URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Submission: On August 02 via api from TR — Scanned from US

Summary

This website contacted 44 IPs in 2 countries across 31 domains to perform 130 HTTP transactions. The main IP is 2a02:e980:e6::cf, located in United States and belongs to INCAPSULA, US. The main domain is www.proofpoint.com. The Cisco Umbrella rank of the primary domain is 290993.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 5th 2024. Valid for: a year.
This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
42 2a02:e980:e6::cf 19551 (INCAPSULA)
2 2607:f8b0:400... 15169 (GOOGLE)
1 151.101.65.91 54113 (FASTLY)
2 18.165.83.61 16509 (AMAZON-02)
1 142.251.163.155 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 23.1.44.149 16625 (AKAMAI-AS)
5 104.16.93.80 13335 (CLOUDFLAR...)
2 34.96.102.137 396982 (GOOGLE-CL...)
2 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:250... 16509 (AMAZON-02)
1 2 3.17.237.129 16509 (AMAZON-02)
2 2001:4860:480... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
1 142.250.31.97 15169 (GOOGLE)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2600:1408:c40... 20940 (AKAMAI-ASN1)
10 2606:4700::68... 13335 (CLOUDFLAR...)
1 13.32.208.17 16509 (AMAZON-02)
2 2a03:2880:f00... 32934 (FACEBOOK)
1 2606:4700:440... 13335 (CLOUDFLAR...)
4 34.198.35.213 14618 (AMAZON-AES)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 68.67.160.184 29990 (ASN-APPNEX)
1 2600:9000:250... 16509 (AMAZON-02)
2 142.251.16.157 15169 (GOOGLE)
4 2600:9000:26c... 16509 (AMAZON-02)
1 2 142.250.31.148 15169 (GOOGLE)
1 192.28.144.124 15224 (OMNITURE)
2 23.73.207.9 20940 (AKAMAI-ASN1)
2 2620:1ec:bdf::40 8075 (MICROSOFT...)
2 34.111.208.231 396982 (GOOGLE-CL...)
4 6 2620:1ec:21::14 8068 (MICROSOFT...)
1 2620:1ec:50::12 8075 (MICROSOFT...)
1 107.23.203.136 14618 (AMAZON-AES)
2 172.253.115.105 15169 (GOOGLE)
1 104.16.92.80 13335 (CLOUDFLAR...)
2 2a03:2880:f10... 32934 (FACEBOOK)
3 51.8.64.151 8075 (MICROSOFT...)
2 13.32.208.104 16509 (AMAZON-02)
3 172.64.150.44 13335 (CLOUDFLAR...)
1 2 20.110.205.119 8075 (MICROSOFT...)
2 104.16.118.43 13335 (CLOUDFLAR...)
1 142.251.179.101 15169 (GOOGLE)
130 44
Apex Domain
Subdomains
Transfer
42 proofpoint.com
www.proofpoint.com — Cisco Umbrella Rank: 290993
1 MB
11 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 5787
buttons-config.sharethis.com — Cisco Umbrella Rank: 6537
l.sharethis.com — Cisco Umbrella Rank: 6409
platform-cdn.sharethis.com — Cisco Umbrella Rank: 12361
t.sharethis.com — Cisco Umbrella Rank: 7974
66 KB
10 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 19182
7 KB
7 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 669
www.linkedin.com — Cisco Umbrella Rank: 914
px4.ads.linkedin.com — Cisco Umbrella Rank: 7330
4 KB
7 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 1114
h.clarity.ms — Cisco Umbrella Rank: 19880
c.clarity.ms — Cisco Umbrella Rank: 1838
29 KB
6 marketo.com
app-abj.marketo.com
72 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 252
googleads.g.doubleclick.net — Cisco Umbrella Rank: 77
4788165.fls.doubleclick.net
4 KB
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 4688
10 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 534
c.bing.com — Cisco Umbrella Rank: 341
17 KB
4 google.com
analytics.google.com — Cisco Umbrella Rank: 238
www.google.com — Cisco Umbrella Rank: 10
128 B
3 zi-scripts.com
js.zi-scripts.com — Cisco Umbrella Rank: 15834
4 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 66995
ibc-flow.techtarget.com — Cisco Umbrella Rank: 63746
2 KB
3 driftt.com
js.driftt.com — Cisco Umbrella Rank: 17606
62 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 104
21 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 112
313 KB
2 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 10891
2 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 108
4 KB
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 764
2 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 236
74 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110
3 KB
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 4988
3 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 8471
6 KB
2 geoip-js.com
geoip-js.com — Cisco Umbrella Rank: 33053
2 KB
1 crwdcntrl.net
bcp.crwdcntrl.net — Cisco Umbrella Rank: 1296
535 B
1 mktoresp.com
309-rhv-619.mktoresp.com
318 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 48041
280 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 42102
