urlscan.io logo urlscan.io
SecurityTrails logo

cofense.com Open in urlscan Pro
141.193.213.20  Public Scan

Go To Rescan Add Verdict Report
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Submission: On March 07 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 29 IPs in 6 countries across 24 domains to perform 136 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is cofense.com. The Cisco Umbrella rank of the primary domain is 555117.
TLS certificate: Issued by R3 on February 26th 2023. Valid for: 3 months.
This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 91 141.193.213.20 209242 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 184.86.2.89 16625 (AKAMAI-AS)
1 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
1 3.214.188.44 14618 (AMAZON-AES)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 184.24.170.43 16625 (AKAMAI-AS)
1 13.32.110.123 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2620:1ec:4f:1... 8075 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:402... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 192.28.144.124 15224 (OMNITURE)
1 2600:9000:225... 16509 (AMAZON-02)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.43.14 8068 (MICROSOFT...)
2 34.111.208.231 396982 (GOOGLE-CL...)
2 185.89.210.180 29990 (ASN-APPNEX)
2 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
1 52.20.195.32 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
2 18.158.29.122 16509 (AMAZON-02)
2 52.167.85.21 8075 (MICROSOFT...)
1 2 68.219.88.97 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
136 29
91    141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
cofense.com
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a02:26f0:3500:16::215:148b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
p.typekit.net
2    2a00:1450:400d:803::2008 (Ireland)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
10    184.86.2.89 (Stockholm, Sweden)

ASN16625 (AKAMAI-AS, US)
PTR: a184-86-2-89.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
1    2a02:26f0:11a::6867:4832 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    3.214.188.44 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-214-188-44.compute-1.amazonaws.com
lltrck.com
1    2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)
ws.zoominfo.com
2    184.24.170.43 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-24-170-43.deploy.static.akamaitechnologies.com
munchkin.marketo.net
1    13.32.110.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-110-123.vie50.r.cloudfront.net
static.oktopost.com
1    2606:4700::6812:c9f (United States)

ASN13335 (CLOUDFLARENET, US)
trk.techtarget.com
2    2620:1ec:4f:1::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
2    2a00:1450:400d:80a::200e (Ireland)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
2    2a00:1450:4025:401::9d (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:400d:808::2003 (Ireland)

ASN15169 (GOOGLE, US)
www.google.de
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
404-jhu-612.mktoresp.com
1    2600:9000:2251:5000:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.linkedin.oribi.io
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.43.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
2    34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com
ibc-flow.techtarget.com
2    185.89.210.180 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
secure.adnxs.com
2    2a02:26f0:11a:3a2::1c91 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
ipv6.6sc.co
1    52.20.195.32 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-195-32.compute-1.amazonaws.com
okt.to
1    2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    18.158.29.122 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-29-122.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
2    52.167.85.21 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
i.clarity.ms
2    68.219.88.97 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
Apex Domain
Subdomains		 Transfer
91 cofense.com
cofense.com — Cisco Umbrella Rank: 555117
732 KB
12 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6488
c.6sc.co — Cisco Umbrella Rank: 9745
ipv6.6sc.co — Cisco Umbrella Rank: 6917
b.6sc.co — Cisco Umbrella Rank: 4795
15 KB
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 1033
i.clarity.ms — Cisco Umbrella Rank: 6978
c.clarity.ms — Cisco Umbrella Rank: 1538
22 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 361
www.linkedin.com — Cisco Umbrella Rank: 564
px4.ads.linkedin.com — Cisco Umbrella Rank: 6058
3 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 14610
ibc-flow.techtarget.com — Cisco Umbrella Rank: 18802
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 10362
577 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 377
2 KB
2 google.de
www.google.de — Cisco Umbrella Rank: 6149
515 B
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 77
402 B
2 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 4370
www.google.com — Cisco Umbrella Rank: 2
659 B
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 30
20 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3033
6 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 44
178 KB
1 bing.com
c.bing.com — Cisco Umbrella Rank: 237
737 B
1 okt.to
okt.to — Cisco Umbrella Rank: 27664
100 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 813
376 B
1 mktoresp.com
404-jhu-612.mktoresp.com
318 B
1 oktopost.com
static.oktopost.com — Cisco Umbrella Rank: 32221
4 KB
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4464
2 KB
1 lltrck.com
lltrck.com — Cisco Umbrella Rank: 28606
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 704
5 KB
1 gstatic.com
fonts.gstatic.com
38 KB
1 typekit.net
p.typekit.net — Cisco Umbrella Rank: 568
181 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 36
1 KB
136 24
Domain Requested by
91 cofense.com 3 redirects cofense.com
7 b.6sc.co cofense.com
2 c.clarity.ms 1 redirects
2 i.clarity.ms www.clarity.ms
2 epsilon.6sense.com j.6sc.co
2 ipv6.6sc.co j.6sc.co
2 c.6sc.co j.6sc.co
2 secure.adnxs.com j.6sc.co
2 ibc-flow.techtarget.com trk.techtarget.com
2 px.ads.linkedin.com 2 redirects
2 www.google.de cofense.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 www.google-analytics.com www.googletagmanager.com
cofense.com
2 www.clarity.ms cofense.com
www.clarity.ms
2 munchkin.marketo.net cofense.com
munchkin.marketo.net
2 www.googletagmanager.com cofense.com
www.googletagmanager.com
1 c.bing.com 1 redirects
1 www.google.com cofense.com
1 okt.to static.oktopost.com
1 px4.ads.linkedin.com cofense.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 404-jhu-612.mktoresp.com munchkin.marketo.net
1 region1.analytics.google.com www.googletagmanager.com
1 trk.techtarget.com cofense.com
1 static.oktopost.com cofense.com
1 ws.zoominfo.com cofense.com
1 lltrck.com cofense.com
1 snap.licdn.com www.googletagmanager.com
1 j.6sc.co cofense.com
1 fonts.gstatic.com fonts.googleapis.com
1 p.typekit.net cofense.com
1 fonts.googleapis.com cofense.com
136 33
Subject Issuer Validity Valid
cofense.com
R3		 2023-02-26 -
2023-05-27		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
use.typekit.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-09-14 -
2023-10-15		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-08 -
2023-03-11		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-02-01 -
2024-01-31		 a year crt.sh
lltrck.com
Go Daddy Secure Certificate Authority - G2		 2022-07-25 -
2023-08-26		 a year crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3		 2022-05-04 -
2023-05-04		 a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-06 -
2024-02-05		 a year crt.sh
*.oktopost.com
Amazon RSA 2048 M01		 2023-02-28 -
2023-10-27		 8 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-07-25 -
2023-07-25		 a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-01 -
2023-12-01		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-02-08 -
2023-05-03		 3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-05 -
2023-11-05		 a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01		 2023-02-24 -
2023-08-06		 5 months crt.sh
ibc-flow.techtarget.com
GTS CA 1D4		 2023-02-05 -
2023-05-06		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
okt.to
R3		 2023-01-17 -
2023-04-17		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
*.6sense.com
Amazon RSA 2048 M01		 2023-02-13 -
2023-06-29		 5 months crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 02		 2022-06-07 -
2023-06-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Frame ID: 09E0308414427E12CD1AB9B7E4E48D19
Requests: 138 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Emotet Sending Malicious Emails After Three-Month Hiatus

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • swiper(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

136
Requests

96 %
HTTPS

57 %
IPv6

24
Domains

33
Subdomains

29
IPs

6
Countries

1029 kB
Transfer

3293 kB
Size

34
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://cofense.com/wp-content/themes/cofense/css/custom.css?ver=6.1.1 HTTP 301
  • https://cofense.com/?ver=6.1.1
Request Chain 7
  • https://cofense.com/wp-content/themes/cofense/css/testing.css?ver=6.1.1 HTTP 301
  • https://cofense.com/?ver=6.1.1
Request Chain 78
  • https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf HTTP 301
  • https://cofense.com/
Request Chain 110
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1678222671762%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%252Femotet-sending-malicious-emails-after-three-month-hiatus%252F%26tm%3Dgtmv2%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true&e_ipv6=AQLSGmhMS9SyeQAAAYa93cHNyAWriKzo_YiwuABJmLw83JVny638cIla3nSofHVVwg
Request Chain 132
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&RedC=c.clarity.ms&MXFR=3D0E859A44456EE10AF7975740456082 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&MUID=127133581F016419078C21951EAD6553

