www.proofpoint.com Open in urlscan Pro
2a02:e980:d::87  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

• https://cloud.typography.com/7639856/7486392/css/fonts.css HTTP 302
• https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/697817/CC9BFD3B523351711.css

Request Chain 63

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=proofpoint.com&pId=575704853436825904

Request Chain 65

• https://www.google-analytics.com/r/collect?v=1&_v=j76&aip=1&a=674788676&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&ul=en-us&de=UTF-8&dt=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBAAEADQ~&jid=1591808538&gjid=84379260&cid=177286155.1561495119&tid=UA-2257074-1&_gid=56046661.1561495119&_r=1&z=78285988 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_gid=56046661.1561495119&gjid=84379260&_v=j76&z=78285988 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988&slf_rd=1&random=152612144

Request Chain 85

• https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1 HTTP 302
• https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1561495125612%26pid%3D169250%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fcorporate-blog%252Fpost%252Fthreat-week-h-work-houdinijacksbot-and-socgholish%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&cookiesTest=true&liSync=true

Request Chain 96

• https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=87df9df4d2ac339cf413f8cf660a44c4-1561495133281&pv=16581043197.420708&cookie=&adroll_s_ref=&keyw=&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish HTTP 302
• https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js

Request Chain 98

• https://d.adroll.com/cm/b/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
• https://x.bidswitch.net/sync?dsp_id=44&user_id=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc

Request Chain 99

• https://d.adroll.com/cm/x/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
• https://ib.adnxs.com/setuid?entity=172&code=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc

Request Chain 100

• https://d.adroll.com/cm/l/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
• https://idsync.rlcdn.com/377928.gif?partner_uid=0776a9a48face4683729bb1be1f8ffd7

Request Chain 101

• https://d.adroll.com/cm/o/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
• https://us-u.openx.net/w/1.0/sd?id=537103138&val=0776a9a48face4683729bb1be1f8ffd7 HTTP 302
• https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0776a9a48face4683729bb1be1f8ffd7