279 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1884
14 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 176
21 KB
1 mutinycdn.com
client-registry.mutinycdn.com — Cisco Umbrella Rank: 47658
17 KB
0 6sc.co Failed
j.6sc.co Failed
130 31
Domain Requested by
42 www.proofpoint.com www.proofpoint.com
www.googletagmanager.com
10 tracking.g2crowd.com www.proofpoint.com
tracking.g2crowd.com
6 app-abj.marketo.com www.proofpoint.com
app-abj.marketo.com
5 px.ads.linkedin.com 3 redirects snap.licdn.com
4 platform-cdn.sharethis.com www.proofpoint.com
4 tags.srv.stackadapt.com www.proofpoint.com
tags.srv.stackadapt.com
3 js.zi-scripts.com www.proofpoint.com
js.zi-scripts.com
3 h.clarity.ms www.clarity.ms
3 js.driftt.com www.proofpoint.com
js.driftt.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.proofpoint.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 www.googletagmanager.com www.proofpoint.com
www.googletagmanager.com
2 ws.zoominfo.com js.zi-scripts.com
2 c.clarity.ms 1 redirects
2 www.facebook.com www.proofpoint.com
2 www.google.com www.proofpoint.com
2 ibc-flow.techtarget.com trk.techtarget.com
2 www.clarity.ms bat.bing.com
www.clarity.ms
2 t.sharethis.com platform-api.sharethis.com
t.sharethis.com
2 4788165.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 googleads.g.doubleclick.net www.googleadservices.com
www.googletagmanager.com
2 secure.adnxs.com 2 redirects
2 connect.facebook.net www.proofpoint.com
connect.facebook.net
2 analytics.google.com www.googletagmanager.com
2 l.sharethis.com 1 redirects www.proofpoint.com
2 fonts.googleapis.com www.proofpoint.com
2 dev.visualwebsiteoptimizer.com www.proofpoint.com
2 munchkin.marketo.net www.proofpoint.com
munchkin.marketo.net
2 geoip-js.com www.proofpoint.com
geoip-js.com
2 platform-api.sharethis.com www.proofpoint.com
platform-api.sharethis.com
1 c.bing.com 1 redirects
1 bcp.crwdcntrl.net platform-api.sharethis.com
1 px4.ads.linkedin.com www.proofpoint.com
1 www.linkedin.com 1 redirects
1 309-rhv-619.mktoresp.com munchkin.marketo.net
1 attr.ml-api.io www.proofpoint.com
1 s.ml-attr.com 1 redirects
1 trk.techtarget.com www.proofpoint.com
1 snap.licdn.com www.proofpoint.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 www.googleadservices.com www.proofpoint.com
1 client-registry.mutinycdn.com www.proofpoint.com
0 j.6sc.co Failed www.googletagmanager.com
130 44
Subject Issuer Validity Valid
proofpoint.com
Sectigo RSA Organization Validation Secure Server CA
2024-07-05 -
2025-07-05
a year crt.sh
*.google-analytics.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
client-registry.mutinycdn.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-03-06 -
2025-04-07
a year crt.sh
sharethis.com
Amazon RSA 2048 M03
2024-04-19 -
2025-05-17
a year crt.sh
*.googleadservices.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
geoip-js.com
WE1
2024-06-14 -
2024-09-12
3 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-12-08 -
2024-12-11
a year crt.sh
app-abj.marketo.com
Cloudflare Inc ECC CA-3
2024-03-05 -
2024-12-31
10 months crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2024-06-29 -
2025-07-31
a year crt.sh
upload.video.google.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
*.google.com
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
*.g.doubleclick.net
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 04
2024-06-19 -
2024-12-16
6 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-12-13 -
2024-12-12
a year crt.sh
g2crowd.com
WE1
2024-06-23 -
2024-09-21
3 months crt.sh
drift.com
Amazon RSA 2048 M03
2024-07-30 -
2025-08-27
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2024-05-11 -
2024-08-09
3 months crt.sh
trk.techtarget.com
WE1
2024-07-23 -
2024-10-21
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M03
2023-09-09 -
2024-10-07
a year crt.sh
*.doubleclick.net
WR2
2024-07-30 -
2024-10-22
3 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-09-07 -
2024-10-07
a year crt.sh
cert1-prod.aut.a24365.net
R11
2024-07-29 -
2024-10-27
3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2023-12-07 -
2024-12-07
a year crt.sh
ibc-flow.techtarget.com
WR3
2024-07-02 -
2024-09-30
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-07-01 -
2025-01-01
6 months crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01
2023-10-08 -
2024-11-05
a year crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh
zi-scripts.com
WE1
2024-07-25 -
2024-10-23
3 months crt.sh
zoominfo.com
E5
2024-07-18 -
2024-10-16
3 months crt.sh

