cofense.com Open in urlscan Pro
35.188.168.180  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/bo2BdGnfNm Page URL
2. https://cofense.com/variants-of-emotet-malware/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1605637033801%26url%3Dhttps%253A%252F%252Fcofense.com%252Fvariants-of-emotet-malware%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&liSync=true

Request Chain 88

• https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&referer=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&fp=7fe850233a9dba8d28e74b09104d56e1 HTTP 302
• https://tracking.leadlander.com/tracking.png

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	bo2BdGnfNm Show response t.co/	297 B 378 B	143ms 143ms	Document text/html	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/bo2BdGnfNm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 6f6209606f8cb1e3b0eac49bd27145186dc7312769f4377f03051682bdbb8f15 Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /bo2BdGnfNm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 cache-control private,max-age=300 content-encoding gzip content-length 190 content-type text/html; charset=utf-8 date Tue, 17 Nov 2020 18:17:11 GMT expires Tue, 17 Nov 2020 18:22:11 GMT server tsa_o set-cookie muc=95730b13-f28c-48a2-bdea-71ca81ef3e4e; Max-Age=63072000; Expires=Thu, 17 Nov 2022 18:17:11 GMT; Domain=t.co; Secure; SameSite=None strict-transport-security max-age=0 vary Origin x-connection-hash 99a160bc9a4a6b1a1f046f59e536456c x-response-time 119 x-xss-protection 0
GET H2	200	Primary Request / Show response cofense.com/variants-of-emotet-malware/	196 KB 29 KB	392ms 145ms	Document text/html	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cofense.com/variants-of-emotet-malware/ Requested by Host: t.co URL: https://t.co/bo2BdGnfNm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / WP Engine Resource Hash 3d535d0027e5d15d1f16748f704925ea3671555282c78e6a7da3fc4be23edc96 Request headers :method GET :authority cofense.com :scheme https :path /variants-of-emotet-malware/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/bo2BdGnfNm accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://t.co/bo2BdGnfNm Response headers status 200 server nginx date Tue, 17 Nov 2020 18:17:12 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie link <https://cofense.com/?p=23228>; rel=shortlink x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate x-cache HIT: 4 x-cache-group normal content-encoding br
GET H2	200	css fonts.googleapis.com/	31 KB 1 KB	17ms 16ms	Stylesheet text/css	2a00:1450:4001:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 693bdd2619bcd296b52f815282cc9344a43020c1948db012925a22e84fcf879e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 17 Nov 2020 18:17:12 GMT server ESF date Tue, 17 Nov 2020 18:17:12 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 17 Nov 2020 18:17:12 GMT
GET H2	200	302b4c77a4244c2defbc3a6fe1dada2b.css cofense.com/wp-content/cache/min/1/	2 MB 296 KB	173ms 172ms	Stylesheet text/css	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 64d18fabca537fb5a2eb4c59a78721e7d6e0a6f0cc541c42342736c3f34b6550 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT content-encoding br last-modified Mon, 16 Nov 2020 21:03:08 GMT server nginx status 200 etag W/"5fb2e90c-20304b" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	jquery.js Show response qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/	95 KB 34 KB	75ms 21ms	Script application/javascript	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT content-encoding gzip last-modified Mon, 16 Nov 2020 20:57:05 GMT server NetDNA-cache/2.2 status 200 etag W/"5fb2e7a1-17a69" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	css fonts.googleapis.com/	3 KB 612 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Rubik:400,500 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4f0da6ae75cc1f32c2955cbd1b4b3b81e7ca3ba3fdf7c72611337d63aff484e0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 17 Nov 2020 16:52:09 GMT server ESF date Tue, 17 Nov 2020 18:17:12 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 17 Nov 2020 18:17:12 GMT
GET H2	200	cofense-logo.svg qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/	3 KB 1 KB	22ms 22ms	Image image/svg+xml	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/cofense-logo.svg Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT content-encoding gzip last-modified Mon, 16 Nov 2020 20:59:10 GMT server NetDNA-cache/2.2 status 200 etag W/"5fb2e81e-b20" vary Accept-Encoding, Accept-Encoding x-cache HIT content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	cofense-cbfree.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	22ms 22ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cbfree.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-c2a" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3114
GET H2	200	cofense-lms.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-lms.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-cd3" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3283
GET H2	200	cofense-reporter.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-reporter.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-b2e" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 2862
GET H2	200	cofense-triage.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	26ms 25ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-triage.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-c04" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3076
GET H2	200	cofense-vision.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	22ms 22ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-vision.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-ad5" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 2773
GET H2	200	cofense-pds.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	4 KB 4 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-pds.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-ff4" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 4084
GET H2	200	cofense-intelligence.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	3 KB 3 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-intelligence.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-c34" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3124