94 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
11 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request threat-week-h-work-houdinijacksbot-and-socgholish Show response www.proofpoint.com/us/corporate-blog/post/	57 KB 17 KB	826ms 805ms	Document text/html	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software nginx / Resource Hash 5ac80e0565daf375e26d5345d6b7c2370fe3b183a8f9418df7a67ca7e0f3801c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SameOrigin Request headers :method GET :authority www.proofpoint.com :scheme https :path /us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server nginx date Tue, 25 Jun 2019 20:38:38 GMT content-type text/html; charset=utf-8 x-drupal-cache MISS etag "1561450581-0" expires Wed, 26 Jun 2019 08:16:21 GMT x-content-type-options nosniff x-frame-options SameOrigin content-language en x-generator Drupal 7 (http://drupal.org) link <https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish>; rel="canonical",<https://www.proofpoint.com/us/node/33436>; rel="shortlink" cache-control public, max-age=86400 last-modified Tue, 25 Jun 2019 08:16:21 GMT vary Cookie,Accept-Encoding content-encoding gzip x-request-id v-83ed857e-9721-11e9-b014-4f7370971800 x-ah-environment prod age 44536 via varnish x-cache HIT x-cache-hits 13 accept-ranges bytes set-cookie visid_incap_177663=iCwWjQvLQkGTsjxgmbvtaEyGEl0AAAAAQUIPAAAAAACOpjrWODrZiORRlZN87whj; expires=Wed, 24 Jun 2020 14:39:31 GMT; path=/; Domain=.proofpoint.com incap_ses_473_177663=Pv27enxRM1NhTEsFZXCQBk2GEl0AAAAAKzpbTMTkF+8/34xQnJnQEA==; path=/; Domain=.proofpoint.com x-iinfo 10-42766560-42766561 NNNN CT(155 326 0) RT(1561495116624 0) q(0 0 5 0) r(6 8) U18 x-cdn Incapsula
GET H2	200	css_rEI_5cK_B9hB4So2yZUtr5weuEV3heuAllCDE6XsIkI.css www.proofpoint.com/sites/default/files/css/	4 KB 1 KB	12ms 8ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/css/css_rEI_5cK_B9hB4So2yZUtr5weuEV3heuAllCDE6XsIkI.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash ac423fe5c2bf07d841e12a36c9952daf9c1eb8457785eb8096508313a5ec2242 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 17:27:52 GMT x-cdn Incapsula etag "a03afbf5" content-type text/css status 200 x-iinfo 10-42766741-0 0CNN RT(1561495117438 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 1236 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	css_dflN4gznpSoqyE-fQqvdVodUm8IHE1_6p9W67RzHBgo.css www.proofpoint.com/sites/default/files/css/	21 KB 5 KB	13ms 9ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/css/css_dflN4gznpSoqyE-fQqvdVodUm8IHE1_6p9W67RzHBgo.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 75f94de20ce7a52a2ac84f9f42abdd5687549bc207135ffaa7d5baed1cc7060a Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 18 Jun 2019 16:20:40 GMT x-cdn Incapsula etag "e1b80d0d" content-type text/css status 200 x-iinfo 10-42766742-0 0CNN RT(1561495117440 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 4794 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	css_YvthmAHmOujLQtPnmuEtkfiby4EqNavjYNQ2dGZqvJg.css www.proofpoint.com/sites/default/files/css/	5 KB 2 KB	14ms 10ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/css/css_YvthmAHmOujLQtPnmuEtkfiby4EqNavjYNQ2dGZqvJg.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 62fb619801e63ae8cb42d3e79ae12d91f89bcb812a35abe360d43674666abc98 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 17:27:52 GMT x-cdn Incapsula etag "f67e2f41" content-type text/css status 200 x-iinfo 10-42766743-0 0CNN RT(1561495117442 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 1532 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	styles.css www.proofpoint.com/sites/all/themes/proofpoint/css/	338 KB 46 KB	18ms 14ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 9b6d554437d8768d7529b5db8a770612c290655904c8e3283a96675f155c52e2 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 11 Jun 2019 23:41:18 GMT x-cdn Incapsula content-type text/css status 200 x-iinfo 10-42766744-0 0CNN RT(1561495117445 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908789, public content-length 47184 expires Sat, 06 Jul 2019 09:05:06 GMT
GET H2	200	proofpoint.css www.proofpoint.com/sites/all/themes/proofpoint/css/	1008 B 544 B	23ms 19ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/css/proofpoint.css?pthq5s Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash c6687d159fd14a00a4b187ecfa840c0e21d5a28f352003295d8508190fbdd826 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Fri, 07 Dec 2018 08:45:31 GMT x-cdn Incapsula content-type text/css status 200 x-iinfo 10-42766745-0 0CNN RT(1561495117448 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908789, public content-length 439 expires Sat, 06 Jul 2019 09:05:06 GMT
GET H2	200	css_s4l5DAmzmU0ysIlyTizh4bjJDQYfEI-QUqAY82zVlxU.css www.proofpoint.com/sites/default/files/css/	170 KB 72 KB	23ms 20ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/css/css_s4l5DAmzmU0ysIlyTizh4bjJDQYfEI-QUqAY82zVlxU.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash b389790c09b3994d32b089724e2ce1e1b8c90d061f108f9052a018f36cd59715 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 18 Jun 2019 16:20:17 GMT x-cdn Incapsula etag "d37e015f" content-type text/css status 200 x-iinfo 10-42766746-0 0CNN RT(1561495117450 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 73906 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	css_nQwtytNsztHNRD8oGYQyyja_LgjxLi44qLISIPyImuw.css www.proofpoint.com/sites/default/files/css/	113 B 228 B	30ms 27ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/css/css_nQwtytNsztHNRD8oGYQyyja_LgjxLi44qLISIPyImuw.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 9d0c2dcad36cced1cd443f28198432ca36bf2e08f12e2e38a8b21220fc889aec Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Mon, 10 Jun 2019 20:25:06 GMT x-cdn Incapsula etag "3c611d61" content-type text/css status 200 x-iinfo 10-42766747-0 0CNN RT(1561495117451 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 113 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_jATlw3iucl8O1KM88pfP_buAg5xbrWmEgBVT94k-xFs.js Show response www.proofpoint.com/sites/default/files/js/	3 KB 2 KB	31ms 28ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_jATlw3iucl8O1KM88pfP_buAg5xbrWmEgBVT94k-xFs.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 8c04e5c378ae725f0ed4a33cf297cffdbb80839c5bad6984801553f7893ec45b Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 22:04:20 GMT x-cdn Incapsula etag "d70c6bae" content-type text/javascript status 200 x-iinfo 10-42766748-0 0CNN RT(1561495117454 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 1583 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_3qgnaHigafp4R77hVMnH-RrGklZofk2P8yZAA1imvl8.js Show response www.proofpoint.com/sites/default/files/js/	283 KB 84 KB	31ms 28ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_3qgnaHigafp4R77hVMnH-RrGklZofk2P8yZAA1imvl8.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash dea8276878a069fa7847bee154c9c7f91ac69256687e4d8ff326400358a6be5f Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 17:27:52 GMT x-cdn Incapsula etag "8a31ad1e" content-type text/javascript status 200 x-iinfo 10-42766749-0 0CNN RT(1561495117456 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 86345 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_rEBDA7lO3k86QBSEM6ztubthamPOgddNOiXV0JKALJc.js Show response www.proofpoint.com/sites/default/files/js/	33 KB 11 KB	34ms 32ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_rEBDA7lO3k86QBSEM6ztubthamPOgddNOiXV0JKALJc.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash ac404303b94ede4f3a40148433acedb9bb616a63ce81d74d3a25d5d092802c97 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Mon, 10 Jun 2019 20:25:08 GMT x-cdn Incapsula etag "30897f91" content-type text/javascript status 200 x-iinfo 10-42766750-0 0CNN RT(1561495117456 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 11176 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_oYQw43wAjKdM3p6nU1hLDI3mDgL3UfCyqPsngNU6GnY.js Show response www.proofpoint.com/sites/default/files/js/	2 KB 692 B	37ms 35ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_oYQw43wAjKdM3p6nU1hLDI3mDgL3UfCyqPsngNU6GnY.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash a18430e37c008ca74cde9ea753584b0c8de60e02f751f0b2a8fb2780d53a1a76 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Mon, 10 Jun 2019 20:25:08 GMT x-cdn Incapsula etag "f5226ed5" content-type text/javascript status 200 x-iinfo 10-42766751-0 0CNN RT(1561495117458 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 600 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_iP_-CfUo1OcWM1ltGYAPtUMwFjf2LCU6YATLj-hLKvA.js Show response www.proofpoint.com/sites/default/files/js/	90 KB 31 KB	37ms 35ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_iP_-CfUo1OcWM1ltGYAPtUMwFjf2LCU6YATLj-hLKvA.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 88fffe09f528d4e71633596d19800fb543301637f62c253a6004cb8fe84b2af0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Fri, 24 May 2019 21:14:23 GMT x-cdn Incapsula etag "339474c6" content-type text/javascript status 200 x-iinfo 10-42766752-0 0CNN RT(1561495117458 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908788, public content-length 31657 expires Sat, 06 Jul 2019 09:05:05 GMT