This page contains 6 frames:

Primary Page: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Frame ID: E715FB65B98D7B391F2FF86C971CD75C
Requests: 124 HTTP requests in this frame

Frame: https://4788165.fls.doubleclick.net/activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698
Frame ID: 92A07386E2479836644D7BDC0791207F
Requests: 1 HTTP requests in this frame

Frame: https://app-abj.marketo.com/index.php/form/XDFrame
Frame ID: CF8C1A686D380A7C3CE5FB55CD0EB740
Requests: 1 HTTP requests in this frame

Frame: https://t.sharethis.com/a/t_.htm?ver=1.1497.23399&cid=c010&cls=B
Frame ID: C95F41FFA68EB1549CBB6EABCA56A417
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=5dfsgn7m2kst&eId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=86f9959d-0c9b-43c1-9f90-3762bbb275fc&sessionStarted=1722575414.793&campaignRefreshToken=836ebe01-6aa9-4758-8293-b22c5d5482d7&hideController=false&pageLoadStartTime=1722575411927&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats
Frame ID: 5F6D7A36756B771C22E65282752BBF05
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1722575411927
Frame ID: F3FDDC699C250F150201E68625586B2F
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Page Statistics

130
Requests

95 %
HTTPS

42 %
IPv6

31
Domains

44
Subdomains

44
IPs

2
Countries

1971 kB
Transfer

5659 kB
Size

75
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43
  • https://l.sharethis.com/pview?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&cms=unknown&publisher=6543fd1a2398960013d900a7&sop=true&version=st_sop.js&lang=en&description=Key%20findings%C2%A0%20Proofpoint%20has%20observed%20an%20increase%20in%20malware%20delivery%20via%20TryCloudflare%20Tunnel%20abuse.%C2%A0%20The%20activity%20is%20financially%20motivated%20and%20delivers%20exclusively%20remote%20access%20trojans%20(RATs).%C2%A0%C2%A0...&ua=&ua_mobile=false&ua_full_version_list=&uuid=0194e41a-33db-4a68-9899-c4a07d1e52c4 HTTP 301
  • https://l.sharethis.com/sc?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&cms=unknown&publisher=6543fd1a2398960013d900a7&sop=true&version=st_sop.js&lang=en&description=Key%20findings%C2%A0%20Proofpoint%20has%20observed%20an%20increase%20in%20malware%20delivery%20via%20TryCloudflare%20Tunnel%20abuse.%C2%A0%20The%20activity%20is%20financially%20motivated%20and%20delivers%20exclusively%20remote%20access%20trojans%20(RATs).%C2%A0%C2%A0...&ua=&ua_mobile=false&ua_full_version_list=&uuid=0194e41a-33db-4a68-9899-c4a07d1e52c4&samesite=None
Request Chain 69
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=6233023589567718437
Request Chain 82
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698 HTTP 302
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698
Request Chain 97
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%252C3976212%26time%3D1722575413413%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fblog%252Fthreat-insight%252Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&cookiesTest=true&liSync=true&e_ipv6=AQL4GVPXgPAy8gAAAZERfuMPL9EzNgZFra0XJiJJC39iGLdm-_YxGDk3AwivBfd67lapew
Request Chain 119
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&RedC=c.clarity.ms&MXFR=1C3FD3F0B51C63B601E8C73FB11C6D47 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&MUID=253A83F6A33A6CDD12AE9739A2D46D41

