
.menlosecurity.com/	1970-01-20 15:17:04	Name: _hjFirstSeen Value: 1
.menlosecurity.com/	1970-01-20 15:17:03	Name: _hjIncludedInSessionSample_1854968 Value: 1
.menlosecurity.com/	1970-01-20 15:17:04	Name: _hjSession_1854968 Value: eyJpZCI6ImUzZTMwMTMxLTE0ZWMtNGM1OC05MjJiLWFmZDFlMTM3NWM1MiIsImNyZWF0ZWQiOjE2OTY2MjI5Mjc0NjQsImluU2FtcGxlIjp0cnVlLCJzZXNzaW9uaXplckJldGFFbmFibGVkIjpmYWxzZX0=
.menlosecurity.com/	1970-01-20 15:17:04	Name: _hjAbsoluteSessionInProgress Value: 0
info.menlosecurity.com/	1969-12-31 23:59:59	Name: BIGipServersj21web-nginx-app_https Value: !l9LjZAotFWKcgWq6vCJNuEQ8FVxgEBoLTsDLYMX70NmlsaBm+3nlJ89SeGE3Y0ddPzqgq3u3DDDZQUQ=
.t.co/	1970-01-21 00:53:02	Name: muc_ads Value: def247f0-9623-4e0e-aeeb-cc744fa5bd28
app.hushly.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: C82FE51220ECB6C06F0896B722D4F7DB
.hushly.com/	1970-01-21 00:53:02	Name: _hly_gvid Value: c91ea725-8b3f-42e3-9167-3bbfb662e540
www.menlosecurity.com/	1970-01-20 15:18:29	Name: ln_or Value: eyI0NzQwNTgiOiJkIn0%3D
www.menlosecurity.com/	1970-01-20 15:27:07	Name: slireg Value: https://scout.us2.salesloft.com
.menlosecurity.com/	1970-01-20 17:26:38	Name: _fbp Value: fb.1.1696622927554.430304572
www.menlosecurity.com/	1970-01-20 15:27:07	Name: _an_uid Value: 0
.linkedin.com/	1970-01-20 17:26:38	Name: li_sugr Value: a586f187-f57d-415d-9af2-2a679c7547b0
.linkedin.com/	1970-01-21 00:02:38	Name: bcookie Value: "v=2&c974e902-dd73-4974-8530-05c7dc2d5342"
.linkedin.com/	1970-01-20 15:18:29	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2859:u=1:x=1:i=1696622927:t=1696709327:v=2:sig=AQFrVJfqlZpV57hph07PAJsTsU9huhYX"
www.menlosecurity.com/	1970-01-21 00:02:38	Name: sliguid Value: 1df4fffa-ca56-403f-9e5d-d066bc22cfb2
www.menlosecurity.com/	1970-01-21 00:02:38	Name: slirequested Value: true
.6sc.co/	1970-01-21 00:53:02	Name: 6suuid Value: 362b351746103d004f69206555020000d1e14600
.linkedin.com/	1970-01-20 16:00:14	Name: UserMatchHistory Value: AQIMN2L8iT-87QAAAYsGm19FiM3E8w6l-GslETdmPpt4XXQCOLtJ2RqYw17NUGpea-g2ANxmxuZILg
.linkedin.com/	1970-01-20 16:00:14	Name: AnalyticsSyncHistory Value: AQLkv7ur5Jdd9wAAAYsGm19FO-ZMPLT3FxU0wdQrpTOwHNdcuUiDp8QYzfKvLuu0u9N9hI596lkP_B3KblFYUA
.www.linkedin.com/	1970-01-21 00:02:38	Name: bscookie Value: "v=1&2023100620084766b7563c-46f2-421f-8d51-9c455e71bff0AQFSQcVlQbaNnRBb4y7zBch7BnzKjh0s"
.linkedin.com/	1970-01-20 19:36:14	Name: li_gc Value: MTswOzE2OTY2MjI5Mjc7MjswMjE6QZBgEMngsR5SRCGgCgzGQG6JcMURT8TklHGaJVtwag==
.menlosecurity.com/	1970-01-21 00:53:02	Name: _ga Value: GA1.2.2029641293.1696622927
.menlosecurity.com/	1970-01-20 15:18:29	Name: _gid Value: GA1.2.1293776008.1696622928
.menlosecurity.com/	1970-01-20 15:17:02	Name: _gat_UA-41161362-2 Value: 1
.menlosecurity.com/	1970-01-21 00:53:02	Name: _hly_vid Value: 3465632c-a39e-48c6-90fc-ba333375d0f5
www.menlosecurity.com/	1969-12-31 23:59:59	Name: _hly_sid Value: b1084e65-f1c6-48c7-a6f7-cad01b287b24
.menlosecurity.com/	1970-01-21 00:53:02	Name: _fcdscv Value: eyJDdXN0b21lcklkIjoiMTg3ZDIxMDMtYmRjNS00ZTNmLWIwNzAtYjVjNmE0MDAwODQwIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiJmYjM0NzMyMi00NGNhLTQzNjgtYWU2OS1jMDE2MGVmMzE5ZjMifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==
www.menlosecurity.com/	1970-01-20 15:17:04	Name: drift_campaign_refresh Value: 6a612bb2-6274-4690-b7e8-460ee147721d
app.hushly.com/	1970-01-20 15:27:07	Name: AWSALBCORS Value: 3Y7xAEnOlUw3Ep61dCyw9Io2U+niH4GyGhomxUIA8k/cTzHBAPXhMnuv+kKGFWws6gg/AHw970SG/Nki3ZBEcj9Uy3xKuhC14O7ZKfuxP+hnz6R79vRe7pVAieHh
www.menlosecurity.com/	1970-01-21 00:53:02	Name: drift_aid Value: 13027597-17cd-4a04-96e4-b8a66f6c53d8
www.menlosecurity.com/	1970-01-21 00:53:02	Name: driftt_aid Value: 13027597-17cd-4a04-96e4-b8a66f6c53d8
.menlosecurity.com/	1970-01-21 00:53:02	Name: _ga_C2G0PCSJKE Value: GS1.1.1696622926.1.0.1696622930.56.0.0