136 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/ 		133 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
b2282b97c6a076f4fdf2acf780ce5b25c59d4334bc1460ce49158684b8d827a0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7a45c0c68c8f927f-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 07 Mar 2023 20:57:50 GMT
link
<https://cofense.com/wp-json/>; rel="https://api.w.org/" <https://cofense.com/wp-json/wp/v2/posts/98436>; rel="alternate"; type="application/json" <https://cofense.com/?p=98436>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 7
x-cache-group
normal
x-cacheable
SHORT
x-pingback
https://cofense.com/xmlrpc.php
x-powered-by
WP Engine
css
fonts.googleapis.com/ 		20 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Inter%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b2dc460864a60ac3ce89c4c6fab1c62ef9171ac1365cc47aa8aca95ecb06f0cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 07 Mar 2023 20:47:56 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 07 Mar 2023 20:57:50 GMT
style.min.css
cofense.com/wp-includes/css/dist/block-library/ 		93 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:49:59 GMT
server
cloudflare
age
601004
etag
W/"63fe7707-172a9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f23927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
classic-themes.min.css
cofense.com/wp-includes/css/ 		217 B
258 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/css/classic-themes.min.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 10 Feb 2023 17:49:36 GMT
server
cloudflare
age
1975805
etag
W/"63e683b0-d9"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f24927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.min.css
cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/ 		908 B
399 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/style.min.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22a79f1fbcc70373c7021bae2164d9232d1e9dd3c6a163df9f9f54070e5f6b50

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 02 Mar 2023 22:00:39 GMT
server
cloudflare
age
368788
etag
W/"64011c87-38c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f25927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.min.css
cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/ 		202 B
171 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee14e1c34ca92b9c270bf567a0bb381f83c6151be2020a948547c3e9de2e9cd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 02 Mar 2023 22:00:39 GMT
server
cloudflare
age
371770
etag
W/"64011c87-ca"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f27927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
cofense.com/wp-content/cache/min/1/wp-content/themes/cofense/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/themes/cofense/style.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3dfc3f03106f85ab56ceaadf44433f35cca4209d64922d50a1c650c90aa60ad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70149
etag
W/"6406651e-1fc3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f28927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
cofense.com/
Redirect Chain
  • https://cofense.com/wp-content/themes/cofense/css/custom.css?ver=6.1.1
  • https://cofense.com/?ver=6.1.1
153 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/?ver=6.1.1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
82aca67a00aae2784b36da4e109bc57a5a27031ed3b45254bb2fc8d3f60d2b36

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
x-cache-group
normal
content-encoding
br
cf-cache-status
DYNAMIC
x-cacheable
SHORT
server
cloudflare
x-powered-by
WP Engine
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
x-cache
HIT: 20
content-type
text/html; charset=UTF-8
cache-control
max-age=600, must-revalidate
cf-ray
7a45c0ca49e29007-FRA
link
<https://cofense.com/wp-json/>; rel="https://api.w.org/", <https://cofense.com/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json", <https://cofense.com/>; rel=shortlink
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 07 Mar 2023 20:57:50 GMT
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding
content-type
text/html
location
https://cofense.com/?ver=6.1.1
cf-ray
7a45c0c88f29927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
cofense.com/
Redirect Chain
  • https://cofense.com/wp-content/themes/cofense/css/testing.css?ver=6.1.1
  • https://cofense.com/?ver=6.1.1
153 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/?ver=6.1.1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
82aca67a00aae2784b36da4e109bc57a5a27031ed3b45254bb2fc8d3f60d2b36

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
x-cache-group
normal
content-encoding
br
cf-cache-status
DYNAMIC
x-cacheable
SHORT
server
cloudflare
x-powered-by
WP Engine
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
x-cache
HIT: 21
content-type
text/html; charset=UTF-8
cache-control
max-age=600, must-revalidate
cf-ray
7a45c0caba4b9007-FRA
link
<https://cofense.com/wp-json/>; rel="https://api.w.org/", <https://cofense.com/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json", <https://cofense.com/>; rel=shortlink
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 07 Mar 2023 20:57:50 GMT
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding
content-type
text/html
location
https://cofense.com/?ver=6.1.1
cf-ray
7a45c0c88f2c927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
elementor-icons.min.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d08fa1906998435f62fea09b51c792ed9b1d93a9636efe4fa8981599c7de9419

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70149
etag
W/"6406651e-4d2f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f2d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend-lite.min.css
cofense.com/wp-content/plugins/elementor/assets/css/ 		84 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2245bdd49577557da1504c6bbacf3670e2b998302dbd724949a8c6312c50e82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 24 Feb 2023 17:51:50 GMT
server
cloudflare
age
955264
etag
W/"63f8f936-14ec2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f2e927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
swiper.min.css
cofense.com/wp-content/plugins/elementor/assets/lib/swiper/css/ 		13 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/swiper/css/swiper.min.css?ver=5.3.6
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 13 Feb 2023 21:56:26 GMT
server
cloudflare
age
1847170
etag
W/"63eab20a-324c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c88f31927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-15.css
cofense.com/wp-content/uploads/elementor/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-15.css?ver=1678140700
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82b28becadf6ab1c3eaf14ee8bf08e65a5f138234f83f6b026e43ff171823d66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:40 GMT
server
cloudflare
age
70149
etag
W/"6406651c-1995"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f39927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend-lite.min.css
cofense.com/wp-content/plugins/elementor-pro/assets/css/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.11.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
38f98805ed3d35d88c84153ed39978d093da023940a231b7ea95c569eab04884

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
477236
etag
W/"63ffca69-2249"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f3a927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-93807.css
cofense.com/wp-content/uploads/elementor/css/ 		3 KB
667 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-93807.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3c983227e71c4f8da7d9af830cde723a94fd1a3a712e666c1f389dfac405bb9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70149
etag
W/"6406651d-b4b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f3e927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-1266.css
cofense.com/wp-content/uploads/elementor/css/ 		19 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-1266.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
727a730eda79071d5f02ba91d752c3feed10e0cd63a9c042f298390c24f85236

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70148
etag
W/"6406651d-4ba3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f3f927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-1271.css
cofense.com/wp-content/uploads/elementor/css/ 		15 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-1271.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8aef119b0af028d678724b6db4e3fba9dbc158c485f46856a560b64ae1df833f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70149
etag
W/"6406651d-3b7c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f40927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-1386.css
cofense.com/wp-content/uploads/elementor/css/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-1386.css?ver=1678140757
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
10e50c3101d259dd39f23f6315b85ed5912fe05ac84db44bd3d5ccc864bad48c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 Mar 2023 22:12:37 GMT
server
cloudflare
etag
W/"64066555-2f45"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f41927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-styles.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementskit-lite/widgets/init/assets/css/ 		439 KB
51 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementskit-lite/widgets/init/assets/css/widget-styles.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ef11cc1aa7203a8c5f634e92d4cef9c5148e3d7761a85fd90bc058c36c1ad09

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-6da2c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f43927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
responsive.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementskit-lite/widgets/init/assets/css/ 		30 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementskit-lite/widgets/init/assets/css/responsive.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
73b2fdcf25aa909c7b0f072cf791066350ab834ca1d0d01ef096bb5583318213

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-764b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f44927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ecs-style.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/ele-custom-skin/assets/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/ele-custom-skin/assets/css/ecs-style.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cbc49b1385bf29debe95333f04795a6e3a2cf218d88b415b29872d06491fd1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-19b2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f45927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-1444.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
516 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-1444.css?ver=1666885955
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cb5457685443a489c3b38e5fcbb0a8262cc79b5fdb36761db8af0b8d99a396e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:19:15 GMT
server
cloudflare
age
4503310
etag
W/"63c1a0a3-826"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f46927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-1462.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
776 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-1462.css?ver=1671033592
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b89b6165327872066d09bf529b6f131b238a193e71a8ab9108b2ea40ae92d3f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:54:22 GMT
server
cloudflare
age
601004
etag
W/"63fe780e-88b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f47927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-86702.css
cofense.com/wp-content/uploads/elementor/css/ 		902 B
386 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-86702.css?ver=1666612343
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6eafef48033bf87526b129f8f292a7ea8b943988241b3abefe94d3a95668ac8a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:56:19 GMT
server
cloudflare
age
3805814
etag
W/"63cad5c3-386"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f49927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-86773.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
530 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-86773.css?ver=1666885690
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bacd426460574c0fc84822fd3846441f1040b4374c8350d67271049bd29fc6d7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:59:04 GMT
server
cloudflare
age
601004
etag
W/"63fe7928-7ae"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f4a927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-94275.css
cofense.com/wp-content/uploads/elementor/css/ 		1 KB
356 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-94275.css?ver=1666870708
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ec717c896d0ca54e4536263e84f11f43a944ba2e04d2f5f1264f0acdc7beada