130 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request threat-actor-abuses-cloudflare-tunnels-deliver-rats
www.proofpoint.com/us/blog/threat-insight/
86 KB
21 KB
Document
General
Full URL
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
73ed76bb6de95a184c2bc13662075980a6c88be5efd5eb1de0fa3a38188217d6
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control
max-age=28792, public
Content-Encoding
gzip
Content-Length
17833
Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
Content-Type
text/html; charset=UTF-8
Date
Fri, 02 Aug 2024 05:10:11 GMT
Etag
"1722503405-gzip"
Expires
Fri, 02 Aug 2024 13:10:03 GMT
Feature-Policy
geolocation 'self'
Last-Modified
Thu, 01 Aug 2024 09:10:05 GMT
Referrer-Policy
origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-CDN
Imperva
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 85) q(0 -1 -1 1) r(0 -1)
X-Imperva-Purge-Tags
fk0h,2171,rsmc,0plh,r6o8,li2r,ebfb,unor,vunp,jtbm,jamf,p7tt,khv0,8qo7,eken,6bqn,bvs8,f24q,h17a,ur5g,va3c,27bp,mlk7,opnv,t4ru,qr22,7nqj,o92e,o6l2,9lcq,fj6k,shcs,l2u0,5cr3,80b8,mu60,us5v,vkkb,v2on,prna,j81r,bisg
X-Permitted-Cross-Domain-Policies
none
js
www.googletagmanager.com/gtag/
323 KB
105 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
96f878284acab47e825e2b385085430c9d76cc746bb05aa2e751d9421bfa6b0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
107551
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 02 Aug 2024 05:10:12 GMT
d454424c4514a20a.js
client-registry.mutinycdn.com/personalize/client/
53 KB
17 KB
Script
General
Full URL
https://client-registry.mutinycdn.com/personalize/client/d454424c4514a20a.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.91 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d9e6caeb8d34d33a957ddfb11bfd04565231812c653f9380a09737765495a341