GET H2	200	js_W5fEOeIW0TWunhDVrtJI2tfSDJsF5U0-qYgg5VUhN50.js Show response www.proofpoint.com/sites/default/files/js/	13 KB 4 KB	38ms 36ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_W5fEOeIW0TWunhDVrtJI2tfSDJsF5U0-qYgg5VUhN50.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 5b97c439e216d135ae9e10d5aed248dad7d20c9b05e54d3ea98820e55521379d Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Mon, 10 Jun 2019 20:25:08 GMT x-cdn Incapsula etag "d82693c3" content-type text/javascript status 200 x-iinfo 10-42766753-0 0CNN RT(1561495117459 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908741, public content-length 3712 expires Sat, 06 Jul 2019 09:04:18 GMT
GET H2	200	js_LQsdP8_0epR8be5rScDla4in7ndNxnQ1G68DesVyUyQ.js Show response www.proofpoint.com/sites/default/files/js/	174 KB 51 KB	39ms 38ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_LQsdP8_0epR8be5rScDla4in7ndNxnQ1G68DesVyUyQ.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 2d0b1d3fcff47a947c6dee6b49c0e56b88a7ee774dc674351baf037ac5725324 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 18 Jun 2019 16:20:17 GMT x-cdn Incapsula etag "b016bd03" content-type text/javascript status 200 x-iinfo 10-42766754-0 0CNN RT(1561495117461 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908742, public content-length 52117 expires Sat, 06 Jul 2019 09:04:19 GMT
GET H2	200	logo-reg.svg www.proofpoint.com/sites/all/themes/proofpoint/	3 KB 1 KB	33ms 31ms	Image image/svg+xml	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/logo-reg.svg Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Fri, 07 Dec 2018 08:45:31 GMT x-cdn Incapsula etag "13fdd2ef" content-type image/svg+xml status 200 x-iinfo 10-42766755-0 0CNN RT(1561495117461 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=949488, public content-length 1124 expires Sat, 06 Jul 2019 20:23:25 GMT
GET H2	200	cybersecurity-guide.png www.proofpoint.com/sites/all/themes/proofpoint/images/	120 KB 120 KB	33ms 32ms	Image image/png	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/images/cybersecurity-guide.png Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 3140e03d8dd88ddfc2a9eefc88a3ae4b233c3f6182423775f83e22e16d072cd5 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT last-modified Wed, 24 Apr 2019 16:02:59 GMT x-cdn Incapsula etag "a3bc78f0" content-type image/png status 200 x-iinfo 10-42766756-0 0CNN RT(1561495117462 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908743, public content-length 123158 expires Sat, 06 Jul 2019 09:04:20 GMT
GET H2	200	home.svg www.proofpoint.com/sites/all/themes/proofpoint/images/	784 B 657 B	11ms 10ms	Image image/svg+xml	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/images/home.svg Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 18 Jun 2019 16:19:41 GMT x-cdn Incapsula etag "4c25cdee" content-type image/svg+xml status 200 x-iinfo 10-42766785-0 0CNN RT(1561495117613 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=953036, public content-length 477 expires Sat, 06 Jul 2019 21:22:33 GMT
GET H2	200	threatoftheweek.jpg www.proofpoint.com/sites/default/files/styles/image_1920_x_400/public/	142 KB 143 KB	804ms 803ms	Image image/jpeg	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/default/files/styles/image_1920_x_400/public/threatoftheweek.jpg?itok=1FHkpART&timestamp=1530887840 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software nginx / Resource Hash 660363a04f97b529da6b393c622e51a573aad22aa160bd8a2860982692fbce2d Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:38 GMT via varnish x-content-type-options nosniff x-cdn Incapsula age 37874 x-cache HIT status 200 x-iinfo 10-42766786-42763253 2NNN RT(1561495117613 0) q(0 0 0 -1) r(8 8) U18 x-ah-environment prod content-length 144977 x-request-id v-078e774e-9731-11e9-adb2-174aa4f8e5f7 last-modified Fri, 14 Dec 2018 19:11:32 GMT server nginx content-type image/jpeg expires Tue, 09 Jul 2019 10:07:24 GMT cache-control max-age=1209600 accept-ranges bytes x-cache-hits 6
GET H2	200	conversion.js Show response www.googleadservices.com/pagead/	24 KB 10 KB	3086ms 24ms	Script text/javascript	172.217.23.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s22-in-f2.1e100.net Software cafe / Resource Hash 1448d19eebf777a4b07f5f9a70629878cf9fd04c305247d95103da42cdd502bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:41 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39" content-length 9306 x-xss-protection 0 server cafe etag 11690690496941220196 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 25 Jun 2019 20:38:41 GMT
GET H/1.1	403 Forbidden	tc.js cdn.lift.acquia.com/Proofpoint/	0 0	3486ms 377ms	Script application/xml	52.222.157.71 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cdn.lift.acquia.com/Proofpoint/tc.js?v=7.65 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.222.157.71 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-52-222-157-71.fra53.r.cloudfront.net Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	200	js_B9q-kGhMDxy17fIVLQN0oYo23EraMWfUQEKNrbS1byU.js Show response www.proofpoint.com/sites/default/files/js/	93 KB 23 KB	9ms 7ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_B9q-kGhMDxy17fIVLQN0oYo23EraMWfUQEKNrbS1byU.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 07dabe90684c0f1cb5edf2152d0374a18a36dc4ada3167d440428dadb4b56f25 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 18 Jun 2019 17:04:42 GMT x-cdn Incapsula etag "7a931267" content-type text/javascript status 200 x-iinfo 10-42766782-0 0CNN RT(1561495117611 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908742, public content-length 23170 expires Sat, 06 Jul 2019 09:04:19 GMT
GET H2	200	js_J4TY7zxNSzw1vGgzlPvvTzNhq3-pSWH1216U4CeDujE.js Show response www.proofpoint.com/sites/default/files/js/	18 KB 6 KB	10ms 8ms	Script text/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/default/files/js/js_J4TY7zxNSzw1vGgzlPvvTzNhq3-pSWH1216U4CeDujE.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 2784d8ef3c4d4b3c35bc683394fbef4f3361ab7fa94961f5db5e94e02783ba31 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 17:28:14 GMT x-cdn Incapsula etag "2d18b5c1" content-type text/javascript status 200 x-iinfo 10-42766783-0 0CNN RT(1561495117612 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908789, public content-length 6286 expires Sat, 06 Jul 2019 09:05:06 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	7146ms 19ms	Script application/x-javascript	23.38.33.240 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.38.33.240 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-38-33-240.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 25 Jun 2019 20:38:45 GMT Content-Encoding gzip Last-Modified Fri, 05 Apr 2019 02:53:44 GMT Server Apache ETag "54520320df20b526337717d6d28181fc:1554432824" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	script.js Show response www.proofpoint.com/sites/all/themes/proofpoint/js/	23 KB 6 KB	11ms 9ms	Script application/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/js/script.js?pthq5s Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 77336156422eb2dc1fde6725f01a30e6ded31961d663cee37bf23e49438f2305 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Thu, 20 Jun 2019 20:37:01 GMT x-cdn Incapsula content-type application/javascript status 200 x-iinfo 10-42766784-0 0CNN RT(1561495117612 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908789, public content-length 5855 expires Sat, 06 Jul 2019 09:05:06 GMT
GET H2	200	css fonts.googleapis.com/	4 KB 708 B	21ms 12ms	Stylesheet text/css	2a00:1450:4001:819::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 61888377ea3de737d925ead7db6168e20da9c61e54f8dd59ed17f08e8d91675f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 25 Jun 2019 20:38:38 GMT server ESF access-control-allow-origin * date Tue, 25 Jun 2019 20:38:38 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Tue, 25 Jun 2019 20:38:38 GMT