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 19:03:09 GMT
server
cloudflare
age
3760085
etag
W/"63cae56d-45d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f4b927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-96442.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
540 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-96442.css?ver=1671639716
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
46809652e471f149e960a31d8228bacc666d56f857eb1a8f639f32c3c6554335

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:19:14 GMT
server
cloudflare
age
4484874
etag
W/"63c1a0a2-7ac"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f4d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-96443.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
542 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-96443.css?ver=1671639746
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6fe59d88646876bb8dfb4a1a021b2dc2662b36bf175625eb3ecb89a3ae956937

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 03 Feb 2023 17:45:28 GMT
server
cloudflare
age
2728953
etag
W/"63dd4838-7ac"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f4e927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-96445.css
cofense.com/wp-content/uploads/elementor/css/ 		2 KB
564 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-96445.css?ver=1675169689
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44c68a4716777a09c291d971f91468c7e72dd2beadecd931aaea641758f4d726

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 31 Jan 2023 21:53:59 GMT
server
cloudflare
age
3014800
etag
W/"63d98df7-89c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f50927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fontawesome.min.css
cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 		57 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:58 GMT
server
cloudflare
age
3805814
etag
W/"63cad626-e238"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f51927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
solid.min.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 		1 KB
403 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc7e118b7e07217031d017282955569cb66891f527050135caadb2dd5779824f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-43a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f52927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
brands.min.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 		1 KB
402 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8449a28a151415d580be1dfd69056906199f1dd6ceb2c1b5edf61950ada9d13

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-440"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f53927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
cofense.com/wp-includes/js/jquery/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Feb 2023 22:04:16 GMT
server
cloudflare
age
969417
etag
W/"63f7e2e0-15e54"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f6f927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-migrate.min.js
cofense.com/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:11:59 GMT
server
cloudflare
age
4375425
etag
W/"63c19eef-2bd8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f70927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
language-cookie.js
cofense.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/ 		226 B
234 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.5.14
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
71966cb221a057ee9313fb232e40c7a0a70d2e472909c3947f4878c8e195ad53

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:55 GMT
server
cloudflare
age
3805813
etag
W/"63cad623-e2"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f72927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ecs_ajax_pagination.js
cofense.com/wp-content/plugins/ele-custom-skin/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/ele-custom-skin/assets/js/ecs_ajax_pagination.js?ver=3.1.7
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
95af163892829a3ef249441b70b2c8281b845edea4b24680d3326486861d6082

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:59 GMT
server
cloudflare
age
3805813
etag
W/"63cad627-ecb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f73927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ecs.js
cofense.com/wp-content/plugins/ele-custom-skin/assets/js/ 		284 B
236 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/ele-custom-skin/assets/js/ecs.js?ver=3.1.7
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
566d4c5dfefc9c4d867e6bef080917a4273b4228731a8700e81f1763eae3d861

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:13:40 GMT
server
cloudflare
age
4375425
etag
W/"63c19f54-11c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f74927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
zlo5wor.css
cofense.com/wp-content/cache/min/1/ 		816 B
382 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/zlo5wor.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c1a5c4b5574a4104a92b2e700e6f0fc5b001c4297ebc5a1e76d67b1fbeb1c2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-330"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f56927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-nav-menu.min.css
cofense.com/wp-content/plugins/elementor-pro/assets/css/ 		26 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/css/widget-nav-menu.min.css
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1827802b8b1f515c876c7c3d78003a2e3f50deef33d6db220881e24fa8056909

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:58 GMT
server
cloudflare
age
3760085
etag
W/"63cad626-6832"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f59927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-icon-list.min.css
cofense.com/wp-content/plugins/elementor/assets/css/ 		10 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.css
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0962f989ad81efa264ab002655675c486b6853cdf4a2f0ff524b3a0a347f5225

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:13:40 GMT
server
cloudflare
age
4484874
etag
W/"63c19f54-2674"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f5c927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-theme-elements.min.css
cofense.com/wp-content/plugins/elementor-pro/assets/css/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/css/widget-theme-elements.min.css
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f51ee281e24140f1f9b7cd29d11ad519d0e71cd61e856276a48be7f44b2f21b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:51:27 GMT
server
cloudflare
age
590208
etag
W/"63fe775f-26a4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f5d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-share-buttons.min.css
cofense.com/wp-content/plugins/elementor-pro/assets/css/ 		30 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/css/widget-share-buttons.min.css
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad9c2058a29c9171478b694c2f8445a9e54531ed6660d05731d16f0776490e6b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 10 Feb 2023 17:51:06 GMT
server
cloudflare
age
2105975
etag
W/"63e6840a-777b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f5f927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
widget-posts.min.css
cofense.com/wp-content/plugins/elementor-pro/assets/css/ 		14 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/css/widget-posts.min.css
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0273e33c663ebeaca0f6c633c1b7a047f9d8bb55c8410801bccee5c153480545

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 27 Feb 2023 23:38:58 GMT
server
cloudflare
age
650667
etag
W/"63fd3f12-374b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f62927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-9276.css
cofense.com/wp-content/uploads/elementor/css/ 		5 KB
836 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-9276.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a7d5d0c9c86dc2db1249eee49e178e16885d04b41f20cab6e5ad4e5a51f89af

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70148
etag
W/"6406651d-12e5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f63927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-9277.css
cofense.com/wp-content/uploads/elementor/css/ 		5 KB
726 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-9277.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b6282f417900055c604419822eb0ff788d325f23c9eca94146e3086177e8f0a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70148
etag
W/"6406651d-15ce"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f64927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-9907.css
cofense.com/wp-content/uploads/elementor/css/ 		3 KB
532 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-9907.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3e04a15bb017b906d4834cb5da6e3ea409b5da37a0cd9cec4b62a496f8560a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70148
etag
W/"6406651d-a0d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f65927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-94175.css
cofense.com/wp-content/uploads/elementor/css/ 		3 KB
536 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-94175.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5cc98a7681a840c7940cf675360a0def2ffacf2ea52b046ce5354a9ee873dd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70148
etag
W/"6406651d-a1e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f67927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-94173.css
cofense.com/wp-content/uploads/elementor/css/ 		3 KB
523 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-94173.css?ver=1678140701
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaf3fbeb37e264707dd55409d3e8729dbbf6fdc39536e3961c59ec0a4ebad5f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:41 GMT
server
cloudflare
age
70147
etag
W/"6406651d-a1e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f69927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
regular.min.css
cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/ 		1 KB
422 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/regular.min.css?ver=1678140758
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f42fa1fe21c3cdf7ccfa09bfb44d1325bd3713e1ddb82e661e2c28002eef957

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 Mar 2023 22:12:38 GMT
server
cloudflare
etag
W/"64066556-442"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f6a927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
post-96724.css
cofense.com/wp-content/uploads/elementor/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/uploads/elementor/css/post-96724.css?ver=1678140702
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
edb409aebe8f4b88021a0c7c6b60abc2cfa4463f794b2429708cf3294681d0fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 06 Mar 2023 22:11:42 GMT
server
cloudflare
age
70148
etag
W/"6406651e-18d4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f6b927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
animations.min.css
cofense.com/wp-content/plugins/elementor/assets/lib/animations/ 		18 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 24 Feb 2023 17:51:50 GMT
server
cloudflare
age
951043
etag
W/"63f8f936-4824"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f6d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
lazysizes.min.js
cofense.com/wp-content/plugins/ewww-image-optimizer/includes/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js?ver=693
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c05a1108c176130e9dff2f6a5ebdb60be1c3e17b5a8f83de35b29f44fb109434