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id
WFut0ZtOkulesXwSHRT8_ASL12HgWjN4
x-continent-code
NA
content-encoding
gzip
date
Fri, 02 Aug 2024 05:10:12 GMT
via
1.1 varnish
x-edge-region
US-West
x-amz-request-id
BNBCAMFZSYPW908E
age
3534
x-amz-server-side-encryption
AES256
x-cache
HIT
x-edge-datacenter
BUR
content-length
17043
x-amz-id-2
de6Q/9dSMbGoQmr7/OzH8VwU7RpgFs15De4i+qisE96ZgYqB/OY4DBVif7jy9KuzErqdo5lBEyY=
x-served-by
cache-bur-kbur8200103-BUR
x-connection-speed
broadband
last-modified
Mon, 22 Jul 2024 16:16:42 GMT
server
AmazonS3
etag
"125d42cc47c79942299dcb38bffc704b"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
s-maxage=3600, max-age=0
vary
X-Continent-Code, Accept-Encoding
accept-ranges
bytes
x-country-code
US
x-cache-hits
0
proofpoint.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
18 KB
18 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"01c16c31"
X-Iinfo
18-11738158-0 0CNN RT(1722575411835 80) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
18296
Expires
Thu, 15 Aug 2024 07:15:36 GMT
RobotoCondensed-Regular-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Regular-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"39ed386e"
Content-Type
application/font-woff
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 82) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=959556, public
Content-Length
20951
Expires
Tue, 13 Aug 2024 07:42:47 GMT
fjalla-one-v7-latin-regular.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
20 KB
20 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"3a88d25f"
Content-Type
application/font-woff
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 84) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
19954
Expires
Thu, 15 Aug 2024 07:15:36 GMT
fjalla-one-v7-latin-regular.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
16 KB
17 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"80852160"
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 73) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
16540
Expires
Thu, 15 Aug 2024 07:15:36 GMT
RobotoCondensed-Bold-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Bold-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"8df65834"
Content-Type
application/font-woff
X-Iinfo
10-947467-0 0CNN RT(1722575411836 74) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
21304
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4b274cd219e6f9e664781b8997843f0881f8911ffbc922349ec4c7b35d50ed78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"f6fb6a17"
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 402) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
31932
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
33 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0b291571122aec79a4f86f9e799ff7707ee3dc914413f425feede8259612ecc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"715d0b99"
Content-Type
application/font-woff
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 216) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
32803
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss-Italic.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
33 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Italic.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
72a15930d7a4561b6af10b65f0e28f3956ef3001404e6fa5ed15ae795567befc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"803b9ae6"
X-Iinfo
10-947467-0 0CNN RT(1722575411836 219) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
32892
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss-Italic.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
33 KB
33 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Italic.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
737324c6a9ca813b87b9a4a164306097cbcb07bc96b74db797f9cd8cee9fc31a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"a22e4f0f"
Content-Type
application/font-woff
X-Iinfo
18-11738158-0 0CNN RT(1722575411835 235) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
33778
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss-Medium.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Medium.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e0d9ca9316294d8c98704da12c55856a2bc837adf42106bb0b7ab89f77115540
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"9545894f"
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 237) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
31844
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss-Medium.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
32 KB
32 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Medium.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
a54fee5912de81021ec64a51dc08b3781b38be49e178936b134ff777e23185ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"a8e8cd5d"
Content-Type
application/font-woff
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 238) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=959560, public
Content-Length
32534
Expires
Tue, 13 Aug 2024 07:42:52 GMT
Swiss-Bold.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
31 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Bold.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0660976790bb5eed64d9617a793a7fcd80b6180f6793c9a68162d0ea12114f2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"013bb7f6"
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 485) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
31304
Expires
Thu, 15 Aug 2024 07:15:36 GMT
Swiss-Bold.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
31 KB
31 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/Swiss-Bold.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d756aa94bf52a495078ecadd896d7deec037433e2df5609d7bd0d5388f084997
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Origin
https://www.proofpoint.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"3ffdb236"
Content-Type
application/font-woff
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 296) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=959564, public
Content-Length
31716
Expires
Tue, 13 Aug 2024 07:42:56 GMT
css_SzsfcKm17EaxTSftk5pG4vhuvmtTMk2JTGHvDvyHSOU.css
www.proofpoint.com/sites/default/files/css/
25 KB
5 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_SzsfcKm17EaxTSftk5pG4vhuvmtTMk2JTGHvDvyHSOU.css?delta=0&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88dfd6fc2bf5814e1fd826b25417ab4e0f11354c5adf2fa49dad6d97e444ebb6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Fri, 19 Jul 2024 04:04:54 GMT
X-CDN
Imperva
Content-Type
text/css
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 230) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1138468, public
Content-Length
4439
Expires
Thu, 15 Aug 2024 09:24:39 GMT