GET H2	200	CC9BFD3B523351711.css www.proofpoint.com/sites/all/themes/proofpoint/fonts/697817/ Redirect Chain https://cloud.typography.com/7639856/7486392/css/fonts.css https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/697817/CC9BFD3B523351711.css	80 KB 60 KB	7ms 6ms	Stylesheet text/css	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/697817/CC9BFD3B523351711.css Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 78d2d4a7849d5645bd0305ad67a43dcd77bceb5c8d60a92ed46fceca52ba4ac1 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 11 Dec 2018 17:22:01 GMT x-cdn Incapsula etag "cccce245" content-type text/css status 200 x-iinfo 10-42766762-0 0CNN RT(1561495117529 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=910829, public content-length 60789 expires Sat, 06 Jul 2019 09:39:06 GMT Redirect headers Date Tue, 25 Jun 2019 20:38:38 GMT Last-Modified Mon, 12 Nov 2018 21:08:11 GMT Server Apache ETag "bbde2a3dc25bac3ba17f4814e42faabd:1542056890" Vary Accept-Encoding Content-Type text/html Location https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/697817/CC9BFD3B523351711.css Cache-Control must-revalidate, private Connection keep-alive X-HCo-pid 14 Content-Length 154 Expires Tue, 25 June 2019 20:38:38 GMT
GET H2	200	css fonts.googleapis.com/	3 KB 631 B	21ms 13ms	Stylesheet text/css	2a00:1450:4001:819::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash bce8d83ff7169cb40931a6982ac10ae77fa2cce5ef98980dd2305784e3699744 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 25 Jun 2019 20:38:38 GMT server ESF access-control-allow-origin * date Tue, 25 Jun 2019 20:38:38 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Tue, 25 Jun 2019 20:38:38 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:818::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash 8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 21 May 2019 23:53:44 GMT server Golfe2 age 6691 date Tue, 25 Jun 2019 18:47:07 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 17595 expires Tue, 25 Jun 2019 20:47:07 GMT
GET DATA	200 OK	truncated /	251 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 46454a26b3142dec4540c21c9c156f2b3e570488667f1bbcf81854e27925f2a4 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	263 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 479f333c6cdf10724e19b33079cab821bb37b0a463170ea9943dcbc0c6d9dc67 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 91221ebe7decdf80fc3cfddffa7595ff915be4af1a9a5620fc9c138bf6cc0363 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	562 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a8bac03a9bf9bff1a50a992ffe70257f2c6a24e0cc79ba4c268baf19c9ca2880 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	588 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 047ef44b759411ac70b47ffb1c29a2814d34ec9aa7cf12a927340128500bc9fe Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e7e6695bf782bd4b52cc817b8adba3d03973c348cea7622ecb06ab94165c4d0f Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1006 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash df7b034e11f350b02f383677a2c37d598922ad494d0e0241ad5740313332a5c8 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e675880ebe2bfb0c3364d32f0ea5569eb1d50d4b18fd15c644cf67ce098e04ed Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3886459ca89f9ca7588cc412ddb3b279947acec2258c42c065bc044ce67276c0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6015b6cdafa09835ca9f65f2d9e211f3e120f8da2760401c7ba5e9520a260c37 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Proofpoint-logo-reg-Reversed.png www.proofpoint.com/sites/all/themes/proofpoint/images/	45 KB 45 KB	6ms 6ms	Image image/png	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/images/Proofpoint-logo-reg-Reversed.png Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70 Request headers Referer https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT last-modified Fri, 07 Dec 2018 08:45:31 GMT x-cdn Incapsula etag "c8a80c4c" content-type image/png status 200 x-iinfo 10-42766788-0 0CNN RT(1561495117625 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=908743, public content-length 46089 expires Sat, 06 Jul 2019 09:04:20 GMT
GET H2	200	earth.svg www.proofpoint.com/sites/all/themes/proofpoint/images/	3 KB 1 KB	6ms 6ms	Image image/svg+xml	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/images/earth.svg Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash b7eab4c7c851a155bd46eb51790debc67d6f4b076d8b7070da3bb77abab18448 Request headers Referer https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Wed, 24 Apr 2019 16:02:59 GMT x-cdn Incapsula etag "6222cb97" content-type image/svg+xml status 200 x-iinfo 10-42766789-0 0CNN RT(1561495117626 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=949489, public content-length 1355 expires Sat, 06 Jul 2019 20:23:26 GMT
GET H2	200	ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2 fonts.gstatic.com/s/robotocondensed/v17/	11 KB 11 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:814::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/robotocondensed/v17/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed Origin https://www.proofpoint.com Response headers date Sun, 02 Jun 2019 16:15:11 GMT x-content-type-options nosniff last-modified Mon, 25 Mar 2019 20:13:46 GMT server sffe age 2003007 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 10968 x-xss-protection 0 expires Mon, 01 Jun 2020 16:15:11 GMT
GET H2	200	BebasNeue-Bold.woff2 www.proofpoint.com/sites/all/themes/proofpoint/fonts/	13 KB 13 KB	6ms 6ms	Font application/octet-stream	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/BebasNeue-Bold.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash e2eb28c4292664b548ad2c8ecf855b1f425a08966c5b413a4a0184b6ff52a509 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s Origin https://www.proofpoint.com Response headers date Tue, 25 Jun 2019 20:38:37 GMT last-modified Fri, 07 Dec 2018 08:47:10 GMT x-cdn Incapsula etag "c0148429" status 200 x-iinfo 10-42766791-0 0CNN RT(1561495117628 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=949489, public content-length 13140 expires Sat, 06 Jul 2019 20:23:26 GMT
GET H2	200	Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2 fonts.gstatic.com/s/fjallaone/v6/	11 KB 12 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/fjallaone/v6/Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 529e77ee17cf48e9ccbb5a64a0e59a1bbda0d9c011ee061f40b1aa189e8fabb8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed Origin https://www.proofpoint.com Response headers date Tue, 18 Jun 2019 09:47:24 GMT x-content-type-options nosniff last-modified Tue, 19 Feb 2019 22:35:38 GMT server sffe age 643874 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11668 x-xss-protection 0 expires Wed, 17 Jun 2020 09:47:24 GMT
GET H2	200	proofpoint.woff2 www.proofpoint.com/sites/all/themes/proofpoint/fonts/	18 KB 18 KB	6ms 6ms	Font application/octet-stream	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/proofpoint.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s Origin https://www.proofpoint.com Response headers date Tue, 25 Jun 2019 20:38:37 GMT last-modified Fri, 07 Dec 2018 08:45:31 GMT x-cdn Incapsula etag "01c16c31" status 200 x-iinfo 10-42766792-0 0CNN RT(1561495117630 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=949489, public content-length 18296 expires Sat, 06 Jul 2019 20:23:26 GMT
GET H2	200	BebasNeue-Regular.woff2 www.proofpoint.com/sites/all/themes/proofpoint/fonts/	27 KB 27 KB	6ms 6ms	Font application/octet-stream	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/BebasNeue-Regular.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 94761f99487dcae4d91af9d25f37227af94965157adee62bd2f503645ded4fc7 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pthq5s Origin https://www.proofpoint.com Response headers date Tue, 25 Jun 2019 20:38:37 GMT last-modified Fri, 07 Dec 2018 08:47:10 GMT x-cdn Incapsula etag "f80c5766" status 200 x-iinfo 10-42766797-0 0CNN RT(1561495117638 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=953037, public content-length 27220 expires Sat, 06 Jul 2019 21:22:34 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	145 KB 34 KB	23ms 22ms	Script application/javascript	2a00:1450:4001:81b::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 078a181675a102668f6dd53a016d7f80fe18c9a225eaf1962040fad9ed8df3cb Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:38 GMT content-encoding br alt-svc quic=":443"; ma=2592000; v="46,44,43,39" server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 34919 x-xss-protection 0 expires Tue, 25 Jun 2019 20:38:38 GMT