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:57 GMT
server
cloudflare
age
3827325
etag
W/"63cad625-3860"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f76927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
navigation.js
cofense.com/wp-content/themes/cofense/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/themes/cofense/js/navigation.js?ver=1.0.0
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ee0654259fda0bbfeab4305b895e740659613080d90352bd36c1452fd426ef6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:53 GMT
server
cloudflare
age
3907414
etag
W/"63cad621-ba4"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f79927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend-script.js
cofense.com/wp-content/plugins/elementskit-lite/libs/framework/assets/js/ 		40 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementskit-lite/libs/framework/assets/js/frontend-script.js?ver=2.8.5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8166c5475df6a64ab2456e95f64564164ed697d258e8bfed8cebca40efd6fa5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
477236
etag
"63ffca69-28"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0c89f7c927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
40
widget-scripts.js
cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/ 		134 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/widget-scripts.js?ver=2.8.5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdaa4c91b5bc3dd4ce8e1345b453844dd414602022a182ce2853d87bd4b9a9d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
514007
etag
W/"63ffca69-2193f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f7e927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
heartbeat.js
cofense.com/wp-content/plugins/wp-rocket/assets/js/ 		0
88 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/wp-rocket/assets/js/heartbeat.js?ver=3.12.5.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
cf-cache-status
HIT
last-modified
Thu, 09 Feb 2023 21:50:05 GMT
server
cloudflare
age
2222669
etag
"63e56a8d-0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0c89f7f927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
jquery.smartmenus.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/ 		25 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.0.1
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:51:28 GMT
server
cloudflare
age
601004
etag
W/"63fe7760-6272"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f81927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
imagesloaded.min.js
cofense.com/wp-includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 03 Mar 2023 17:38:52 GMT
server
cloudflare
age
252865
etag
W/"640230ac-15fd"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f82927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
webpack-pro.runtime.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.11.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7efa2a00682ddd7e88acefa0cb1a29fcf6f27767b1adca6cb9eaf14f86434270

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
477236
etag
W/"63ffca69-1526"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f84927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
webpack.runtime.min.js
cofense.com/wp-content/plugins/elementor/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7c0f82dd005d68a008eb43b8cac538cfdf12af97ab823ef63e6af2925b9272f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:51:28 GMT
server
cloudflare
age
601004
etag
W/"63fe7760-135e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f85927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend-modules.min.js
cofense.com/wp-content/plugins/elementor/assets/js/ 		36 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3d2467dafcf3ec25a9388f64b1db604286540134984e0b3dd81cba78fce1108

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 24 Feb 2023 17:51:50 GMT
server
cloudflare
age
951043
etag
W/"63f8f936-8e6c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f87927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
regenerator-runtime.min.js
cofense.com/wp-includes/js/dist/vendor/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:11:59 GMT
server
cloudflare
age
4484874
etag
W/"63c19eef-194b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f88927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
wp-polyfill.min.js
cofense.com/wp-includes/js/dist/vendor/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:11:59 GMT
server
cloudflare
age
4484874
etag
W/"63c19eef-459f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f89927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
hooks.min.js
cofense.com/wp-includes/js/dist/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:56:18 GMT
server
cloudflare
age
3768171
etag
W/"63cad5c2-132e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f8a927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
i18n.min.js
cofense.com/wp-includes/js/dist/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/dist/i18n.min.js?ver=9e794f35a71bb98672ae
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
01c3955df67a9b9d1367957e2c187729eae46b72e92c2b52bdb217b14a8fc874

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 28 Feb 2023 21:49:59 GMT
server
cloudflare
age
601004
etag
W/"63fe7707-27f6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f8b927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		22 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.11.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fae155199830495dcf89c32308098762ae8f8fcbfb81c1eb416507ab37fd1095

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:02 GMT
server
cloudflare
age
477236
etag
W/"63ffca6a-576a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f8d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
waypoints.min.js
cofense.com/wp-content/plugins/elementor/assets/lib/waypoints/ 		12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:58 GMT
server
cloudflare
age
3827325
etag
W/"63cad626-2fa6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f8f927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
core.min.js
cofense.com/wp-includes/js/jquery/ui/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:56:18 GMT
server
cloudflare
age
3907378
etag
W/"63cad5c2-53c0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f90927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
frontend.min.js
cofense.com/wp-content/plugins/elementor/assets/js/ 		41 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
54653e67bf7f952e3b4b2beae1d77c4e85012231efa6eecc4fcda2977b605e7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 24 Feb 2023 17:51:50 GMT
server
cloudflare
age
951043
etag
W/"63f8f936-a3b2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f91927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
elements-handlers.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		29 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.11.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f4845539af93678757bc744411935ce2e762443cdc380bfd237a7826e92b462

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:02 GMT
server
cloudflare
age
477236
etag
W/"63ffca6a-73a1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f94927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
animate-circle.js
cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/ 		810 B
535 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/animate-circle.js?ver=2.8.5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8667a50fdab17dd946e43e37c6fd1623583b9440bdca887e44cc726e48feedaf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
477236
etag
W/"63ffca69-32a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f97927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
elementor.js
cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementskit-lite/widgets/init/assets/js/elementor.js?ver=2.8.5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0b49c65cbdaa8f556ec513f0ea3f9502f1879f0168c8d0a7aa21370b9403c2c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
514006
etag
W/"63ffca69-4829"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f99927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
swiper.min.js
cofense.com/wp-content/plugins/elementor/assets/lib/swiper/ 		136 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=2.8.5
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:02 GMT
server
cloudflare
age
477236
etag
W/"63ffca6a-21f91"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f9a927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.sticky.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/lib/sticky/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver=3.11.3
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 01 Mar 2023 21:58:01 GMT
server
cloudflare
age
477236
etag
W/"63ffca69-e89"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0c89f9d927f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
lazyload.min.js
cofense.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 06 Jan 2023 18:07:56 GMT
server
cloudflare
age
4971650
etag
W/"63b8637c-2063"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0cb8b159007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
p.css
p.typekit.net/ 		5 B
181 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://p.typekit.net/p.css?s=1&k=zlo5wor&ht=tk&f=26014&a=103167865&app=typekit&e=css
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/cache/min/1/zlo5wor.css?ver=1678140702
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
last-modified
Sat, 16 Oct 2021 08:18:43 GMT
server
nginx
etag
"616a8ae3-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
gtm.js
www.googletagmanager.com/ 		292 KB
96 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
73dd3e4170d7dee382ae1041d931a72a4023cc6bec0f42c8dfaf97ea4968f3b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
97673
x-xss-protection
0
last-modified
Tue, 07 Mar 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 07 Mar 2023 20:57:51 GMT
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/ 		37 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Inter%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://cofense.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Thu, 02 Mar 2023 09:17:36 GMT
x-content-type-options
nosniff
age
474015
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37924
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 20:54:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Mar 2024 09:17:36 GMT
truncated
/ 		67 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
13ba7d85cedf2d5b14f9091119f9067689bdc33edde1d37a654787d416fbca34

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/svg+xml
/
cofense.com/
Redirect Chain
  • https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf
  • https://cofense.com/
155 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cofense.com/
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/uploads/elementor/css/post-15.css?ver=1678140700
Protocol
H3
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
d99c721b325b80c34fb26246a79f92a193a930e140196fe8b56d1dd9dd4213e9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/wp-content/uploads/elementor/css/post-15.css?ver=1678140700
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
x-cache-group
normal
content-encoding
br
cf-cache-status
DYNAMIC
x-cacheable
SHORT
server
cloudflare
x-powered-by
WP Engine
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
x-cache
HIT: 14
content-type
text/html; charset=UTF-8
cache-control
max-age=600, must-revalidate
cf-ray
7a45c0d1aa039007-FRA
link
<https://cofense.com/wp-json/>; rel="https://api.w.org/", <https://cofense.com/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json", <https://cofense.com/>; rel=shortlink
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
EXPIRED
server
cloudflare
vary
Accept-Encoding
content-type
text/html
location
https://cofense.com/
cf-ray
7a45c0d008059007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9868e8439115f9c036adc3182c02c60fb530968db2c8161abde30f695a33d6fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3031094ac314d1d3c5b37e16a10651ab1fd25067106abd2e2d3d7481e0044e9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f980a1f721b3ab441d00032ffd031a7b017de2677262608a1db5b15b4c40d0a4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/svg+xml
NETWORKHEADERBG-1.png
cofense.com/wp-content/uploads/2022/06/ 		57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cofense.com/wp-content/uploads/2022/06/NETWORKHEADERBG-1.png
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/uploads/elementor/css/post-1386.css?ver=1678140757
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab14a02f5ab4221421d12f9948a23f1c831a23c4143a05e5e95658b7cbfffe58