css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css
www.proofpoint.com/sites/default/files/css/
453 KB
37 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
27a16b821d4421779cf21f213da4cc950c3a3eab3b3811f0937c40bc02a75328
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Thu, 25 Jul 2024 23:17:24 GMT
X-CDN
Imperva
Content-Type
text/css
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 320) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=973507, public
Content-Length
37793
Expires
Tue, 13 Aug 2024 11:35:18 GMT
js_Wi8RdyzDF-uwGcwq9eMv1Giiu7RfMo7nYneG5kg6rd4.js
www.proofpoint.com/sites/default/files/js/
2 KB
1 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Wi8RdyzDF-uwGcwq9eMv1Giiu7RfMo7nYneG5kg6rd4.js?scope=header&delta=0&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
1519ceaa67bcd32243176aa59028ac713011d3fdb6e9ef4dffa70cce31ae8cf9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Fri, 26 Jul 2024 21:48:40 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
10-947467-0 0CNN RT(1722575411836 297) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1149969, public
Content-Length
752
Expires
Thu, 15 Aug 2024 12:36:21 GMT
sharethis.js
platform-api.sharethis.com/js/
206 KB
46 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.165.83.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-165-83-61.iad55.r.cloudfront.net
Software
/
Resource Hash
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:00:57 GMT
content-encoding
gzip
via
1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
IAD55-P3
age
555
etag
W/"336d0-g/6wprihOkYe7HpMswOVDodT6lU"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-cache
Hit from cloudfront
x-amz-cf-id
FKkkccjmpghs_aseN5EwNLqKMZLj5tPam1MshAL66hgK0aEDF7Zz0A==
gtm.js
www.googletagmanager.com/
452 KB
123 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6cb491c38ad0fdf859e49d3b3653b2bf4c99bdc68d6299583c6566da6e66fb77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
126126
x-xss-protection
0
last-modified
Fri, 02 Aug 2024 03:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 02 Aug 2024 05:10:12 GMT
conversion.js
www.googleadservices.com/pagead/
57 KB
21 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
49652ad86154be80557ff54bff8ffca4a611acbe4d70bbc174be39e8472de17f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21174
x-xss-protection
0
server
cafe
etag
61132669705791137
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 02 Aug 2024 05:10:12 GMT
js_e_2NS_DoN6WDSMG4U1VvhbrEAZsLpho_S_frxqkQgJM.js
www.proofpoint.com/sites/default/files/js/
150 KB
52 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_e_2NS_DoN6WDSMG4U1VvhbrEAZsLpho_S_frxqkQgJM.js?scope=footer&delta=0&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8638dcf82ad4b91ff673b4bde5bafa7c695a4836a3d4ab314bfc541962dd0bb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Thu, 25 Jul 2024 23:17:09 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 360) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1149969, public
Content-Length
52415
Expires
Thu, 15 Aug 2024 12:36:21 GMT
geoip2.js
geoip-js.com/js/apis/geoip2/v2.1/
3 KB
2 KB
Script
General
Full URL
https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b2b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 02 Aug 2024 04:24:00 GMT
server
cloudflare
age
1508
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
8acb8f65db3108f7-LAX
expires
Fri, 02 Aug 2024 09:10:12 GMT
js_DA7GHFg6Iz1O22c58zPl-nNTEwx5y7RuyKjesK1mXJI.js
www.proofpoint.com/sites/default/files/js/
5 KB
2 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_DA7GHFg6Iz1O22c58zPl-nNTEwx5y7RuyKjesK1mXJI.js?scope=footer&delta=2&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
64ac610477f4c2a19d7ade073fef3eccaa7db99efa5ff86733fb44c33c55226a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Fri, 26 Jul 2024 21:21:55 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 361) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1149969, public
Content-Length
1661
Expires
Thu, 15 Aug 2024 12:36:21 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.44.149 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-44-149.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
js_Q_hAq3KoriT4uxdUnA3XDouviRgbwswFyj5MCBnzVHU.js
www.proofpoint.com/sites/default/files/js/
48 KB
14 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Q_hAq3KoriT4uxdUnA3XDouviRgbwswFyj5MCBnzVHU.js?scope=footer&delta=4&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
480dfc4f346103ef7f50a60ef2462bc7ef967a06ee6ed20c6dcb50a6ef48d66e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Thu, 18 Jul 2024 23:38:39 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 606) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1149969, public
Content-Length
13427
Expires
Thu, 15 Aug 2024 12:36:21 GMT
app.js
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/js/
2 MB
527 KB
Script
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/js/app.js?q=GG49RroLtKw&v=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
446380f8e7c7baddebcb2fc82da913bd6087bd07ea6b28fc6e92a8208d6d18bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Fri, 02 Aug 2024 00:27:39 GMT
X-CDN
Imperva
Content-Type
application/javascript
X-Iinfo
10-947467-0 0CNN RT(1722575411836 373) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1192773, public
Content-Length
539025
Expires
Fri, 16 Aug 2024 00:29:45 GMT
js_2LYNA9Zu5KE51oXU7U2qX9zbS5cCqO7wzxelxAEWhjk.js
www.proofpoint.com/sites/default/files/js/
373 B
728 B
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_2LYNA9Zu5KE51oXU7U2qX9zbS5cCqO7wzxelxAEWhjk.js?scope=footer&delta=6&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8fd5dcb3427fad9f1304d5a1eafd0f9db5aafdf9eabe50bb1e5c2a16fc521efe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Thu, 18 Jul 2024 23:38:39 GMT
X-CDN
Imperva
Content-Type
text/javascript
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 377) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=973509, public
Content-Length
277
Expires
Tue, 13 Aug 2024 11:35:21 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/
199 KB
67 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63113904
last-modified
Fri, 19 Jul 2024 20:11:11 GMT
server
cloudflare
cf-cache-status
HIT
age
463
etag
"3e1640-31b30-61d9f4beb95c0"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
8acb8f668f5b96de-SJC
expires
Fri, 02 Aug 2024 09:10:12 GMT
j.php
dev.visualwebsiteoptimizer.com/
7 KB
3 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=767242&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&f=1&vn=1.3
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gla2 /
Resource Hash
79c5866be02e93324059c6cda1612ff9044daaf4f842c7a18c89c3ed755070a3