GET H2	200	cofense-livefeed.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	5 KB 5 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-livefeed.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-12ad" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 4781
GET H2	200	virus-01.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/	6 KB 7 KB	22ms 22ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/virus-01.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:57:37 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7c1-198b" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 6539
GET H2	200	wfh-01.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/	4 KB 5 KB	22ms 22ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/wfh-01.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:57:29 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7b9-111d" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 4381
GET H2	200	cofense-threat_education.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	4 KB 4 KB	21ms 21ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_education.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-e51" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3665
GET H2	200	phishing-threats-db.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/	5 KB 5 KB	23ms 22ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/phishing-threats-db.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:57:21 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7b1-1469" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 5225
GET H2	200	cofense-cloud_seeker.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/	4 KB 5 KB	23ms 23ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:58:09 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7e1-1166" vary Accept-Encoding x-cache HIT content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 4454
GET H2	200	ee31a2a28e5707446ede031f17200001.js Show response cofense.com/wp-content/cache/min/1/	637 KB 178 KB	145ms 145ms	Script application/javascript	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 5b8feac69ec1dea9835ac9186c98cb4be1f4de45cb6a624242e05ac07e03f798 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT content-encoding br last-modified Tue, 17 Nov 2020 12:00:18 GMT server nginx status 200 etag W/"5fb3bb52-9f259" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	nav-arrow.png cofense.com/wp-content/themes/copro/images/	3 KB 3 KB	122ms 121ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/themes/copro/images/nav-arrow.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9 Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:59:10 GMT server nginx status 200 etag "5fb2e81e-b8d" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 2957
GET H2	200	icn-nav-search@2x.png cofense.com/wp-content/themes/copro/images/	1 KB 1 KB	127ms 126ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/themes/copro/images/icn-nav-search@2x.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:59:10 GMT server nginx status 200 etag "5fb2e81e-514" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 1300
GET H2	200	b-g.png cofense.com/wp-content/themes/copro/images/	840 KB 841 KB	122ms 122ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/themes/copro/images/b-g.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9 Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 16 Nov 2020 20:59:12 GMT server nginx status 200 etag "5fb2e820-d20af" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 860335
GET H2	200	footer-graphic.png cofense.com/wp-content/uploads/2016/07/	4 KB 4 KB	172ms 171ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/uploads/2016/07/footer-graphic.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29 Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:58:56 GMT server nginx status 200 etag "5fb2e810-e4e" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 3662
GET H2	200	footer-graphic-b.png cofense.com/wp-content/uploads/2016/07/	212 B 413 B	173ms 172ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/uploads/2016/07/footer-graphic-b.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:58:56 GMT server nginx status 200 etag "5fb2e810-d4" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 212
GET H2	200	footer-graphic-a.png cofense.com/wp-content/uploads/2016/07/	107 B 308 B	172ms 172ms	Image image/png	35.188.168.180 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cofense.com/wp-content/uploads/2016/07/footer-graphic-a.png Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.188.168.180 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software nginx / Resource Hash 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb Request headers Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:58:56 GMT server nginx status 200 etag "5fb2e810-6b" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 107
GET H2	200	fa-solid-900.woff2 use.fontawesome.com/releases/v5.13.0/webfonts/	78 KB 78 KB	30ms 20ms	Font font/woff2	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2 Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7 Request headers Origin https://cofense.com Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 23 Mar 2020 16:08:17 GMT server NetDNA-cache/2.2 status 200 etag "b15db15f746f29ffa02638cb455b8ec0" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT accept-ranges bytes content-length 79444
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	15ms 5ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://cofense.com Referer https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 11:20:36 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 24996 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Wed, 17 Nov 2021 11:20:36 GMT
GET H2	200	fa-brands-400.woff2 use.fontawesome.com/releases/v5.13.0/webfonts/	75 KB 75 KB	37ms 28ms	Font font/woff2	23.111.9.35 HIGHWINDS2
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2 Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29 Request headers Origin https://cofense.com Referer https://cofense.com/wp-content/cache/min/1/302b4c77a4244c2defbc3a6fe1dada2b.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:12 GMT last-modified Mon, 23 Mar 2020 16:10:04 GMT server NetDNA-cache/2.2 status 200 etag "a06da7f0950f9dd366fc9db9d56d618a" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * access-control-max-age 3000 cache-control max-age=31556926 x-cache HIT accept-ranges bytes content-length 76612