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/ Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Distribution_of_verticals_targeted_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/ Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Attack_Chain_fig2_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/ Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Redirection_Chain_fig5_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/(Line 10) Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Distribution_of_verticals_targeted_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/(Line 10) Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Attack_Chain_fig2_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/(Line 10) Message: Mixed Content: The page at 'https://www.menlosecurity.com/blog/evilproxy-phishing-attack-strikes-indeed/' was loaded over HTTPS, but requested an insecure element 'http://www.menlosecurity.com/wp-content/uploads/2023/09/Phishing_Redirection_Chain_fig5_outline.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	(Line 1) Message: Refused to load the script 'https://js.zi-scripts.com/zi-tag.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://scout-cdn.salesloft.com https://connect.facebook.net https://gartner.com https://.gartner.com https://.brighttalk.com https://brighttalk.com https://trk.techtarget.com https://.vimeocdn.com https://.marketo.net https://player.vimeo.com https://.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com; style-src 'self' 'unsafe-inline' https://.gartner.com https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://.gartner.com https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://.clickagy.com https://googletagmanager.com https://.brighttalk.com https://player.vimeo.com https://.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data: blob:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
Strict-Transport-Security	max-age=31536000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

281-owv-899.mktoresp.com
analytics.twitter.com
app.hushly.com
b.6sc.co
bootstrap.api.drift.com
c.6sc.co
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
content.hotjar.io
csp.menlosecops.com
d2i34c80a0ftze.cloudfront.net
driftt.imgix.net
epsilon.6sense.com
event.api.drift.com
extend.vimeocdn.com
flow.api.drift.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
hubfront.hushly.com
ibc-flow.techtarget.com
info.menlosecurity.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.zi-scripts.com
metrics.api.drift.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
targeting.api.drift.com
trk.techtarget.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.es
www.googletagmanager.com
www.linkedin.com
www.menlosecurity.com
analytics.twitter.com
b.6sc.co
js.zi-scripts.com
104.17.74.206
104.244.42.69
13.107.42.14
13.227.219.60
13.227.219.71
141.193.213.20
146.75.116.157
146.75.122.109
184.31.85.59
185.89.211.12
192.28.147.68
2001:4860:4802:34::36
23.53.43.58
2600:9000:21c7:b800:13:a3bc:6800:93a1
2600:9000:2204:8200:2:53b2:240:93a1
2600:9000:2490:ec00:9:14eb:6280:93a1
2606:4700:4400::6812:2089
2606:4700:4400::6812:24c4
2606:4700::6811:129
2606:4700::6811:180e
2606:4700::6812:83ec
2620:1ec:21::14
2a00:1450:4001:803::2004
2a00:1450:4001:811::200e
2a00:1450:4001:813::2002
2a00:1450:4001:81c::2003
2a00:1450:4001:827::2003
2a00:1450:4001:828::200a
2a00:1450:4001:829::2008
2a00:1450:400c:c03::9a
2a02:26f0:3500:16::215:1491
2a02:26f0:7100::5f64:87f1
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:8d::720
34.111.208.231
44.217.5.70
52.222.139.110
52.222.139.75
52.48.140.7
52.59.43.42
54.147.21.139
54.183.36.230
54.184.63.179
0137473b2caef46e3f7d56e7fc3eaad0f4283d75d3db901ecf7cd0fded972cf3
014c54f9c69b24966b07631c7e8e558f5539ec546d75a475defe14337d28e152