GET		MP9Jyqtx.min.js scripts.demandbase.com/	0 0
GET H2	200	js Show response www.google-analytics.com/gtm/	65 KB 24 KB	23ms 23ms	Script application/javascript	2a00:1450:4001:818::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-KKGL4NZ&cid=177286155.1561495119&aip=true Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 1a5ba899692b83acd963530777311246713db185a1d2c7f79180a112ffc620b5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:38 GMT content-encoding br alt-svc quic=":443"; ma=2592000; v="46,44,43,39" server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 24271 x-xss-protection 0 expires Tue, 25 Jun 2019 20:38:38 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	23 KB 9 KB	2837ms 25ms	Script text/javascript	172.217.23.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s22-in-f2.1e100.net Software cafe / Resource Hash f1e6382aa070301007ee92dbaaef83c9f6075f9d86ee3632c82a609f02c6fc1f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:41 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39" content-length 8912 x-xss-protection 0 server cafe etag 11386026576561889187 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 25 Jun 2019 20:38:41 GMT
GET H2	200	bat.js Show response bat.bing.com/	23 KB 7 KB	100ms 47ms	Script application/javascript	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash 134d9689dd766fbea01b7b16563704e655883a93b76f55a6acf999f67510f8b5 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:37 GMT content-encoding gzip last-modified Tue, 28 May 2019 20:50:22 GMT x-msedge-ref Ref A: 9798E107B1844F3E8317EF99D55B74B8 Ref B: VIEEDGE1117 Ref C: 2019-06-25T20:38:38Z access-control-allow-origin * etag "03b90f79615d51:0" vary Accept-Encoding content-type application/javascript status 200 cache-control private,max-age=1800 accept-ranges bytes content-length 7112
GET H/1.1	200 OK	insight.min.js Show response sjs.bizographics.com/	15 KB 5 KB	50ms 6ms	Script application/x-javascript	2a02:26f0:6c00:2bf::3adf AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sjs.bizographics.com/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2bf::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 25 Jun 2019 20:38:38 GMT Content-Encoding gzip Last-Modified Mon, 03 Dec 2018 23:03:30 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=26490 Connection keep-alive Accept-Ranges bytes Content-Length 4571
GET		uwt.js static.ads-twitter.com/	0 0
GET		hotjar-933369.js static.hotjar.com/c/	0 0
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	53 KB 17 KB	52ms 5ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 vary Origin, Accept-Encoding content-length 16120 x-xss-protection 0 pragma public x-fb-debug IY3NIfA5WspGv7HhhFTyhkxSYBIMEckovi8/+OBMfieMJUnsLFTC0mndOiPHuNPzIL8sR5RCMhS8uZ44wdWO+w== x-fb-trip-id 1372681640 date Tue, 25 Jun 2019 20:38:38 GMT x-frame-options DENY access-control-allow-methods OPTIONS content-type application/x-javascript; charset=utf-8 access-control-allow-origin https://connect.facebook.net access-control-expose-headers X-FB-Debug, X-Loader-Length cache-control public, max-age=1200 access-control-allow-credentials true content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET		s ads.avocet.io/	0 0
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	899 B 672 B	5036ms 7ms	Script application/javascript	159.122.87.153 SoftLayer Technol...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=359897&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&r=0.5476413558964737 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 159.122.87.153 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US), Reverse DNS 99.57.7a9f.ip4.static.sl-reverse.com Software dacdn2 / Resource Hash eabb8d06462c7f3eb0c646968d18a9defc2e8d0f535fa14ab19b0c682217aa62 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Tue, 25 Jun 2019 20:38:42 GMT content-encoding gzip server dacdn2 content-type application/javascript; charset=UTF-8
GET H2	403	1594.js tracking.g2crowd.com/attribution_tracking/conversions/	0 0	92ms 29ms	Script text/html	2606:4700::6812:f0e5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish&e= Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f0e5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	403	1644.js tracking.g2crowd.com/attribution_tracking/conversions/	0 0	40ms 18ms	Script text/html	2606:4700::6812:f0e5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish&e= Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f0e5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	403	1645.js tracking.g2crowd.com/attribution_tracking/conversions/	0 0	25ms 24ms	Script text/html	2606:4700::6812:f0e5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish&e= Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f0e5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	403	1646.js tracking.g2crowd.com/attribution_tracking/conversions/	0 0	31ms 30ms	Script text/html	2606:4700::6812:f0e5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish&e= Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f0e5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	403	1647.js tracking.g2crowd.com/attribution_tracking/conversions/	0 0	14ms 13ms	Script text/html	2606:4700::6812:f0e5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish&e= Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:f0e5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software / Resource Hash Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	200	main.rtfl.js Show response visitor.reactful.com/dist/	252 KB 98 KB	83ms 23ms	Script application/javascript	2a00:1450:4001:825::2013 Google LLC
General Check archive.org Show headers Download Go to Full URL https://visitor.reactful.com/dist/main.rtfl.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:825::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Frontend / Resource Hash bbc22113c7ef3720e304275594d7eb23bd68267fa75a4575735cf6c37910082a Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:37:32 GMT content-encoding gzip server Google Frontend age 66 etag "eNgCLw" content-type application/javascript; charset=UTF-8 status 200 x-cloud-trace-context 2d2b9f1cb5a239d5c22786e7e9a2dd69 cache-control public, max-age=600 content-length 99578 expires Tue, 25 Jun 2019 20:47:32 GMT
GET		ip.json api.company-target.com/api/v2/	0 0
GET		/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=proofpoint.com&pId=575704853436825904	0 0
GET		img gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/	0 0
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j76&aip=1&a=674788676&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-soc... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_gid=56046661.1561495119&gjid=84379260&_v=j76&z=78285988 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988&slf_rd=1&random=152612144	42 B 109 B	27ms 27ms	Image image/gif	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988&slf_rd=1&random=152612144 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=177286155.1561495119&jid=1591808538&_v=j76&z=78285988&slf_rd=1&random=152612144 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	143852102935619 Show response connect.facebook.net/signals/config/	228 KB 60 KB	131ms 130ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/143852102935619?v=2.8.51&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 00539b8aca52f9c006d925d3043f16f092f43e8b0bfdd49a79ee56018ccff94e Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 vary Origin, Accept-Encoding x-xss-protection 0 pragma public x-fb-debug uW7N6HQaBGgNwYun1TEIpp1fzLKl+5u5ukaCl6lHgSUg36E6N3UeX0gY87d1WGGeZ5SDn/G337iTh8auQwWWFw== x-fb-trip-id 1372681640 date Tue, 25 Jun 2019 20:38:38 GMT x-frame-options DENY access-control-allow-methods OPTIONS content-type application/x-javascript; charset=utf-8 access-control-allow-origin https://connect.facebook.net access-control-expose-headers X-FB-Debug, X-Loader-Length cache-control public, max-age=1200 access-control-allow-credentials true content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 171 B	51ms 51ms	Image text/plain	2620:1ec:c11::200 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=17087961&Ver=2&mid=d25fcd3f-432b-bb14-c341-c023aba224d5&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&r=&evt=pageLoad&msclkid=N&rn=422666 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 pragma no-cache date Tue, 25 Jun 2019 20:38:38 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 3E116299FC9144388E95164C248DDFE3 Ref B: VIEEDGE1117 Ref C: 2019-06-25T20:38:38Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	inferredEvents.js Show response connect.facebook.net/signals/plugins/	1 KB 921 B	7ms 6ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.8.51 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 vary Origin, Accept-Encoding content-length 772 x-xss-protection 0 pragma public x-fb-debug i8V6xQJZsaBbzTOvANyfSTZjTqxCfZSN4luhz1qg0Fb0pFnRjyA3fdtPDK35QohdshFLH/OvuXhX7IdMprxLlA== x-fb-trip-id 1372681640 date Tue, 25 Jun 2019 20:38:41 GMT x-frame-options DENY access-control-allow-methods OPTIONS content-type application/x-javascript; charset=utf-8 access-control-allow-origin https://connect.facebook.net access-control-expose-headers X-FB-Debug, X-Loader-Length cache-control public, max-age=1200 access-control-allow-credentials true content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ Show response visitor.reactful.com/config/879986/	11 KB 4 KB	2105ms 2084ms	XHR text/html	2a00:1450:4001:825::2013 Google LLC