GET H2	200	1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2 fonts.gstatic.com/s/raleway/v18/	41 KB 42 KB	17ms 9ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/raleway/v18/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bb0c201f0ca67e745869967d48db2e90bf01353d1f305959d487291cab6d0755 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://cofense.com Referer https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 15 Nov 2020 20:00:32 GMT x-content-type-options nosniff last-modified Wed, 30 Sep 2020 20:45:21 GMT server sffe age 166600 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42444 x-xss-protection 0 expires Mon, 15 Nov 2021 20:00:32 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	16ms 8ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://cofense.com Referer https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 15 Nov 2020 11:20:35 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 197797 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 15 Nov 2021 11:20:35 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	15ms 7ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://cofense.com Referer https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 15 Nov 2020 20:01:10 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 166562 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11020 x-xss-protection 0 expires Mon, 15 Nov 2021 20:01:10 GMT
GET H2	200	KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2 fonts.gstatic.com/s/roboto/v20/	12 KB 12 KB	14ms 7ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://cofense.com Referer https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700%7CRoboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 11:20:43 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:19:00 GMT server sffe age 24989 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12680 x-xss-protection 0 expires Wed, 17 Nov 2021 11:20:43 GMT
GET H2	200	1st.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	206 KB 207 KB	351ms 347ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/1st.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash f92a1694ceecfc59ca0c59ad08654274ed26458a5de831cf76e9b0c5f307a097 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-339f0" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 211440
GET H2	200	2nd.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	125 KB 126 KB	351ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/2nd.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 1796315b2d6aff6798e5b0f51b6a69fdb40205766a037accf439dafb231e457b Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-1f501" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 128257
GET H2	200	3rd.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	21 KB 21 KB	351ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/3rd.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 7f35456fcbf2bf350c25e098c01a3dfe3f869483a6526e31795608aac3b1b14f Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-52f3" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 21235
GET H2	200	4th.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	345 KB 346 KB	350ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/4th.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash fda154afddd80d8a4807ca8ee59fcb0ad0476d9f3a701f0988a6afbb61982176 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:11 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a7-56489" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 353417
GET H2	200	5th.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	101 KB 101 KB	351ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/5th.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 9f147fd1094355d691eba795330309397279d06700bbf302575f99db85441b9b Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-193e8" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 103400
GET H2	200	6th.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	77 KB 78 KB	351ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/6th.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash 926b5c117e8c8a4c5961e503b2e024d7dcc24f55aa98831fb1608370a33658b6 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-13509" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 79113
GET H2	200	7th.png qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/	120 KB 121 KB	351ms 348ms	Image image/png	108.161.188.228 HIGHWINDS2
General Check archive.org Show headers Download Go to Show image Full URL https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/7th.png Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US), Reverse DNS Software NetDNA-cache/2.2 / Resource Hash d476eafda965b72747b1f176c254fee2ab25498f63f7b6fcdaed8773af33e0b0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT last-modified Mon, 16 Nov 2020 20:57:10 GMT server NetDNA-cache/2.2 status 200 etag "5fb2e7a6-1e16c" vary Accept-Encoding x-cache MISS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 123244
GET H2	200	core-d2a24f1d20d2043482758bef114eb219.js Show response cdn.iubenda.com/cons/iubenda_cons/	21 KB 7 KB	85ms 26ms	Script application/javascript	2.17.181.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdn.iubenda.com/cons/iubenda_cons/core-d2a24f1d20d2043482758bef114eb219.js Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.181.202 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-17-181-202.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash 523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip last-modified Mon, 16 Nov 2020 10:25:14 GMT server nginx/1.15.8 etag "5fb2538a-1b74" vary Accept-Encoding p3p CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml" status 200 cache-control public, must-revalidate, proxy-revalidate, max-age=31536000 content-type application/javascript content-length 7028 expires Wed, 17 Nov 2021 18:17:13 GMT
GET H2	200	core-7477c61df49044b49eabbd94edfbd933.js Show response cdn.iubenda.com/cookie_solution/iubenda_cs/	610 KB 123 KB	96ms 37ms	Script application/javascript	2.17.181.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-7477c61df49044b49eabbd94edfbd933.js Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.181.202 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-17-181-202.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash df127da678d7ebec429bdf5bb1dd0f2f9ea307b5d7cc9a20e8829f0cfe1e7f9c Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip last-modified Mon, 16 Nov 2020 10:25:14 GMT server nginx/1.15.8 etag "5fb2538a-1e8a0" vary Accept-Encoding p3p CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml" status 200 cache-control public, must-revalidate, proxy-revalidate, max-age=31536000 content-type application/javascript content-length 125088 expires Wed, 17 Nov 2021 18:17:13 GMT