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/wp-content/uploads/elementor/css/post-1386.css?ver=1678140757
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
HIT
age
338395
cf-polished
origSize=79487, status=webp_bigger
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58284
cf-bgj
imgq:100,h2pri
last-modified
Fri, 03 Mar 2023 17:38:57 GMT
server
cloudflare
etag
"640230b1-1367f"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0cfffe69007-FRA
fa-brands-400.woff2
cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=1678140702
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Request headers

Referer
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=1678140702
Origin
https://cofense.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
HIT
last-modified
Fri, 03 Mar 2023 17:40:21 GMT
server
cloudflare
age
196951
etag
"64023105-12bdc"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0cffff59007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
76764
fa-solid-900.woff2
cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 		76 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=1678140702
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Request headers

Referer
https://cofense.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=1678140702
Origin
https://cofense.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
HIT
last-modified
Fri, 13 Jan 2023 18:13:40 GMT
server
cloudflare
age
4365354
etag
"63c19f54-13174"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0d0282d9007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
78196
dialog.min.js
cofense.com/wp-content/plugins/elementor/assets/lib/dialog/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.11.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b936db5880aa9b6b2f26a8d32fc2b689fb75f69d971b94194f16dba801221ffe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 20 Jan 2023 17:57:58 GMT
server
cloudflare
age
3823109
etag
W/"63cad626-29ba"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d0c8e79007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cofense.png
cofense.com/wp-content/uploads/2022/06/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cofense.com/wp-content/uploads/2022/06/cofense.png
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c45f781964e97c179059fb620032eddab4a86bf8af6cd3f7460b2fa839fedb10

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
HIT
age
597470
cf-polished
origFmt=png, origSize=4060
content-disposition
inline; filename="cofense.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3568
cf-bgj
imgq:100,h2pri
last-modified
Tue, 28 Feb 2023 21:50:06 GMT
server
cloudflare
etag
"63fe770e-fdc"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0d0c8ef9007-FRA
EmotetEmail.png
cofense.com/wp-content/uploads/2023/03/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cofense.com/wp-content/uploads/2023/03/EmotetEmail.png
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
346056f22908ec3b0d2fdb35d715bf0e9c5ce68999a0394eef7b893f2b8e593f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
HIT
age
12460
cf-polished
origFmt=png, origSize=25505
content-disposition
inline; filename="EmotetEmail.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
25490
cf-bgj
imgq:100,h2pri
last-modified
Tue, 07 Mar 2023 17:06:04 GMT
server
cloudflare
etag
"64076efc-63a1"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0d0c8f19007-FRA
EmotetDocFile.png
cofense.com/wp-content/uploads/2023/03/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cofense.com/wp-content/uploads/2023/03/EmotetDocFile.png
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ab2cbb6f0b67d5bee1a14c2a79fc4a7fc3c4df757fcdde9268e0540ba937806

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
cf-cache-status
MISS
last-modified
Tue, 07 Mar 2023 17:05:56 GMT
server
cloudflare
etag
"64076ef4-97ad"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7a45c0d0c8f39007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
38829
nav-menu.c8d112707fd7172d2a9d.bundle.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.c8d112707fd7172d2a9d.bundle.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.11.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 03 Feb 2023 17:47:14 GMT
server
cloudflare
age
2710402
etag
W/"63dd48a2-104f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d0d9049007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
text-editor.2c35aafbe5bf0e127950.bundle.min.js
cofense.com/wp-content/plugins/elementor/assets/js/ 		1 KB
882 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.11.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 06 Jan 2023 18:08:00 GMT
server
cloudflare
age
4971650
etag
W/"63b86380-54f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d119579007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
share-buttons.0bdd88c45462dfb2b073.bundle.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		1 KB
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.0bdd88c45462dfb2b073.bundle.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.11.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e121a132711448d3f71cb945d29c9b2305f7131c898873c1b243e2f841b3871

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 Mar 2023 21:52:51 GMT
server
cloudflare
etag
W/"640660b3-4bd"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d139859007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
load-more.c9f6aac03af905f4e206.bundle.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/load-more.c9f6aac03af905f4e206.bundle.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.11.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b4af6983752bcafa9f9b2fb5d74cab0cd5ccff9ab0098a5736f94b22ef0d1d6a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 03 Mar 2023 17:40:20 GMT
server
cloudflare
age
135181
etag
W/"64023104-15eb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d149959007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
posts.e33113a212454e383747.bundle.min.js
cofense.com/wp-content/plugins/elementor-pro/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor-pro/assets/js/posts.e33113a212454e383747.bundle.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.11.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dafabc5bcfd8a70b1103414f31b1ea2bf79a8fa23695d9fa7b4503f1c58b003

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 03 Mar 2023 17:40:20 GMT
server
cloudflare
age
135181
etag
W/"64023104-cfd"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d149969007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
6si.min.js
j.6sc.co/ 		33 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 09 Feb 2023 18:18:39 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63e538ff-820b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
10438
expires
Tue, 07 Mar 2023 20:57:51 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::6867:4832 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=36000
accept-ranges
bytes
content-length
4777
lt-v3.js
lltrck.com/scripts/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://lltrck.com/scripts/lt-v3.js?llid=19612
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.214.188.44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-188-44.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers
2Uq3HoQoVZEHgHXXf288
ws.zoominfo.com/pixel/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
28dd2bee72bd1d3f4bca7be2c3cdb689f92b8eaa1b40f67b9f960be4966b73a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
7a45c0d1db313a6a-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.24.170.43 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-170-43.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8de86d71297dc0c8a04caeab00e28f1fcadaa2574558098cccfddd3aa27b8172

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 07 Mar 2023 20:57:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Feb 2023 02:55:32 GMT
Server
AkamaiNetStorage
ETag
"d59e4096b6b551f06e189b1a016fc70a:1676602532.716228"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
746
oktrk.js
static.oktopost.com/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.oktopost.com/oktrk.js
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.110.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-110-123.vie50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 02:07:33 GMT
content-encoding
gzip
via
1.1 530e9f4b5e6084726110986459f0c18c.cloudfront.net (CloudFront)
last-modified
Mon, 27 Jan 2020 09:47:41 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C2
age
67819
etag
W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
x0I6iY7C_XhIKiAKalv0xRC2mOYeAyWqFk0kDzW13piXKagACQJSJA==
tracking.js
trk.techtarget.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c9f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
server
cloudflare
age
222
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
server-timing
cf-q-config;dur=7.0000000960135e-06
cf-ray
7a45c0d21a0e9271-FRA
expires
Tue, 07 Mar 2023 21:04:09 GMT
ed9ggbnvvo
www.clarity.ms/tag/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/ed9ggbnvvo?ref=gtm2
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:4f:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
c651dab7b95d009f9a4e6963b54f95d4640e6af77fe882451cbd63f0fe8f90cf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type
application/x-javascript
date
Tue, 07 Mar 2023 20:57:50 GMT
cache-control
no-cache, no-store
expires
-1
x-azure-ref
0T6UHZAAAAACWnBy4CNplRo/LbLBNg0HiRlJBMzFFREdFMDkyMAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
request-context
appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
js
www.googletagmanager.com/gtag/ 		248 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-3G76T4W3LR&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7f010e2e2cd74d23f181c35ff9e24b8e964f0fa742a1d62ea6a8be47324ceab1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
83863
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 07 Mar 2023 20:57:51 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 07 Mar 2023 19:17:30 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
6021
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Tue, 07 Mar 2023 21:17:30 GMT
munchkin.js
munchkin.marketo.net/162/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.24.170.43 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-170-43.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 07 Mar 2023 20:57:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Thu, 15 Jun 2023 20:57:51 GMT
collect
region1.analytics.google.com/g/ 		0
251 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-3G76T4W3LR&gtm=45je3360&_p=1323549060&_gaz=1&cid=315771449.1678222672&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1678222671&sct=1&seg=0&dl=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&dt=Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3G76T4W3LR&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:52 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://cofense.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
251 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-3G76T4W3LR&cid=315771449.1678222672&gtm=45je3360&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3G76T4W3LR&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://cofense.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-3G76T4W3LR&cid=315771449.1678222672&gtm=45je3360&aip=1&z=847367901
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:808::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
404-jhu-612.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://404-jhu-612.mktoresp.com/webevents/visitWebPage?_mchNc=1678222671757&_mchCn=&_mchId=404-JHU-612&_mchTk=_mch-cofense.com-1678222671757-51993&_mchHo=cofense.com&_mchPo=&_mchRu=%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 07 Mar 2023 20:57:52 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
a0857e2a-3adc-4701-a6e1-51c35b659d73
token
cdn.linkedin.oribi.io/partner/300721/domain/cofense.com/ 		36 B
376 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.linkedin.oribi.io/partner/300721/domain/cofense.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:5000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:01:25 GMT
content-encoding
gzip
via
1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
3386
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
lESRf3sEBxbogqzfPt2eGybOd1wrX5CExJr1RGI3D30AV4aLCTVA8Q==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1678222671762%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%25...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true...
0
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true&e_ipv6=AQLSGmhMS9SyeQAAAYa93cHNyAWriKzo_YiwuABJmLw83JVny638cIla3nSofHVVwg
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Server
13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: D88A69E6F9AB4A8CB0D087507340AB44 Ref B: VIEEDGE1517 Ref C: 2023-03-07T20:57:52Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2VapA4qiV130hF4O72g==