General Check archive.org Show headers Download Go to Full URL https://visitor.reactful.com/config/879986/?page=%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&hash=&referer=&user_id=&hshkgid=2d4ca2dc-f88b-4b26-9d36-69d18fb8b15a&cb_rtfl=_rtfl_jsonp_0 Requested by Host: visitor.reactful.com URL: https://visitor.reactful.com/dist/main.rtfl.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:825::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Frontend / Resource Hash 30730f507359d0e500cf5d7aa5d359e04f3bb4b32dbc27828d4f28a648b0544b Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Origin https://www.proofpoint.com Response headers date Tue, 25 Jun 2019 20:38:40 GMT content-encoding gzip server Google Frontend status 200 vary Accept-Encoding access-control-allow-methods GET, OPTIONS p3p CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM" access-control-allow-origin https://www.proofpoint.com x-cloud-trace-context c1049b1da8ebce2be22bd0d96f0b422e cache-control no-cache access-control-allow-credentials true content-type text/html; charset=utf-8 access-control-allow-headers Six-Sense-Data,Custom-Vars-Data content-length 3810 expires Tue, 25 Jun 2019 20:38:40 GMT
GET BLOB	200 OK	68a1ae9e-0399-486b-a681-2bba1c5ab729 Show response https://www.proofpoint.com/	11 KB 0		Script text/html
General Check archive.org Show headers Download Go to Full URL blob:https://www.proofpoint.com/68a1ae9e-0399-486b-a681-2bba1c5ab729 Requested by Host: visitor.reactful.com URL: https://visitor.reactful.com/dist/main.rtfl.js Protocol BLOB Security , , Server -, , ASN (), Reverse DNS Software / Resource Hash 30730f507359d0e500cf5d7aa5d359e04f3bb4b32dbc27828d4f28a648b0544b Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Length 11564 Content-Type text/html
POST H2	200	/ Show response tracking.reactful.com/tracking/879986/	6 B 193 B	188ms 145ms	XHR text/html	2a00:1450:4001:81a::2013 Google LLC
General Check archive.org Show headers Download Go to Full URL https://tracking.reactful.com/tracking/879986/ Requested by Host: visitor.reactful.com URL: https://visitor.reactful.com/dist/main.rtfl.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Frontend / Resource Hash cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56 Request headers Accept */* Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Origin https://www.proofpoint.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 25 Jun 2019 20:38:41 GMT content-encoding gzip server Google Frontend status 200 vary Accept-Encoding content-type text/html; charset=utf-8 access-control-allow-origin * x-cloud-trace-context 4fd39632cd833f9cf4bb426d5038d239 cache-control no-cache content-length 26
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/	2 KB 1 KB	48ms 48ms	Script text/javascript	2a00:1450:4001:818::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1561495121390&cv=9&fst=1561495121390&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef296f29bc7e1c828417ebbfc13c6b2b079bf656b618b706739f0921ca64200f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39" content-length 1016 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/	2 KB 1 KB	19ms 19ms	Script text/javascript	2a00:1450:4001:818::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1561495121398&cv=9&fst=1561495121398&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6c0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 00410c5c5f9bc2982e4aafe191fd826a559609f305265011c17dbb707604e10c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39" content-length 1030 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/950296937/	42 B 110 B	21ms 21ms	Image image/gif	2a00:1450:4001:824::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/950296937/?random=1561495121398&cv=9&fst=1561492800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6c0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&async=1&fmt=3&cdct=2&is_vtc=1&random=3138722824&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/950296937/	42 B 156 B	32ms 31ms	Image image/gif	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/950296937/?random=1561495121398&cv=9&fst=1561492800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg6c0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&async=1&fmt=3&cdct=2&is_vtc=1&random=3138722824&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 322 B	24ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&rl=&if=false&ts=1561495121433&sw=1600&sh=1200&v=2.8.51&r=stable&ec=0&o=30&fbp=fb.1.1561495121431.146367679&it=1561495118621&coo=false&rqm=GET Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:41 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Tue, 25 Jun 2019 20:38:41 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/950296937/	42 B 110 B	25ms 24ms	Image image/gif	2a00:1450:4001:824::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/950296937/?random=1561495121390&cv=9&fst=1561492800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&fmt=3&cdct=2&is_vtc=1&random=1551527697&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/950296937/	42 B 110 B	24ms 23ms	Image image/gif	2a00:1450:4001:81f::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/950296937/?random=1561495121390&cv=9&fst=1561492800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&tiba=Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint&fmt=3&cdct=2&is_vtc=1&random=1551527697&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:41 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 99 B	7ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=143852102935619&ev=Microdata&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&rl=&if=false&ts=1561495121937&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%20%7C%20Proofpoint%22%2C%22meta%3Adescription%22%3A%22%20Each%20week%20we%20host%20a%20Threat%20of%20the%20Week%20webinar%20featuring%20a%20high-level%20look%20at%20interesting%20threats%20to%20help%20security%20teams%20navigate%20the%20attack%20landscape.%20Last%20week%2C%20we...%22%7D&cd[OpenGraph]=%7B%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish%22%2C%22og%3Atitle%22%3A%22Threat%20of%20the%20Week%3A%20H-Work%20(Houdini)%2FJacksbot%20and%20SocGholish%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.proofpoint.com%2Fsites%2Fdefault%2Ffiles%2Fthreatoftheweek.jpg%22%2C%22article%3Apublished_time%22%3A%222018-06-29T17%3A12%3A30-07%3A00%22%2C%22article%3Amodified_time%22%3A%222019-01-27T12%3A27%3A47-08%3A00%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.8.51&r=stable&ec=1&o=30&fbp=fb.1.1561495121431.146367679&it=1561495118621&coo=false&es=automatic&rqm=GET Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:41 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Tue, 25 Jun 2019 20:38:41 GMT