GET H2	200	28krvx2uf9n3.js Show response js.driftt.com/include/1605637200000/	137 KB 45 KB	301ms 198ms	Script application/javascript	65.9.96.127 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1605637200000/28krvx2uf9n3.js Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.96.127 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip x-amz-cf-pop PRG50-C1 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront status 200 strict-transport-security max-age=31536000; includeSubDomains access-control-allow-origin * last-modified Tue, 13 Oct 2020 15:05:22 GMT server nginx etag W/"a48548cec5608126b24de4cbfe9bfb8d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 via 1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront) cache-control max-age=10 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id TM7qiwYZ8zgRfK2I2R03fPoh3z1wOEe0KFXz25MaFVit8illCoKGcg==
GET H2	200	76856514.js Show response www.iubenda.com/cookie-solution/confs/js/	63 B 435 B	83ms 81ms	Script application/javascript	2.17.181.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.iubenda.com/cookie-solution/confs/js/76856514.js Requested by Host: cdn.iubenda.com URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-7477c61df49044b49eabbd94edfbd933.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.181.202 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-17-181-202.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT access-control-request-method * status 200 content-encoding gzip content-length 69 last-modified Tue, 17 Nov 2020 17:02:42 GMT server nginx etag "5fb40232-3f" vary Accept-Encoding access-control-allow-methods POST, PUT, DELETE, GET, OPTIONS content-type application/javascript access-control-allow-origin * cache-control max-age=86400 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization expires Wed, 18 Nov 2020 18:17:13 GMT
GET DATA	200 OK	truncated Show response /	488 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 145f6b17f093012ed6a6770be506a68fd1a4285ddc9ec7e5cfcf0475a477c931 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type text/javascript
GET H2	200	shareaholic.js Show response dsms0mj1bbhn4.cloudfront.net/assets/pub/	9 KB 4 KB	41ms 9ms	Script application/javascript	2600:9000:2057:4200:c:d51b:4400:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:4200:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 30f1a6726aef3ede2d993a31b417256ea67423799720ded669ece5d48dc2725b Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:11:23 GMT content-encoding gzip age 350 x-cache Hit from cloudfront status 200 x-hello-human Join the fun! Apply at www.shareaholic.com/jobs content-length 3703 access-control-allow-origin * last-modified Mon, 02 Nov 2020 15:40:22 GMT server nginx etag "d8b187a31edd46a8bbbe6daf537ebe74" content-type application/javascript; charset=UTF-8 via 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront) cache-control max-age=900, public x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id eW6Y5fJSmCH8NNqu_HlmhAZq8BLOka0eBe-Uqe8p9jUhqJqcndisiA==
GET H2	200	js Show response www.googletagmanager.com/gtag/	96 KB 38 KB	23ms 22ms	Script application/javascript	2a00:1450:4001:817::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-1061448384 Requested by Host: cofense.com URL: https://cofense.com/wp-content/cache/min/1/ee31a2a28e5707446ede031f17200001.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d4691fbcbce5f9645b3359c999cbac666fa2a008f8db7be208dc412657f19b0d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38703 x-xss-protection 0 last-modified Tue, 17 Nov 2020 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 17 Nov 2020 18:17:13 GMT
GET DATA	200 OK	truncated Show response /	145 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 571cb8ef30eabf63289bb0130518c76421dcba289d5aeb4bd42e3e33c61fbed0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type text/javascript
GET H2	200	gtm.js Show response www.googletagmanager.com/	174 KB 59 KB	16ms 16ms	Script application/javascript	2a00:1450:4001:817::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH Requested by Host: text URL: data:text/javascript;base64,CihmdW5jdGlvbiggdywgZCwgcywgbCwgaSApIHsKCiAgICB3W2xdID0gd1tsXSB8fCBbXTsKICAgIHdbbF0ucHVzaCh7CiAgICAgICAgJ2d0bS5zdGFydCc6IG5ldyBEYXRlKCkuZ2V0VGltZSgpLAogICAgICAgIGV2ZW50OiAnZ3RtLmpzJwogICAgfSk7CgogICAgdmFyIGYgPSBkLmdldEVsZW1lbnRzQnlUYWdOYW1lKCBzIClbMF0sCiAgICAgICAgaiA9IGQuY3JlYXRlRWxlbWVudCggcyApLAogICAgICAgIGRsID0gbCAhPSAnZGF0YUxheWVyJyA/ICcmbD0nICsgbCA6ICcnOwoKICAgIHZhciBlbnYgPSAnJzsKCiAgICBqLmFzeW5jID0gdHJ1ZTsKICAgIGouc3JjID0gJ2h0dHBzOi8vd3d3Lmdvb2dsZXRhZ21hbmFnZXIuY29tL2d0bS5qcz9pZD0nICsgaSArIGRsICsgZW52OwogICAgZi5wYXJlbnROb2RlLmluc2VydEJlZm9yZSggaiwgZiApOwoKfSkoIHdpbmRvdywgZG9jdW1lbnQsICdzY3JpcHQnLCAnZGF0YUxheWVyJywgJ0dUTS01UlEzN0tIJyApOwo= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 6b55bfcce57424b46c659b6eeb52a11e94a19e2805f764d8a8873206d087ac44 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 59784 x-xss-protection 0 last-modified Tue, 17 Nov 2020 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 17 Nov 2020 18:17:13 GMT
OPTIONS H2	204	write hits-i.iubenda.com/ Frame	0 0	70ms 22ms	Other text/plain	64.225.68.135 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://hits-i.iubenda.com/write?db=hits1 Protocol H2 Server 64.225.68.135 Jacksonville, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization Origin https://cofense.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers status 204 server nginx date Tue, 17 Nov 2020 18:17:13 GMT access-control-allow-origin https://cofense.com access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers *, authorization access-control-max-age 1728000 access-control-allow-credentials true content-length 0 content-type text/plain charset=UTF-8