017c3225be669ab0ea7c4536450f6ab9eeee60e41e33058cf7d6cb16f18d7cfa
01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc
02837c1c83835a7fa5c081c8a7a00db394bb0d3a742eb15cca5db3d8845fd596
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d
09048873cebefcb0b837c6962a0a053ef6700472bd37ff9b049e9b73e684f1ae
0a1df262a204435f75a376f9306eb4095b7ceb8373bfdcdb7a191394e4410a3b
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0dd8dd2d9dd64be26e1131ac6585c4325fdf043a546cb1479a6e6835574dfb56
0eccd324a6b84c9c53f0f4c1c29243742cd3e18241e4ea759f6b731c57d40163
0fa14d124f186dd1ee8b0d2564bf1457ebe1fd5d2c971cff7b4ca73ba5ada204
11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc
13e6d3edf54c6c00bfa34948557a2988bd13c12dfa05426e2f96841e05859f61
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
28a26321734fb5f8c8fe42b5503f162fdf1469bf97e2d9c503a83cc2b3c534cd
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da
2b74bc303570faa3cd261b240078960cd0c28f811ae71cb72352809a42d20f6e
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3321757433351762495ef3452adf0fcefa179583f4409dd04815c710c5e45f6f
33da1c851e3d9059fb26a83434dcc64cebd5419d7b1c7125b598a8f4a56a7530
3ccfd8491a4f2101549ea6031091edc3616340f714216323f1f604f674749239
3d62ad0f23c60258f120e52cf68b2e1adff5c1bf5bde5ac8f8d6e5f4c4c64f34
3ecf2df4e67c353430286abf942883f821bf53cdd1c9a691c1cc7d42d04a95c3
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
50727bb494fe5a7a0caa0f700d257698e7b4cc84171e6658ba286a1e42f59178
51356fa79699268ffecc5052d61a15c56d95620b54d0c3b2c9238ce84fcc269a
517381e9702df6a6b6bf7921e93447d4b7d626a45fc55d31934a8392946b79c5
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5579738226ab34a5c3f0d6d9a8dce0935aee53fc9deb02b7426ce417d04124c5
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60
5aaf5321af8262d7cb4fd75f55f36147846fa26b0da1b9c8f89941a93cc7c6fb
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5d7cf3e0541293b73d644c724dd833a87c4e9a15566814e97d5d998437d7cb39
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e58a7a5dfea7aa85806f87b03c5c5aa4de018eaddbc7e8b6e61b6ee5f2eaa53
5ec1e2ebe080ec8fbfbdc7dd9c0c25449e1d98e4e947c11a00fd770d8841698b
5f8ece9fc3c316bd78480ef2f48dc82b47f84a1a2a39ddd4a0fec27a720cae41
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b
622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec
62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43
655c91c206f255edb1c208c75131ed3d4ee3cfdd32ef342bfd2f183071514a22
65c83173b67ae74899203be738f66cfe1e21405bf49b9d0670349451c8b74e47
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6b59be2f48490e7fab65a6fa43c99851ed0026b9c651ffa9937f49ad57cc2a22
6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6d73e2d840909264d25d4de2508bda7b8b76a75018b5f40367dc6e3558766ab7
6e11f14c199be97ad9f7d697f3cc87b50a4286784a0a88fb33588bb1ccfbf591
6e393c611c654ea00ed25aff28de5cad1e84d0b18e44f1b894472df7a84c32a5
6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a
6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7c53dc802273a2dbc35c73b0627e8e7a075b979b95a622f8f6b04945079bb55e
805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847df18ba757f7e15431ae68bf68db0b4d4166b5602815468c09420c66bc4cd5
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8879c5372c9cdd8a63f0482260b11c03651fb6bf5a216ab4478fdb30394ee24a
89b282ab54cdefb3f4f9f88314b84a51784580ad273b0276363f815da2cdd549
8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
8f59ad64243b7d8ea410db10bf3e9b1decd131e24aa59d41b5966b60fc6e33c7
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
94dcf5556e059d9e35d347a9fdd7c295ec5d8001d8c00693dfc2a7d18f9fb0f3
958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5
9ad53aa2ff9112696a0c6a5ec87d7861d417df09a4a63e1ce15ee49c7b590bf9
9ef57649dac2bfdab04aa540057152d57a6c5937af34b635e2dafa4daf705e68