Redirect headers

date
Tue, 07 Mar 2023 20:57:51 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 37C20F3C744A42119A689B48624EED35 Ref B: FRAEDGE2015 Ref C: 2023-03-07T20:57:52Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1678222671762&url=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&tm=gtmv2&liSync=true&e_ipv6=AQLSGmhMS9SyeQAAAYa93cHNyAWriKzo_YiwuABJmLw83JVny638cIla3nSofHVVwg
x-li-proto
http/2
content-length
0
x-li-uuid
AAX2Vao8w3zVfxrCloPYOQ==
gif.gif
ibc-flow.techtarget.com/a/ 		43 B
470 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17654763&r=1678222671774&ref=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
17654763
Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
via
1.1 google
x-guploader-uploadid
ADPycdsaC1l_CHcJN0zGb7X9qqlTYhozcmUDpOOAnyVTsqf_RfhbMMT9v1QAqzOKBUUXZLIi7ijOfCyo0NSitN7H0mj99vQUoIfY
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Tue, 07 Mar 2023 21:57:52 GMT
gif.gif
ibc-flow.techtarget.com/a/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17654763&r=1678222671774&ref=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://cofense.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 07 Mar 2023 20:57:51 GMT
expires
Tue, 07 Mar 2023 20:57:51 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
ADPycduWeolbzl7UWGo-lL79x5X-UH-51MwwOV7LQJ4HdZgqDBQwyFotleo47jFGBJF323-uM2P0okimZRgRq1IB9Qn0Gmx9s3SF
getuidj
secure.adnxs.com/ 		11 B
807 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 07 Mar 2023 20:57:51 GMT
AN-X-Request-Uuid
3d9de0b0-090d-4758-9dc6-3b4a9a6eadc7
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://cofense.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
81.95.5.40; 81.95.5.40; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		7 B
199 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://cofense.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/ 		15 B
300 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a:3a2::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9181a6929147959668b1f69b492b777a5b60d239d9ab4bf2774c335e66389eae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://cofense.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::11
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466172_1600460636_3260341824_17_750_12_0";dur=1
content-length
15
expires
Tue, 07 Mar 2023 20:57:51 GMT
getuidj
secure.adnxs.com/ 		11 B
807 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 07 Mar 2023 20:57:51 GMT
AN-X-Request-Uuid
2ba441f3-3462-455d-ac02-d224fb558674
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://cofense.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
81.95.5.40; 81.95.5.40; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		7 B
199 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://cofense.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/ 		15 B
300 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a:3a2::1c91 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9181a6929147959668b1f69b492b777a5b60d239d9ab4bf2774c335e66389eae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://cofense.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:2b::11
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="466172_1600460636_3260341827_16_325_12_0";dur=1
content-length
15
expires
Tue, 07 Mar 2023 20:57:51 GMT
clarity.js
www.clarity.ms/eus2-c/s/0.7.2/ 		56 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/eus2-c/s/0.7.2/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/ed9ggbnvvo?ref=gtm2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:4f:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
99b523edd72385876c466fc061393829b08dec3aa544963373b22a08fb97784f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:51 GMT
content-encoding
br
last-modified
Wed, 01 Jun 2022 12:22:22 GMT
x-azure-ref-originshield
0lmEHZAAAAADTiYisdLngQppJKkgHFNUgRlJBMjMxMDUwNDE4MDMxADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
etag
"1d94d032bd8761c"
x-azure-ref
0T6UHZAAAAAAm0mzQ7/4RQYgnniCQFy0GRlJBMzFFREdFMDkyMAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
TCP_HIT
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
collect
stats.g.doubleclick.net/j/ 		4 B
151 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-114787942-1&cid=315771449.1678222672&jid=1278331176&gjid=857087310&_gid=1559489235.1678222672&_u=YCDAgUABAAAAAEAAI~&z=1795356455
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 07 Mar 2023 20:57:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://cofense.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j99&aip=1&a=1323549060&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&ul=en-us&de=UTF-8&dt=Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAgUABAAAAAAAAI~&jid=1278331176&gjid=857087310&cid=315771449.1678222672&tid=UA-114787942-1&_gid=1559489235.1678222672&gtm=45He3360n815RQ37KH&z=733361263
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 17:13:00 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
13491
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ping
okt.to/ 		0
100 B 		Script
General
Check archive.org
Download Go to
Full URL
https://okt.to/ping?uri=%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&aid=001shx33p56dsdg&ts=1678222671809
Requested by
Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.20.195.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-195-32.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
strict-transport-security
max-age=31536000;
content-type
text/javascript;charset=UTF-8
share-link.min.js
cofense.com/wp-content/plugins/elementor/assets/lib/share-link/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cofense.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.11.2
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.11.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 Mar 2023 21:52:51 GMT
server
cloudflare
etag
W/"640660b3-a3c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7a45c0d31b9d9007-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-114787942-1&cid=315771449.1678222672&jid=1278331176&_u=YCDAgUABAAAAAEAAI~&z=669456384
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-114787942-1&cid=315771449.1678222672&jid=1278331176&_u=YCDAgUABAAAAAEAAI~&z=669456384
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:808::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b253130e4accad98012a3abe3f4b4c7a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22b253130e4accad98012a3abe3f4b4c7a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22a9e769d7d96a596f969b9dc5023033e21a69bf40%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A11%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/ 		740 B
577 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.158.29.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-29-122.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
d7d62f1b6fc6f96998066b32b4d71d1ad2f1b399758f0e429398306f7571fa3d