POST H2	204	write Show response hits-i.iubenda.com/	0 395 B	73ms 72ms	XHR text/plain	64.225.68.135 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://hits-i.iubenda.com/write?db=hits1 Requested by Host: cdn.iubenda.com URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/core-7477c61df49044b49eabbd94edfbd933.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 64.225.68.135 Jacksonville, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cofense.com/variants-of-emotet-malware/ Authorization Basic aGl0czFfdTpoaXRzMV91cHdk Content-Type text/plain;charset=UTF-8 Response headers date Tue, 17 Nov 2020 18:17:13 GMT server nginx x-influxdb-build OSS status 204 access-control-allow-methods DELETE, GET, OPTIONS, POST, PUT access-control-allow-origin https://cofense.com access-control-expose-headers Date, X-InfluxDB-Version, X-InfluxDB-Build request-id 1dda2a20-2901-11eb-b7a0-0242ac110003 access-control-allow-headers Accept, Accept-Encoding, Authorization, Content-Length, Content-Type, X-CSRF-Token, X-HTTP-Method-Override x-influxdb-version 1.8.2 x-request-id 1dda2a20-2901-11eb-b7a0-0242ac110003
GET H2	200	main.js Show response m9m6e2w5.stackpathcdn.com/v2/bd6fcdf2/	146 KB 43 KB	90ms 27ms	Script application/javascript	151.139.128.11 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://m9m6e2w5.stackpathcdn.com/v2/bd6fcdf2/main.js Requested by Host: dsms0mj1bbhn4.cloudfront.net URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.11 Dallas, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash db95655e443f2198ea9005bee7f37284359c158fe9df439dbe121e21dc1e4d58 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip last-modified Mon, 02 Nov 2020 15:40:19 GMT server nginx x-amz-request-id 745DF988DB016377 etag "2483ca406632d0c07dd7fa0391d638b5" x-hw 1605637033.cds024.pa1.hn,1605637033.cds039.pa1.c content-type application/javascript; charset=UTF-8 status 200 cache-control max-age=31536000, public x-hello-human Join the fun! Apply at www.shareaholic.com/jobs accept-ranges bytes access-control-allow-origin * content-length 43551 x-amz-id-2 p+woPkBVCcFkFqbYnQE1hwUr/fmH3M9U4JKDkTrPJokDGhsa88UkcQ34fl0HJz2J09ir1p0unK8=
GET H2	200	62df9f201cc7c19a56912daae814efca.json Show response www.shareaholic.net/config/	11 KB 2 KB	324ms 108ms	XHR application/json	54.197.98.98 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json Requested by Host: dsms0mj1bbhn4.cloudfront.net URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 54.197.98.98 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software nginx / Resource Hash 1e6c1037c61147de087c99ee388b95a27833e77e820875f0fadcb64039abdb3b Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-client-geo-country BE,Belgium date Mon, 16 Nov 2020 19:50:40 GMT content-encoding gzip vary Accept-Encoding access-control-allow-origin * status 200 access-control-allow-methods GET, HEAD content-length 1669 server nginx x-client-geo-region BRU,Brussels Capital x-client-geo-metrocode etag W/"1e6c1037c61147de087c99ee388b95a2" access-control-max-age 2000 x-client-geo-city Brussels x-varnish 844230690 812042012 via 1.1 varnish (Varnish/6.0) access-control-expose-headers Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode cache-control max-age=3, public, must-revalidate x-client-geo-zip 1930 accept-ranges bytes content-type application/json access-control-allow-headers * x-client-geo-latlong 50.884700,4.504900
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	30 KB 12 KB	37ms 37ms	Script text/javascript	216.58.205.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s24-in-f226.1e100.net Software cafe / Resource Hash 30b509528a09195b7a7080345419048fd35269803cdfeab438a98c2176a1d9d0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 11761 x-xss-protection 0 server cafe etag 8854462785499610041 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 17 Nov 2020 18:17:13 GMT
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	132 KB 51 KB	27ms 27ms	Script application/javascript	2a00:1450:4001:817::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 17f5c61003f5aa3f91ca367e5fba61a573c5816e8b45ebbc541434041e9b53a2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51843 x-xss-protection 0 server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 17 Nov 2020 18:17:13 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 18 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:818::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 3685 date Tue, 17 Nov 2020 17:15:48 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Tue, 17 Nov 2020 19:15:48 GMT
GET H2	200	hotjar-1312741.js Show response static.hotjar.com/c/	12 KB 3 KB	94ms 93ms	Script application/javascript	65.9.96.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1312741.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.96.128 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash b0f2929359ea3654957d506f5cc75dfc35383321a16bf1b2d2bb35158787c9c2 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding br x-content-type-options nosniff cache-control max-age=60 x-amz-cf-pop PRG50-C1 etag W/f67034a994dd770da38238c218cb9b10 status 200 x-cache RefreshHit from cloudfront content-type application/javascript access-control-allow-origin * x-cache-hit 1 vary Accept-Encoding x-amz-cf-id zOAcOGEIdfBC1hze5m6RbgaYOQFynk18iGJ2Ypche2-9hDLKLZWXdA== via 1.1 7cfba11baf6016eafce83142b99c8ff8.cloudfront.net (CloudFront)
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	965 B 761 B	12ms 10ms	Script application/x-javascript	2a02:26f0:10c:582::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 17 Nov 2020 18:17:13 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=60163 Connection keep-alive Accept-Ranges bytes Content-Length 448
GET H2	200	sf14g.js Show response t.sf14g.com/	37 KB 37 KB	440ms 200ms	Script application/javascript	52.44.242.176 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://t.sf14g.com/sf14g.js Requested by Host: t.co URL: https://t.co/bo2BdGnfNm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.44.242.176 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Kestrel / Resource Hash 86ecafc33ecb5976760d6b5f13a2874525e3f4bfa8b12a0e14d6c98ae9e727cd Security Headers Name Value Strict-Transport-Security max-age=2592000 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT last-modified Thu, 06 Aug 2020 14:28:30 GMT server Kestrel etag "1d66bfddb0de89b" strict-transport-security max-age=2592000 content-type application/javascript status 200 cache-control no-cache, no-store accept-ranges bytes content-length 37787 expires -1
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	26ms 22ms	Script application/javascript	199.232.56.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: t.co URL: https://t.co/bo2BdGnfNm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.56.157 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip age 51977 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1958 x-served-by cache-lon4236-LON last-modified Wed, 21 Oct 2020 21:46:56 GMT x-timer S1605637034.707818,VS0,VE0 etag "a4cc3f907681b24a3efd540acd5d2996+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes