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:11 GMT
content-encoding
gzip
via
1.1 google
server
gla2
etag
W/"1722522848_EA"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0, no-cache, must-revalidate
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e2a193fa1b1801dcdddf024a250b04b496f5e36e4324a8de73948e6421ff5865
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 02 Aug 2024 05:03:27 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 02 Aug 2024 05:10:12 GMT
css2
fonts.googleapis.com/
28 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
afdd76f6919dc340e54a1045e6f4a8fc840a922c8efd1d07cc5bcdf448373a66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 02 Aug 2024 05:04:13 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 02 Aug 2024 05:10:12 GMT
v.gif
dev.visualwebsiteoptimizer.com/
35 B
144 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=767242&d=proofpoint.com&u=D583D41428EEA3EF03E06E7DB8C82F136&h=61a65b51f479b678dba13b04b41607db&t=false
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv03c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv03c
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=43200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
6543fd1a2398960013d900a7.js
buttons-config.sharethis.com/js/
745 B
1 KB
Script
General
Full URL
https://buttons-config.sharethis.com/js/6543fd1a2398960013d900a7.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:250b:e800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9c1b1066c42f920ce30aee11e0645fc48f66f13f828e31865b34abe54d6dd4e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
via
1.1 bd3f4df95f7c836cc4eb6a22d92ac2c2.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 17 Nov 2023 07:10:02 GMT
server
AmazonS3
x-amz-cf-pop
IAD12-P4
x-amz-server-side-encryption
AES256
etag
"923a352055e8a91048dec7ed5b809c72"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
745
x-amz-cf-id
_vZ9VDYG6NfJ9WA88rCQIAdcv8qZGrk0NihPE-BIhP4FohQiM5N2cA==
globe.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
808 B
795 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/globe.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
2b72026eaaae017cb9535ad20f82d00bc0ce390c76fbf5268e4708f9bf5e9bf8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"e4edf726"
Content-Type
image/svg+xml
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 646) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
327
Expires
Thu, 15 Aug 2024 07:15:36 GMT
search.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
514 B
767 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/search.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
3d827d05f0c1502d3b245e544611619ddb4d0eec78f55940594ae531e4f62cfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:08 GMT
X-CDN
Imperva
Etag
"9fc0adb6"
Content-Type
image/svg+xml
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 646) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
298
Expires
Thu, 15 Aug 2024 07:15:36 GMT
user.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
779 B
835 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/user.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
55bda2f21018d051f95b3aebea318bd719370a3a870245f92dd9c3e7d6348a59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:08 GMT
X-CDN
Imperva
Etag
"63f6cd8c"
Content-Type
image/svg+xml
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 892) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
366
Expires
Thu, 15 Aug 2024 07:15:36 GMT
logo-black.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
5 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/logo-black.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6450691706460a0ed12542c899ec8108a2856abefd157b9ef298661ebb5ab506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:08 GMT
X-CDN
Imperva
Etag
"617fefc4"
Content-Type
image/svg+xml
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 649) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1141835, public
Content-Length
1876
Expires
Thu, 15 Aug 2024 10:20:47 GMT
global-elements-arrow-blue.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
584 B
791 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/global-elements-arrow-blue.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bd5584dd3ce86c6fc33cf17cc82ee828026eaa7c7b7ac0699db83efade55f06b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"529df945"
Content-Type
image/svg+xml
X-Iinfo
18-11738158-0 0CNN RT(1722575411835 651) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
322
Expires
Thu, 15 Aug 2024 07:15:36 GMT
x.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
364 B
695 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/x.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
751b1a09760d9c50041b5f070968f1ae898dfb4f6f89b86d0bfa6526d0dc89ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:08 GMT
X-CDN
Imperva
Etag
"e9257f17"
Content-Type
image/svg+xml
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 721) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130724, public
Content-Length
227
Expires
Thu, 15 Aug 2024 07:15:36 GMT
block-subscribe-button-addthis.webp
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
2 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/block-subscribe-button-addthis.webp
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5f3083b731588016304b0ac105b66985b8ffc9d2c7a2e627f0435da5e86a4648
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 18 Jul 2024 23:31:59 GMT
X-CDN
Imperva
Etag
"81ec458f"
Content-Type
image/webp
X-Iinfo
10-947467-0 0CNN RT(1722575411836 667) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1160569, public
Content-Length
1656
Expires
Thu, 15 Aug 2024 15:33:01 GMT
pfpt-us-connect-dots.jpg.webp
www.proofpoint.com/sites/default/files/styles/image_1920_750/public/misc/
92 KB
92 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/styles/image_1920_750/public/misc/pfpt-us-connect-dots.jpg.webp?itok=tHMBplrM
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e8362a6b3607b4974b228b7148f5e7163bb351fd4acc9a54b5a8bd35ec3f45ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 25 Jul 2024 19:03:44 GMT
X-CDN
Imperva
Content-Type
image/webp
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 721) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1173256, public
Content-Length
93944
Expires
Thu, 15 Aug 2024 19:04:28 GMT
Screenshot%202024-07-25%20at%2011.56.08%E2%80%AFAM_0.png
www.proofpoint.com/sites/default/files/inline-images/
80 KB
80 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screenshot%202024-07-25%20at%2011.56.08%E2%80%AFAM_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d2ff1d7d7ca94f39ff764e0650c5d3ca48404df97284f1940b7c24797da5730e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 25 Jul 2024 19:17:24 GMT
X-CDN
Imperva
Etag
"d4b56d57"
Content-Type
image/png
X-Iinfo
18-11738134-0 0CNN RT(1722575411591 967) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=996136, public
Content-Length
81933
Expires
Tue, 13 Aug 2024 17:52:28 GMT
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=h...
  • https://l.sharethis.com/sc?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=http...
176 B
700 B
XHR
General
Full URL
https://l.sharethis.com/sc?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&cms=unknown&publisher=6543fd1a2398960013d900a7&sop=true&version=st_sop.js&lang=en&description=Key%20findings%C2%A0%20Proofpoint%20has%20observed%20an%20increase%20in%20malware%20delivery%20via%20TryCloudflare%20Tunnel%20abuse.%C2%A0%20The%20activity%20is%20financially%20motivated%20and%20delivers%20exclusively%20remote%20access%20trojans%20(RATs).%C2%A0%C2%A0...&ua=&ua_mobile=false&ua_full_version_list=&uuid=0194e41a-33db-4a68-9899-c4a07d1e52c4&samesite=None
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
HTTP/1.1
Server
3.17.237.129 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-17-237-129.us-east-2.compute.amazonaws.com
Software
/
Resource Hash
8277ddf1278fc0cfc43a6d5cc9ed62f66e7ce2b9790390343d7c62745f4503fe
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:13 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.proofpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAAC2asajUAAAAIPQSVAw==
Access-Control-Allow-Headers
*
Content-Length
176
X-Robots-Tag
noindex, nofollow