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 236 B	8ms 7ms	Image image/gif	159.122.87.153 SoftLayer Technol...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?a=359897&d=proofpoint.com&u=DE9274333B395DFD21E80B651E68F4AB6&h=8072b2dbe13ce8050f5a8d67e52f87be&t=true&r=0.7509356104338725 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 159.122.87.153 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US), Reverse DNS 99.57.7a9f.ip4.static.sl-reverse.com Software dacdn2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:38:42 GMT x-content-type-options nosniff server dacdn2 content-type image/gif status 200 cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/155/	9 KB 4 KB	15ms 15ms	Script application/x-javascript	23.38.33.240 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/155/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.38.33.240 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-38-33-240.deploy.static.akamaitechnologies.com Software Apache / Resource Hash efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 25 Jun 2019 20:38:45 GMT Content-Encoding gzip Last-Modified Fri, 30 Nov 2018 03:18:20 GMT Server Apache ETag "c67dad42946949112916578f78706df8:1543547900" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3923 Expires Thu, 03 Oct 2019 20:38:45 GMT
GET H2	200	iframe_api Show response www.youtube.com/	859 B 944 B	23ms 23ms	Script application/javascript	2a00:1450:4001:814::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/sites/all/themes/proofpoint/js/script.js?pthq5s Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software YouTube Frontend Proxy / Resource Hash 1b8f031245f4014208a7b07d0494ef3a2dd43a4a30b5ed7f4385a7e26b01037e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:45 GMT x-content-type-options nosniff server YouTube Frontend Proxy content-type application/javascript status 200 cache-control no-cache alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 859 x-xss-protection 0 expires Tue, 27 Apr 1971 19:44:06 EST
GET H2	200	_Incapsula_Resource Show response www.proofpoint.com/	112 KB 16 KB	10ms 10ms	Script application/javascript	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Full URL https://www.proofpoint.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=419493562 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash 94d20a53c7bba78070bc90cb244f0ab716b0e4b3904803badb9246a5efce974f Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 content-encoding gzip cache-control no-cache content-length 16433 content-type application/javascript
GET H2	200	addthis_widget.js Show response s7.addthis.com/js/300/	344 KB 110 KB	2804ms 24ms	Script application/javascript	23.210.248.44 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/js/300/addthis_widget.js?_=1561495125607 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/sites/default/files/js/js_3qgnaHigafp4R77hVMnH-RrGklZofk2P8yZAA1imvl8.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 5e4fc2a9f143ce79202a0978e34d48650075032ba6be805e1219cbe2f6d25a80 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:48 GMT content-encoding gzip last-modified Tue, 25 Jun 2019 19:16:58 GMT etag "5d12732a-56165" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 x-host s7.addthis.com accept-ranges bytes
GET H2	200	/ Show response px.ads.linkedin.com/collect/ Redirect Chain https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1 https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&c... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1561495125612%26pid%3D169250%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fcorporate... https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&c...	0 98 B	242ms 241ms	Script application/javascript	2a05:f500:11:101::b93f:9005 LinkedIn Corporation
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&cookiesTest=true&liSync=true Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:38:46 GMT content-encoding gzip server Play vary Accept-Encoding x-li-fabric prod-lor1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 20 x-li-uuid +1LkW4+LqxUgKlQDsSoAAA== Redirect headers date Tue, 25 Jun 2019 20:38:46 GMT content-encoding gzip x-content-type-options nosniff status 302 x-li-pop prod-tln1 content-length 20 x-li-uuid lKHKRYqLqxVABuy3kCsAAA== pragma no-cache server Play x-frame-options sameorigin expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" vary Accept-Encoding strict-transport-security max-age=2592000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect/?time=1561495125612&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&fmt=js&s=1&cookiesTest=true&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	css fonts.googleapis.com/	24 KB 1 KB	17ms 17ms	Stylesheet text/css	2a00:1450:4001:819::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic Requested by Host: visitor.reactful.com URL: https://visitor.reactful.com/dist/main.rtfl.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash ce2dc45c0adef73039fafb13f6147ac6d4e9c27f5e2839126500fa3eef483c34 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 25 Jun 2019 20:38:45 GMT server ESF access-control-allow-origin * date Tue, 25 Jun 2019 20:38:45 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Tue, 25 Jun 2019 20:38:45 GMT
POST H2	200	/ Show response tracking.reactful.com/tracking/879986/	6 B 115 B	131ms 131ms	XHR text/html	2a00:1450:4001:81a::2013 Google LLC
General Check archive.org Show headers Download Go to Full URL https://tracking.reactful.com/tracking/879986/ Requested by Host: visitor.reactful.com URL: https://visitor.reactful.com/dist/main.rtfl.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Frontend / Resource Hash cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56 Request headers Accept */* Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Origin https://www.proofpoint.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 25 Jun 2019 20:38:45 GMT content-encoding gzip server Google Frontend status 200 vary Accept-Encoding content-type text/html; charset=utf-8 access-control-allow-origin * x-cloud-trace-context d9849908ce541c1d6e6ca287da88f4e5 cache-control no-cache content-length 26
GET DATA	200 OK	truncated /	562 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5fde80b0aaf01a7fe4f8de3dbb671abadb59a30f6143e828b8000ac4fa9a45ec Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	32 KB 11 KB	6757ms 24ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 8aa2d4a076b1df43e751a2dca70d57a2c6098758addfc7c13e7076337564e0fd Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id Y2HhOfr_kKpiwiGZEOdqRmM2sQhnK_2O Content-Encoding gzip x-amz-request-id AA50DE7108927E5D x-amz-server-side-encryption AES256 Access-Control-Max-Age 600 Date Tue, 25 Jun 2019 20:38:52 GMT Connection keep-alive Content-Length 10323 x-amz-id-2 zBgZZy+7svyNRx5F9Ocx+DrtPjRMYxE5oZPEgt+wax1VW25Mj78UDrD84NF0eZCuFDLzkKTh+xk= Last-Modified Mon, 10 Jun 2019 19:13:27 GMT Server AmazonS3 ETag "089df3afc0b2c1dede17edfaf42eee33" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2 fonts.gstatic.com/s/opensans/v16/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic Origin https://www.proofpoint.com Response headers date Tue, 18 Jun 2019 10:05:10 GMT x-content-type-options nosniff last-modified Mon, 25 Mar 2019 20:11:28 GMT server sffe age 642815 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9016 x-xss-protection 0 expires Wed, 17 Jun 2020 10:05:10 GMT
GET H2	200	mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 fonts.gstatic.com/s/opensans/v16/	9 KB 9 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:814::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic Origin https://www.proofpoint.com Response headers date Tue, 18 Jun 2019 13:11:30 GMT x-content-type-options nosniff last-modified Mon, 25 Mar 2019 20:10:29 GMT server sffe age 631635 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9132 x-xss-protection 0 expires Wed, 17 Jun 2020 13:11:30 GMT
GET H2	200	_Incapsula_Resource www.proofpoint.com/	1 B 34 B	6ms 5ms	Image text/plain	2a02:e980:d::87 Incapsula Inc
General Check archive.org Show headers Download Go to Show image Full URL https://www.proofpoint.com/_Incapsula_Resource?SWKMTFSR=1&e=0.3847445301211221 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 cache-control no-cache content-length 1 content-type text/plain
GET H/1.1	200 OK	visitWebPage Show response 309-rhv-619.mktoresp.com/webevents/	43 B 622 B	10926ms 102ms	XHR image/gif	199.15.213.19 MARKETO
General Check archive.org Show headers Download Go to Full URL https://309-rhv-619.mktoresp.com/webevents/visitWebPage?_mchNc=1561495125735&_mchCn=&_mchId=309-RHV-619&_mchTk=_mch-proofpoint.com-1561495125735-71426&_mchHo=www.proofpoint.com&_mchPo=&_mchRu=%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/155/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.15.213.19 , United States, ASN53580 (MARKETO - MARKETO, Inc., US), Reverse DNS Software Apache / Resource Hash cbbd42bb1d88693e6805bd9d676840424af5ecf3e13d874fd06e6b57d53d8d40 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Origin https://www.proofpoint.com Response headers Pragma no-cache Date Tue, 25 Jun 2019 20:38:56 GMT X-Content-Type-Options nosniff Last-Modified Tue, 25 Jun 2019 15:38:56 -0500 Server Apache P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Access-Control-Allow-Origin * Cache-Control no-cache Connection Keep-Alive Content-Type image/gif Keep-Alive timeout=5, max=100 Content-Length 43 Expires -1