GET H2	200	2Uq3HoQoVZEHgHXXf288 Show response ws.zoominfo.com/pixel/	0 726 B	261ms 242ms	Script text/javascript	2606:4700::6810:a852 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288 Requested by Host: t.co URL: https://t.co/bo2BdGnfNm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT via 1.1 google x-content-type-options nosniff cf-cache-status DYNAMIC x-powered-by Express status 200 content-length 0 cf-request-id 067905e6f50000d6ddccb74000000001 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 5f3b7284bfe1d6dd-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
GET H3-Q050	200	js Show response www.google-analytics.com/gtm/	84 KB 34 KB	17ms 17ms	Script application/javascript	2a00:1450:4001:818::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm5&cid=1817237507.1605637034&aip=true Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 907cf25e08d729eea78088a03467de91bb95b37a01be60894daaa1158fe43d2a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 34199 x-xss-protection 0 last-modified Tue, 17 Nov 2020 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 17 Nov 2020 18:17:13 GMT
GET H/1.1	200 OK	insight.beta.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	10ms 9ms	Script application/x-javascript	2a02:26f0:10c:582::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 17 Nov 2020 18:17:13 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=12367 Connection keep-alive Accept-Ranges bytes Content-Length 1799
GET H2	200	adsct t.co/i/	43 B 170 B	146ms 146ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 121 pragma no-cache last-modified Tue, 17 Nov 2020 18:17:13 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 99a160bc9a4a6b1a1f046f59e536456c x-transaction 0007761400761b23 expires Tue, 31 Mar 1981 05:00:00 GMT
POST H3-Q050	204	collect www.google-analytics.com/g/	0 36 B	13ms 13ms	Other text/plain	2a00:1450:4001:818::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-0HTW6C6HJS&gtm=2oeb41&_p=112288158&sr=1600x1200&ul=en-us&cid=1817237507.1605637034&_s=1&dl=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&dr=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&dt=Variants%20of%20Emotet%20Malware%20-%20Cofense&sid=1605637033&sct=1&seg=0&en=page_view&_fv=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT server Golfe2 status 204 content-type text/plain access-control-allow-origin https://cofense.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	e analytics.shareaholic.com/	43 B 377 B	325ms 107ms	Other image/gif	54.87.159.104 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://analytics.shareaholic.com/e Requested by Host: m9m6e2w5.stackpathcdn.com URL: https://m9m6e2w5.stackpathcdn.com/v2/bd6fcdf2/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.87.159.104 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Security Headers Name Value Content-Security-Policy referrer always Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:14 GMT status 200 vary Origin p3p CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC" access-control-allow-origin https://cofense.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true referer-policy unsafe-url content-security-policy referrer always content-type image/gif content-length 43 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1605637033801%26url%3Dhttps%253A%252F%252Fcofense.com%252Fvariant... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&liSync=true	0 63 B	182ms 182ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&liSync=true Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:14 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 0 x-li-uuid 9UHNJGBeSBawuQSi/CoAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-content-type-options nosniff linkedin-action 1 status 302 content-length 0 x-li-uuid qIsPHmBeSBbg3sndyyoAAA== pragma no-cache x-li-pop afd-prod-lor1 x-msedge-ref Ref A: 396DFAD39889460BBDBB176766A4A08C Ref B: FRAEDGE1314 Ref C: 2020-11-17T18:17:13Z x-frame-options sameorigin date Tue, 17 Nov 2020 18:17:13 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1605637033801&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 85 B	15ms 15ms	XHR text/plain	2a00:1450:400c:c03::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=253211049&gjid=1833459282&_gid=607423619.1605637034&_u=aGDAgUADQAAAAE~&z=149414101 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c03::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 17 Nov 2020 18:17:13 GMT status 200 content-type text/plain access-control-allow-origin https://cofense.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	2 B 25 B	14ms 13ms	XHR text/plain	2a00:1450:4001:818::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=112288158&t=event&ni=1&_s=1&dl=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&dr=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&ul=en-us&de=UTF-8&dt=Variants%20of%20Emotet%20Malware%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Cookie%20Banner&ea=Banner%20Shown&_u=aGDAAUADQAAAAG~&jid=611670782&gjid=1652113960&cid=1817237507.1605637034&tid=UA-114787942-1&_gid=607423619.1605637034&_r=1&gtm=2wgb415RQ37KH&z=83180485 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 status 200 content-type text/plain access-control-allow-origin https://cofense.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 63 B	6ms 6ms	Image image/gif	2a00:1450:4001:818::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=112288158&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&dr=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&ul=en-us&de=UTF-8&dt=Variants%20of%20Emotet%20Malware%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgUADQ~&jid=253211049&gjid=1833459282&cid=1817237507.1605637034&tid=UA-114787942-1&_gid=607423619.1605637034&gtm=2wgb415RQ37KH&z=1620575770 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 01:19:27 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 61066 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	modules.901d255c60be478c0407.js Show response script.hotjar.com/	362 KB 71 KB	88ms 88ms	Script application/javascript	65.9.96.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.901d255c60be478c0407.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.96.128 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 19a78a3d65530057588a374ad94600724a1637d5f4813f54d45fba4dc40dd381 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 16 Nov 2020 11:14:04 GMT content-encoding br x-content-type-options nosniff age 111789 x-cache Hit from cloudfront status 200 content-length 72685 access-control-allow-origin * last-modified Mon, 16 Nov 2020 11:10:28 GMT etag "d5bad46b67576c083ff87f8ad6924084" vary Accept-Encoding content-type application/javascript via 1.1 7cfba11baf6016eafce83142b99c8ff8.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop PRG50-C1 accept-ranges bytes x-robots-tag none x-amz-cf-id 6__XwE7Yexcdjub8KnPEDxePY_C__kFw8M40w3mr4paUQXOATInD2A==