a06e74d8087e82597aa565a8641337658c9c1b32eeecd24a4ea5671e95d236bd
a0f13ed756ef9286099a3b05ddbd538aa467fddaff881bb261fe8d40615005f0
a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a
a8331d520e307081359e060643052b00e5529d0062b5ce516c251f4da1b9fae2
aa011ed383cb780028a85caaa0dda67dce19b0f4bc596f4f708d1857015c1362
aa987fcd4cdc8223dadb3967767d387e2c82e1a290c88d92ed90ca84f4dafe56
ab6259024d508e82f2100726285def9d2c67211afc10f9450dbb9efee58db5de
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
b28577e9ac71e71f647be12dbed2c7646de798aa5cd64ce2a9648ec6712bec73
b36f04f424a688d1f2f6371da9ec078aaedd729f623c8ad123e997951f0bf749
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2
b8f578b678ec838f50338b1bc5ad8e4eec8f35bc614f32830a4e00599f4fa749
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bbf1ec3090884a1878e6ab7b58df66595faef1080ee874e9bfd3f2e2e1d5af87
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
c127a7f93d3ea162c7086632dba913392b83faf29d513c9952f32ead527a2f41
c1a125e0538c7f978c8ca3c7c591a7309c25eb9d3231b04931d1df36980b39c3
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c3db29c686974ac99facae2d3fe9d4c7a5e077ed35accbf9be4ea40f3398b3b4
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c54a4d70398e66017625cccc15d6d0338b7f64ed0c197083d9c01607a964dba6
c5ac82b020340006a2a39a016936c48cb16b777d48d278da5095f5ab103ee031
c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2
c871f116084716e74638906e8f72d572ad0b429fe4ffd1e6524698f8863e6eed
c8b2d5d8e420ee3d3ac1cbaa1cce0809e1a3d20a9584f7f259d973d328d28d06
cc8f587e3095c0c067bc4a0393dc98fd4a795ca73a05c3ab628cfa218521f6c6
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d08677147d91dbb2607b77428b90c0d2ecc19bb9bd79f09253be2e008517a207
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d1c259ad7ec16db8f44cd5a795202083058eaa996e4b3b7a9f29af88c552b41e
d21b490fa72e9cd90e09db07c73ef43c0d65bf38de6a41dfd1c53338f71549a3
d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99
d3d4743801b05f2c918e65a6244cb6eebe0c4cc728c69a1383795cb3bc4b2ee4
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d72983b238351d09721849a10a2d5d051b2ce68e5584b4955bc77233b5a9426f
d8b080802cba44025db6515c924fd17cfba0f2d9123093aaa779d43f8a04a522
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e4230a318e0da81b2d5a52d7cf1ac911d61974c79cc28ab84040e15a22df36ea
e4cb43a37cc7a0cd47b7267f7d8abc84f6bc0f59fb640a1f8d80394a67a61443
e51a2be6b9ef83a35f3c668ee14a711245586dd5d64abec9609d71586063b5a0
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e8f71867a6991d5a1ba2b9cd33000e8d8691f6ba8864516946b62087de93aa85
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
ee39d0cbc9e9cd88b7dac8ebca680b89e8879081f855152f21772c7834474437
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3162a29ec6486e3baa2b24b6cc4fe0ac4dabf9068d4b458b114ebfaaea1abd
efe0158313c7c4a51647245388b73eed8e7f7a24fedb59fc82d43279050ba1c8
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6595a6cae5eae5be3d15f0f8a7a15ba74bc27f6140b101eb12ae167f598bddb
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1
fbeb296c1ecc216a17bda77bf65e833cc0410cfbe1908e121f7a4549cc390675
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fee4d039e94ad990d7dda71ba3c31837e903239eeeaa3fb8421052b6e3d7e5f3

www.menlosecurity.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

234 Requests

98 %HTTPS

52 %IPv6

37 Domains

53 Subdomains

44 IPs

5 Countries

3209 kBTransfer

8385 kBSize

43 Cookies

36 Outgoing links

Redirected requests

234 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.menlosecurity.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

234
Requests

98 %
HTTPS

52 %
IPv6

37
Domains

53
Subdomains

44
IPs

5
Countries

3209 kB
Transfer

8385 kB
Size

43
Cookies

234 HTTP transactions
0 data transactions