GET H2	200	www-widgetapi.js Show response s.ytimg.com/yts/jsbin/www-widgetapi-vflE27ZKb/	21 KB 8 KB	54ms 6ms	Script text/javascript	2a00:1450:4001:81e::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://s.ytimg.com/yts/jsbin/www-widgetapi-vflE27ZKb/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 1f0a166a9d871f1e11e7f24c885812e39ece64afa502c72bfbb766568bc8013d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 23 Jun 2019 06:20:14 GMT content-encoding gzip x-content-type-options nosniff age 224311 status 200 alt-svc quic=":443"; ma=2592000; v="46,44,43,39" content-length 8141 x-xss-protection 0 last-modified Sat, 22 Jun 2019 15:59:20 GMT server sffe vary Accept-Encoding, Origin content-type text/javascript cache-control public, max-age=691200 accept-ranges bytes timing-allow-origin https://www.youtube.com expires Mon, 01 Jul 2019 06:20:14 GMT
GET H/1.1	200 OK	7YJ7XZCLMRHSVCXIHB5HIT Show response d.adroll.com/consent/check/	40 B 499 B	883ms 33ms	Script application/javascript	176.34.190.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT?_s=fa9098816e05d7f6c040d52d5a1b3d9c Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 176.34.190.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-176-34-190-23.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash 867bd168728faba904fe15de941932d1d7537130b0edb918970901435cf39929 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 25 Jun 2019 20:38:53 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type application/javascript Content-Length 40
GET H/1.1	200 OK	T47Y2VPPABDUBJXFROMZZM.js Show response s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/ Redirect Chain https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=87df9df4d2ac339cf413f8cf660a44c4-1561495133281&pv=16581043197.420708&cookie=&adroll_s_ref=&keyw=&arrfrr=https%3A%... https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js	4 KB 2 KB	15ms 15ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash f1c3b93762c44aa82a7fe6aa06ff5c7883e2a9ba400ab1d7b4cef2cd3f3195e0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id iPZJme2Tqlf38zbOUNReQYPegTXyCeaB Content-Encoding gzip x-amz-request-id AC3BC41B2FEC5435 x-amz-server-side-encryption AES256 Access-Control-Max-Age 600 Date Tue, 25 Jun 2019 20:38:53 GMT Connection keep-alive Content-Length 1264 x-amz-id-2 /wRXeYaCVJQrWMuTbDeti6AyW8esDM0Q3oeHp/AJgHBe9M0MWvqsEtHsXqE9K2nmkDuUBA9+VZk= Last-Modified Wed, 22 May 2019 02:08:42 GMT Server AmazonS3 ETag "abc6474ff3e7a09dd5d089591ce95ed2" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * Redirect headers Date Tue, 25 Jun 2019 20:38:53 GMT X-Segment-Display-Name P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Connection keep-alive Content-Length 0 Pragma no-cache X-Conversion-Value 0.0 Server nginx/1.14.1 X-Rule * X-Segment-Eid T47Y2VPPABDUBJXFROMZZM Location https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js Cache-Control no-store, no-cache, must-revalidate X-Pixel-Eid YV5KYXXEJZATZCT37YRTMK X-Segment-Name * X-Advertisable-Eid 7YJ7XZCLMRHSVCXIHB5HIT X-Conversion-Currency
GET H2	200	389545881899618 Show response connect.facebook.net/signals/config/	228 KB 61 KB	131ms 131ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/389545881899618?v=2.8.51&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 8de2fc762597b1c3ba74b61f9c62b94a58a4a37d43f995c65c60be000134a9bd Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 vary Origin, Accept-Encoding x-xss-protection 0 pragma public x-fb-debug nh7tJKTT+ab6112SQQGU74dllG8Me0i4xAbqgHTiH0Kp7HVBSrM4s9pHbKWua9aJ2EiksFxsKvI+kQ4CTGY0VQ== x-fb-trip-id 1372681640 date Tue, 25 Jun 2019 20:38:53 GMT x-frame-options DENY access-control-allow-methods OPTIONS content-type application/x-javascript; charset=utf-8 access-control-allow-origin https://connect.facebook.net access-control-expose-headers X-FB-Debug, X-Loader-Length cache-control public, max-age=1200 access-control-allow-credentials true content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET		sync x.bidswitch.net/ Redirect Chain https://d.adroll.com/cm/b/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT https://x.bidswitch.net/sync?dsp_id=44&user_id=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc	0 0
GET		setuid ib.adnxs.com/ Redirect Chain https://d.adroll.com/cm/x/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT https://ib.adnxs.com/setuid?entity=172&code=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc	0 0
GET		377928.gif idsync.rlcdn.com/ Redirect Chain https://d.adroll.com/cm/l/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT https://idsync.rlcdn.com/377928.gif?partner_uid=0776a9a48face4683729bb1be1f8ffd7	0 0
GET H2	200	sd us-u.openx.net/w/1.0/ Redirect Chain https://d.adroll.com/cm/o/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT https://us-u.openx.net/w/1.0/sd?id=537103138&val=0776a9a48face4683729bb1be1f8ffd7 https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0776a9a48face4683729bb1be1f8ffd7	43 B 256 B	20ms 20ms	Image image/gif	173.241.240.143 OPENX TECHNOLOGIES
General Check archive.org Show headers Download Go to Show image Full URL https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0776a9a48face4683729bb1be1f8ffd7 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.241.240.143 Amsterdam, Netherlands, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US), Reverse DNS ox-173-241-240-143.xa.dc.openx.org Software OXGW/16.146.0 / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jun 2019 20:39:03 GMT server OXGW/16.146.0 vary Accept p3p CP="CUR ADM OUR NOR STA NID" status 200 cache-control private, max-age=0, no-cache content-type image/gif content-length 43 expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers status 302 date Tue, 25 Jun 2019 20:39:03 GMT server OXGW/16.146.0 content-length 0 location https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0776a9a48face4683729bb1be1f8ffd7 p3p CP="CUR ADM OUR NOR STA NID"
GET H/1.1	200 OK	out d.adroll.com/cm/g/	42 B 488 B	33ms 33ms	Image image/gif	176.34.190.23 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/g/out?advertisable=7YJ7XZCLMRHSVCXIHB5HIT&google_nid=adroll5 Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 176.34.190.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-176-34-190-23.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 25 Jun 2019 20:39:03 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42
GET H2	200	/ www.facebook.com/tr/	44 B 323 B	17ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=389545881899618&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fthreat-week-h-work-houdinijacksbot-and-socgholish&rl=&if=false&ts=1561495133711&cd[segment_eid]=T47Y2VPPABDUBJXFROMZZM&sw=1600&sh=1200&v=2.8.51&r=stable&ec=0&o=29&fbp=fb.1.1561495133710.216936117&it=1561495118621&coo=false&rqm=GET Requested by Host: www.proofpoint.com URL: https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.proofpoint.com/us/corporate-blog/post/threat-week-h-work-houdinijacksbot-and-socgholish User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Jun 2019 20:39:03 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Tue, 25 Jun 2019 20:39:03 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

scripts.demandbase.com

URL

https://scripts.demandbase.com/MP9Jyqtx.min.js

Domain

static.ads-twitter.com

URL

https://static.ads-twitter.com/uwt.js

Domain

static.hotjar.com

URL

https://static.hotjar.com/c/hotjar-933369.js?sv=5

Domain

ads.avocet.io

URL

https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j

Domain

api.company-target.com

URL

https://api.company-target.com/api/v2/ip.json?key=8d20076343394d24eb8250e933d1560c

Domain

attr.ml-api.io

URL

https://attr.ml-api.io/?domain=proofpoint.com&pId=575704853436825904

Domain

gwmtracking.com

URL

https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=164566506

Domain

x.bidswitch.net

URL

https://x.bidswitch.net/sync?dsp_id=44&user_id=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc

Domain

ib.adnxs.com

URL

https://ib.adnxs.com/setuid?entity=172&code=MDc3NmE5YTQ4ZmFjZTQ2ODM3MjliYjFiZTFmOGZmZDc

Domain

idsync.rlcdn.com

URL

https://idsync.rlcdn.com/377928.gif?partner_uid=0776a9a48face4683729bb1be1f8ffd7