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	30ms 30ms	Image image/gif	2a00:1450:4001:81a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=253211049&_u=aGDAgUADQAAAAE~&z=1382414191 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	31ms 30ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=253211049&_u=aGDAgUADQAAAAE~&z=1382414191 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3-Q050	200	collect Show response stats.g.doubleclick.net/j/	4 B 66 B	16ms 16ms	XHR text/plain	2a00:1450:400c:c03::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=611670782&gjid=1652113960&_gid=607423619.1605637034&_u=aGDAAUADQAAAAG~&z=574428616 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c03::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 17 Nov 2020 18:17:13 GMT status 200 content-type text/plain access-control-allow-origin https://cofense.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	box-469cf41adb11dc78be68c1ae7f9457a4.html vars.hotjar.com/ Frame 81E4	0 0	46ms 45ms	Document text/html	65.9.96.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.96.126 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-469cf41adb11dc78be68c1ae7f9457a4.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://cofense.com/variants-of-emotet-malware/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cofense.com/variants-of-emotet-malware/ Response headers status 200 content-type text/html content-length 851 date Mon, 05 Oct 2020 13:02:45 GMT accept-ranges bytes cache-control max-age=31536000 content-encoding br etag "d594f1d4c3e5dbd6b556c60d34e0daea" last-modified Mon, 05 Oct 2020 11:02:22 GMT x-robots-tag none vary Accept-Encoding x-cache Hit from cloudfront via 1.1 0803e66d64c794aaadfd4a88601bc68e.cloudfront.net (CloudFront) x-amz-cf-pop PRG50-C1 x-amz-cf-id qBfDnn9PwMmOceW-T7oI_f4292dazbpS5d2kPewr6pAYd7VWEcibRQ== age 3734068
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	31ms 30ms	Image image/gif	2a00:1450:4001:81a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=611670782&_u=aGDAAUADQAAAAG~&z=1702616394 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	30ms 29ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-114787942-1&cid=1817237507.1605637034&jid=611670782&_u=aGDAAUADQAAAAG~&z=1702616394 Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/	2 KB 1 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1605637033922&cv=9&fst=1605637033922&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash bb5cfa684fee7c4483b287da62d1569f21ee14d785de2aebf2da3d21f891312b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:13 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1064 x-xss-protection 0 pragma no-cache server cafe content-type text/javascript; charset=UTF-8 cache-control no-cache, must-revalidate timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/1061448384/	42 B 244 B	21ms 20ms	Image image/gif	2a00:1450:4001:81a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1061448384/?random=1605637033922&cv=9&fst=1605636000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3627362829&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/1061448384/	42 B 89 B	22ms 21ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1061448384/?random=1605637033922&cv=9&fst=1605636000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3627362829&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:13 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	partners.js Show response partner.shareaholic.com/	0 265 B	393ms 181ms	Script application/javascript	107.20.147.136 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&referrer=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&cl=en-US&id_sync=c86da288-4b7a-4004-8b65-4399b5de843a&minify=1&pvs=1&site=62df9f201cc7c19a56912daae814efca Requested by Host: m9m6e2w5.stackpathcdn.com URL: https://m9m6e2w5.stackpathcdn.com/v2/bd6fcdf2/main.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 107.20.147.136 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:14 GMT vary Accept-Encoding, User-Agent p3p CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC' status 200 cache-control no-cache, no-store, must-revalidate content-type application/javascript;charset=utf-8 content-length 0 expires Thu, 01 Jan 1970 00:00:00 GMT
POST H2	200	visit-data Show response in.hotjar.com/api/v2/client/sites/1312741/	178 B 320 B	41ms 41ms	XHR application/json	54.76.178.237 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://in.hotjar.com/api/v2/client/sites/1312741/visit-data?sv=7 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.901d255c60be478c0407.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.76.178.237 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-178-237.eu-west-1.compute.amazonaws.com Software / Resource Hash 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers date Tue, 17 Nov 2020 18:17:14 GMT content-encoding br status 200 vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-max-age 86400 access-control-allow-credentials true
GET H2	204	1312741 Show response vc.hotjar.io/sessions/	0 255 B	51ms 51ms	XHR text/plain	143.204.201.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vc.hotjar.io/sessions/1312741?s=0.25&r=0.09461504424950173 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.901d255c60be478c0407.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.201.77 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-201-77.fra53.r.cloudfront.net Software Python/3.7 aiohttp/3.5.4 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:14 GMT via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) server Python/3.7 aiohttp/3.5.4 x-amz-cf-pop FRA53-C1 x-cache Miss from cloudfront status 204 cache-control no-store access-control-allow-origin * x-amz-cf-id 1ENr5rV0LaDgJnc5PhaN1ysan6aDRDp11UQCLCZ28wBgSJr6iOlqKg==