Request headers

Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
Authorization
Token a9e769d7d96a596f969b9dc5023033e21a69bf40
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://cofense.com
access-control-allow-credentials
true
content-length
395
details
epsilon.6sense.com/v3/company/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.158.29.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-29-122.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://cofense.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://cofense.com
access-control-max-age
1800
date
Tue, 07 Mar 2023 20:57:51 GMT
server
nginx
collect
i.clarity.ms/ 		0
161 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus2-c/s/0.7.2/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin
https://cofense.com
date
Tue, 07 Mar 2023 20:57:51 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
vary
Origin
request-context
appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
7bbcf45a-e438-49af-a139-a80cbb71d63d
https://cofense.com/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://cofense.com/7bbcf45a-e438-49af-a139-a80cbb71d63d
Requested by
Host: cofense.com
URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&RedC=c.clarity.ms&MXFR=3D0E859A44456EE10AF7975740456082
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&MUID=127133581F016419078C21951EAD6553
42 B
441 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&MUID=127133581F016419078C21951EAD6553
Protocol
H2
Server
68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:51 GMT
last-modified
Wed, 15 Feb 2023 08:41:50 GMT
server
Microsoft-IIS/10.0
etag
"ddef9591941d91:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 07 Mar 2023 20:57:52 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 8138324B68C0492D926253F53090987C Ref B: FRA31EDGE0108 Ref C: 2023-03-07T20:57:52Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=5351C46D596143F2A7D1134D5ABDC650&MUID=127133581F016419078C21951EAD6553
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A51%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:52 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
i.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus2-c/s/0.7.2/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://cofense.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin
https://cofense.com
date
Tue, 07 Mar 2023 20:57:52 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
vary
Origin
request-context
appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A52%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:53 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:54 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:55 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=b253130e4accad98012a3abe3f4b4c7a&svisitor=null&visitor=d66f803d-ddb4-4ba7-8563-7097eef7921f&session=a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Mar%202023%2020%3A57%3A55%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Key%20Points%3A%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Emotet%20Sending%20Malicious%20Emails%20After%20Three-Month%20Hiatus%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fcofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F&pageViewId=bba7fed3-5592-4f43-8e48-9e0281b7cecd&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.86.2.89 Stockholm, Sweden, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-86-2-89.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cofense.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 20:57:56 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless undefined| $ function| jQuery object| wpml_cookies object| ecs_ajax_params boolean| canBeLoaded function| ECS_load_next_page function| EleCustomSkinChangeUrlPage function| EleCustomSkinReInitJs object| ECS_hooks number| ECS_Columns_Count function| ECS_add_action function| ECS_do_action object| dataLayer boolean| ewww_webp_supported object| eio_lazy_vars function| shouldAutoScale function| constrainSrc object| lazySizesConfig object| lazySizes function| _createClass function| _classCallCheck function| RocketBrowserCompatibilityChecker object| RocketPreloadLinksConfig object| elementskit function| EvEmitter function| imagesLoaded object| webpackChunkelementor_pro object| webpackChunkelementor object| elementorModules object| runtime object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp function| sprintf function| vsprintf object| ElementorProFrontendConfig object| elementorProFrontend function| Waypoint object| elementorFrontendConfig object| elementorFrontend object| ekit_config object| ElementsKit_Helper function| Swiper function| Sticky object| lazyLoadOptions function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| _6si function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _linkedin_data_partner_ids boolean| _already_called_lintrk boolean| llcookieless object| formalyze function| Attributor object| __utmz string| OktopostTrackerObject function| _oktrk object| techtargetic function| clarity object| DialogsManager string| GoogleAnalyticsObject function| ga function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| onYouTubeIframeAPIReady object| gaGlobal object| MunchkinTracker function| lintrk function| gtag object| gaplugins object| gaData object| ziws boolean| _storagePopulated function| ShareLink

34 Cookies

Domain/Path Name / Value
cofense.com/ Name: wp-wpml_current_language
Value: en
.cofense.com/ Name: _gcl_au
Value: 1.1.1649843467.1678222672
.cofense.com/ Name: attr_first
Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F%22%2C%22date%22%3A%222023-03-7%22%2C%22timestamp%22%3A1678222671614%7D
.cofense.com/ Name: attr_last
Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Femotet-sending-malicious-emails-after-three-month-hiatus%2F%22%2C%22date%22%3A%222023-03-7%22%2C%22timestamp%22%3A1678222671614%7D
.techtarget.com/ Name: __cf_bm
Value: E9dRAZ2DjP_E1xvCfSsBSUB.15SdrAMZgHq9kloyyxk-1678222671-0-AcCsvr9EOuA39Y1EmS87HyRTjiYYydYAZf/dam0a6VXAQj8g6MVrSSX7q6ChBGcnJi8wafFZdEsNaq2hSUktye0=
www.clarity.ms/ Name: CLID
Value: 7cbc5016f6874fc6bd0680b46c3ee0c1.20230307.20240306
.cofense.com/ Name: _mkto_trk
Value: id:404-JHU-612&token:_mch-cofense.com-1678222671757-51993
.cofense.com/ Name: _ga
Value: GA1.2.315771449.1678222672
.cofense.com/ Name: _gid
Value: GA1.2.1559489235.1678222672
.cofense.com/ Name: _dc_gtm_UA-114787942-1
Value: 1
.ws.zoominfo.com/ Name: visitorId
Value: e10ae1f6cac0ee1a30ed4b2a2c880487eb74dbcdd1de65cc13f8784fed8eb4b4
.zoominfo.com/ Name: __cf_bm
Value: Lzu6P.sPWVIIMhubYibDznUwYcI6lv2MoljVXIg3IJI-1678222671-0-AcaDMvBpbjfd/WKG0MiVsugaOAwcNIAFEw5Qo0MROu/0y0yonXTwfs1IRf734bRM+C5XV2mNHpIv26v8cKrEaVw=
.zoominfo.com/ Name: _cfuvid
Value: izRZhdQy.LUu2KVv03oH471BXBsIKejFyPI1e1qjiQs-1678222671813-0-604800000
cofense.com/ Name: ln_or
Value: eyIzMDA3MjEiOiJkIn0%3D
.cofense.com/ Name: _clck
Value: 22z70a|1|f9p|0
cofense.com/ Name: _an_uid
Value: 0
cofense.com/ Name: _gd_visitor
Value: d66f803d-ddb4-4ba7-8563-7097eef7921f
cofense.com/ Name: _gd_session
Value: a5bb11b4-c67e-4cb7-8347-48cd6b3fcb17
.linkedin.com/ Name: UserMatchHistory
Value: AQJ_SodXeSV5cgAAAYa93cA8n5R9q76rDxL39ZwVnpqQkOwhp6w1q4pk22Ue34KkDSesfQ1zoja9-w
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJF5p20Mi1gTAAAAYa93cA8EwlNOe5xKj6wP1jwPtITj-YfYawfnwtJBEclHD77I8hS5wwIypSomyBBAB9xQA
.linkedin.com/ Name: bcookie
Value: "v=2&864bb8df-2cfc-4d60-89e0-d20b46eb8e96"
.linkedin.com/ Name: lidc
Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2693:u=1:x=1:i=1678222671:t=1678309071:v=2:sig=AQFEO_GGA47og5eiuDSi38BLOyFOK_eS"
.6sc.co/ Name: 6suuid
Value: 25f01502ef29000050a5076469000000fe350000
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230307205752e7d99c76-596e-42a4-8be3-0aecf95f352eAQFTX6Zot5swTlyW4WfIuntlJmv-0kXK"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzgyMjI2NzI7MjswMjG251o7v0V+024s+SUAhMT4UtJnz9ulRzICO0bHr2uM9g==
.cofense.com/ Name: _ga_3G76T4W3LR
Value: GS1.1.1678222671.1.0.1678222672.59.0.0
.cofense.com/ Name: _clsk
Value: 196b2dt|1678222672447|1|1|i.clarity.ms/collect
.bing.com/ Name: MUID
Value: 127133581F016419078C21951EAD6553
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 127133581F016419078C21951EAD6553
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 127133581F016419078C21951EAD6553
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0

9 Console Messages

Source Level URL
Text
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
Failed to decode downloaded font: https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
Failed to decode downloaded font: https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
Failed to decode downloaded font: https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
Failed to decode downloaded font: https://cofense.com/wp-content/uploads/2022/05/Inter-Medium.ttf
other warning URL: https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
network error URL: https://lltrck.com/scripts/lt-v3.js?llid=19612
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