GET H3-Q050	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/	2 KB 2 KB	147ms 133ms	Script text/javascript	2a00:1450:4001:81a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1605637034049&cv=9&fst=1605637034049&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0c45306f5140aa943950e0b9a12828af6d0b5a4f9b6a20f7404abf40fb5667f1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:14 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1068 x-xss-protection 0 pragma no-cache server cafe content-type text/javascript; charset=UTF-8 cache-control no-cache, must-revalidate timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/1061448384/	42 B 89 B	29ms 28ms	Image image/gif	2a00:1450:4001:81a::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1061448384/?random=1605637034049&cv=9&fst=1605636000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=4086623288&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:14 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/1061448384/	42 B 89 B	22ms 21ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1061448384/?random=1605637034049&cv=9&fst=1605636000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oab41&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&ref=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&tiba=Variants%20of%20Emotet%20Malware%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=4086623288&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: cofense.com URL: https://cofense.com/variants-of-emotet-malware/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:14 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	pd.js Show response pi.pardot.com/	5 KB 2 KB	434ms 109ms	Script application/javascript	18.232.28.189 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/pd.js Requested by Host: t.co URL: https://t.co/bo2BdGnfNm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS pi0-lba1-6-ue1.aws.pardot.com Software PardotServer / Resource Hash 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 17 Nov 2020 18:17:14 GMT Content-Encoding gzip X-Pardot-Route ea50fcd3dcf777490e1499615b883deb X-Pardot-LB e95a292e477f6214c8e77c2cf881a7d3 Last-Modified Fri, 13 Mar 2020 19:45:39 GMT Server PardotServer ETag "1442-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Cache-Control max-age=63072000 Accept-Ranges bytes Content-Length 1842 Expires Thu, 17 Nov 2022 18:17:14 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 163 B	152ms 152ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:17:14 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=631138519 content-length 57 x-xss-protection 0 x-response-time 125 pragma no-cache last-modified Tue, 17 Nov 2020 18:17:14 GMT server tsa_o x-frame-options SAMEORIGIN content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 08ba94af2da9cc50f1876e76b7b1d167 x-transaction 00c7791e007d26a9 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	tracking.png tracking.leadlander.com/ Redirect Chain https://tracking.leadlander.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&referer=https%3A%2F%2Ft.co%2Fbo2BdGnfNm&fp=7fe850233a9dba8d28e74b09104d56e1 https://tracking.leadlander.com/tracking.png	68 B 296 B	108ms 108ms	Image image/png	3.220.33.83 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tracking.leadlander.com/tracking.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.220.33.83 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Kestrel / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Security Headers Name Value Strict-Transport-Security max-age=2592000 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 17 Nov 2020 18:17:15 GMT last-modified Wed, 26 Sep 2018 16:48:51 GMT server Kestrel etag "1d455b8cd761bc4" strict-transport-security max-age=2592000 content-type image/png status 200 cache-control no-cache, no-store accept-ranges bytes content-length 68 expires -1 Redirect headers status 302 date Tue, 17 Nov 2020 18:17:14 GMT server Kestrel access-control-allow-origin * location /tracking.png content-length 0 strict-transport-security max-age=2592000
GET H2	200	index.html js.driftt.com/deploy/assets/ Frame 5CCC	0 0	48ms 47ms	Document text/html	65.9.96.127 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/deploy/assets/index.html Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1605637200000/28krvx2uf9n3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.96.127 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority js.driftt.com :scheme https :path /deploy/assets/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://cofense.com/variants-of-emotet-malware/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cofense.com/variants-of-emotet-malware/ Response headers status 200 content-type text/html; charset=utf-8 content-length 894 server nginx last-modified Tue, 13 Oct 2020 15:05:22 GMT x-amz-server-side-encryption AES256 accept-ranges bytes access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains date Tue, 17 Nov 2020 18:17:12 GMT etag "e6bb65f85e419beda3231798abde6eb3" cache-control max-age=10 x-cache Hit from cloudfront via 1.1 cb11ca2ff3db5adbe7df4bca70e51594.cloudfront.net (CloudFront) x-amz-cf-pop PRG50-C1 x-amz-cf-id htm4c3iWetI_yq4rHt_3GyEnvTPtYb8F2gB2bp20g4ZG739Xa1EFlQ== age 4
GET H/1.0	200 OK	analytics Show response pi.pardot.com/	1 KB 1 KB	168ms 166ms	Script text/javascript	18.232.28.189 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=Variants%20of%20Emotet%20Malware%20-%20Cofense&url=https%3A%2F%2Fcofense.com%2Fvariants-of-emotet-malware%2F&referrer=https%3A%2F%2Ft.co%2Fbo2BdGnfNm Requested by Host: pi.pardot.com URL: https://pi.pardot.com/pd.js Protocol HTTP/1.0 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS pi0-lba1-6-ue1.aws.pardot.com Software PardotServer / Resource Hash ba2ea83824fa4727e553d845e6a35e7d5337d51ab12b3fc371260f6195003432 Request headers Referer https://cofense.com/variants-of-emotet-malware/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 17 Nov 2020 18:17:15 GMT Content-Encoding gzip X-Pardot-Route 13c7a24cfc43e49b0467af9964bf67ec X-Pardot-LB e95a292e477f6214c8e77c2cf881a7d3 X-Pardot-Rsp 16/53/219 Vary Accept-Encoding,User-Agent P3p CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type text/javascript; charset=utf-8 Content-Length 672 Server PardotServer Expires Thu, 19 Nov 1981 08:52:00 GMT