404-jhu-612.mktoresp.com
b.6sc.co
c.6sc.co
c.bing.com
c.clarity.ms
cdn.linkedin.oribi.io
cofense.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
i.clarity.ms
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
lltrck.com
munchkin.marketo.net
okt.to
p.typekit.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
secure.adnxs.com
snap.licdn.com
static.oktopost.com
stats.g.doubleclick.net
trk.techtarget.com
ws.zoominfo.com
www.clarity.ms
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
13.107.43.14
13.32.110.123
141.193.213.20
18.158.29.122
184.24.170.43
184.86.2.89
185.89.210.180
192.28.144.124
2001:4860:4802:32::36
2600:9000:2251:5000:2:53b2:240:93a1
2606:4700::6810:a852
2606:4700::6812:c9f
2620:1ec:21::14
2620:1ec:4f:1::45
2620:1ec:c11::200
2a00:1450:4001:801::2003
2a00:1450:4001:806::2004
2a00:1450:4001:82a::200a
2a00:1450:400d:803::2008
2a00:1450:400d:808::2003
2a00:1450:400d:80a::200e
2a00:1450:4025:401::9d
2a02:26f0:11a:3a2::1c91
2a02:26f0:11a::6867:4832
2a02:26f0:3500:16::215:148b
3.214.188.44
34.111.208.231
52.167.85.21
52.20.195.32
68.219.88.97
01c3955df67a9b9d1367957e2c187729eae46b72e92c2b52bdb217b14a8fc874
0273e33c663ebeaca0f6c633c1b7a047f9d8bb55c8410801bccee5c153480545
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0962f989ad81efa264ab002655675c486b6853cdf4a2f0ff524b3a0a347f5225
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0ec717c896d0ca54e4536263e84f11f43a944ba2e04d2f5f1264f0acdc7beada
10e50c3101d259dd39f23f6315b85ed5912fe05ac84db44bd3d5ccc864bad48c
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
13ba7d85cedf2d5b14f9091119f9067689bdc33edde1d37a654787d416fbca34
1827802b8b1f515c876c7c3d78003a2e3f50deef33d6db220881e24fa8056909
1a7d5d0c9c86dc2db1249eee49e178e16885d04b41f20cab6e5ad4e5a51f89af
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
22a79f1fbcc70373c7021bae2164d9232d1e9dd3c6a163df9f9f54070e5f6b50
28dd2bee72bd1d3f4bca7be2c3cdb689f92b8eaa1b40f67b9f960be4966b73a4
2cb5457685443a489c3b38e5fcbb0a8262cc79b5fdb36761db8af0b8d99a396e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
346056f22908ec3b0d2fdb35d715bf0e9c5ce68999a0394eef7b893f2b8e593f
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
38f98805ed3d35d88c84153ed39978d093da023940a231b7ea95c569eab04884
3c1a5c4b5574a4104a92b2e700e6f0fc5b001c4297ebc5a1e76d67b1fbeb1c2d
3f4845539af93678757bc744411935ce2e762443cdc380bfd237a7826e92b462
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
44c68a4716777a09c291d971f91468c7e72dd2beadecd931aaea641758f4d726
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
46809652e471f149e960a31d8228bacc666d56f857eb1a8f639f32c3c6554335
4b6282f417900055c604419822eb0ff788d325f23c9eca94146e3086177e8f0a
4f42fa1fe21c3cdf7ccfa09bfb44d1325bd3713e1ddb82e661e2c28002eef957
533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020
54653e67bf7f952e3b4b2beae1d77c4e85012231efa6eecc4fcda2977b605e7b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
566d4c5dfefc9c4d867e6bef080917a4273b4228731a8700e81f1763eae3d861
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
6dafabc5bcfd8a70b1103414f31b1ea2bf79a8fa23695d9fa7b4503f1c58b003
6eafef48033bf87526b129f8f292a7ea8b943988241b3abefe94d3a95668ac8a
6fe59d88646876bb8dfb4a1a021b2dc2662b36bf175625eb3ecb89a3ae956937
71966cb221a057ee9313fb232e40c7a0a70d2e472909c3947f4878c8e195ad53
727a730eda79071d5f02ba91d752c3feed10e0cd63a9c042f298390c24f85236
73b2fdcf25aa909c7b0f072cf791066350ab834ca1d0d01ef096bb5583318213
73dd3e4170d7dee382ae1041d931a72a4023cc6bec0f42c8dfaf97ea4968f3b9
7ab2cbb6f0b67d5bee1a14c2a79fc4a7fc3c4df757fcdde9268e0540ba937806
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7efa2a00682ddd7e88acefa0cb1a29fcf6f27767b1adca6cb9eaf14f86434270
7f010e2e2cd74d23f181c35ff9e24b8e964f0fa742a1d62ea6a8be47324ceab1
82aca67a00aae2784b36da4e109bc57a5a27031ed3b45254bb2fc8d3f60d2b36
82b28becadf6ab1c3eaf14ee8bf08e65a5f138234f83f6b026e43ff171823d66
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8667a50fdab17dd946e43e37c6fd1623583b9440bdca887e44cc726e48feedaf
8aef119b0af028d678724b6db4e3fba9dbc158c485f46856a560b64ae1df833f
8cbc49b1385bf29debe95333f04795a6e3a2cf218d88b415b29872d06491fd1c
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
8de86d71297dc0c8a04caeab00e28f1fcadaa2574558098cccfddd3aa27b8172
8e121a132711448d3f71cb945d29c9b2305f7131c898873c1b243e2f841b3871
8ee0654259fda0bbfeab4305b895e740659613080d90352bd36c1452fd426ef6
8ef11cc1aa7203a8c5f634e92d4cef9c5148e3d7761a85fd90bc058c36c1ad09
9181a6929147959668b1f69b492b777a5b60d239d9ab4bf2774c335e66389eae
95af163892829a3ef249441b70b2c8281b845edea4b24680d3326486861d6082
9868e8439115f9c036adc3182c02c60fb530968db2c8161abde30f695a33d6fa
99b523edd72385876c466fc061393829b08dec3aa544963373b22a08fb97784f
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
a2245bdd49577557da1504c6bbacf3670e2b998302dbd724949a8c6312c50e82
a3d2467dafcf3ec25a9388f64b1db604286540134984e0b3dd81cba78fce1108
a7c0f82dd005d68a008eb43b8cac538cfdf12af97ab823ef63e6af2925b9272f
ab14a02f5ab4221421d12f9948a23f1c831a23c4143a05e5e95658b7cbfffe58
ad9c2058a29c9171478b694c2f8445a9e54531ed6660d05731d16f0776490e6b
b2282b97c6a076f4fdf2acf780ce5b25c59d4334bc1460ce49158684b8d827a0
b23f49f504faa32aac548b6662ffd64412f6738496fab8be38da46c5b7121804
b2dc460864a60ac3ce89c4c6fab1c62ef9171ac1365cc47aa8aca95ecb06f0cf
b3c983227e71c4f8da7d9af830cde723a94fd1a3a712e666c1f389dfac405bb9
b4af6983752bcafa9f9b2fb5d74cab0cd5ccff9ab0098a5736f94b22ef0d1d6a
b8166c5475df6a64ab2456e95f64564164ed697d258e8bfed8cebca40efd6fa5
b8449a28a151415d580be1dfd69056906199f1dd6ceb2c1b5edf61950ada9d13
b89b6165327872066d09bf529b6f131b238a193e71a8ab9108b2ea40ae92d3f8
b936db5880aa9b6b2f26a8d32fc2b689fb75f69d971b94194f16dba801221ffe
bacd426460574c0fc84822fd3846441f1040b4374c8350d67271049bd29fc6d7
beeb705b69f299ad7567ae7ba292ae685556a7082531220a088a0d3b3307c410
c05a1108c176130e9dff2f6a5ebdb60be1c3e17b5a8f83de35b29f44fb109434
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
c3dfc3f03106f85ab56ceaadf44433f35cca4209d64922d50a1c650c90aa60ad
c45f781964e97c179059fb620032eddab4a86bf8af6cd3f7460b2fa839fedb10
c651dab7b95d009f9a4e6963b54f95d4640e6af77fe882451cbd63f0fe8f90cf
ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cdaa4c91b5bc3dd4ce8e1345b453844dd414602022a182ce2853d87bd4b9a9d3
d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9
d08fa1906998435f62fea09b51c792ed9b1d93a9636efe4fa8981599c7de9419
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f
d7d62f1b6fc6f96998066b32b4d71d1ad2f1b399758f0e429398306f7571fa3d
d99c721b325b80c34fb26246a79f92a193a930e140196fe8b56d1dd9dd4213e9
dc7e118b7e07217031d017282955569cb66891f527050135caadb2dd5779824f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0b49c65cbdaa8f556ec513f0ea3f9502f1879f0168c8d0a7aa21370b9403c2c
e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae
e3031094ac314d1d3c5b37e16a10651ab1fd25067106abd2e2d3d7481e0044e9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5cc98a7681a840c7940cf675360a0def2ffacf2ea52b046ce5354a9ee873dd8
eaf3fbeb37e264707dd55409d3e8729dbbf6fdc39536e3961c59ec0a4ebad5f0
edb409aebe8f4b88021a0c7c6b60abc2cfa4463f794b2429708cf3294681d0fe
ee14e1c34ca92b9c270bf567a0bb381f83c6151be2020a948547c3e9de2e9cd3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f3e04a15bb017b906d4834cb5da6e3ea409b5da37a0cd9cec4b62a496f8560a1
f51ee281e24140f1f9b7cd29d11ad519d0e71cd61e856276a48be7f44b2f21b3
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f980a1f721b3ab441d00032ffd031a7b017de2677262608a1db5b15b4c40d0a4
fae155199830495dcf89c32308098762ae8f8fcbfb81c1eb416507ab37fd1095
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869