Redirect headers

Date
Fri, 02 Aug 2024 05:10:13 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Max-Age
1728000
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
https://www.proofpoint.com
Location
/sc?event=pview&hostname=www.proofpoint.com&location=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&product=inline-share-buttons&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&source=platform&fcmp=false&fcmpv2=false&has_segmentio=false&title=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&cms=unknown&publisher=6543fd1a2398960013d900a7&sop=true&version=st_sop.js&lang=en&description=Key%20findings%C2%A0%20Proofpoint%20has%20observed%20an%20increase%20in%20malware%20delivery%20via%20TryCloudflare%20Tunnel%20abuse.%C2%A0%20The%20activity%20is%20financially%20motivated%20and%20delivers%20exclusively%20remote%20access%20trojans%20(RATs).%C2%A0%C2%A0...&ua=&ua_mobile=false&ua_full_version_list=&uuid=0194e41a-33db-4a68-9899-c4a07d1e52c4&samesite=None
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAAC2asajUAAAAIPQSVAw==
Access-Control-Allow-Headers
*
Content-Length
1022
X-Robots-Tag
noindex, nofollow
content-pager-arrow.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
618 B
799 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/content-pager-arrow.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
ece2d0c67a92dd2e9092416cd1c60151504e8f7eed717af3b152420c3684a3f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"4a312a01"
Content-Type
image/svg+xml
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 725) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1160569, public
Content-Length
330
Expires
Thu, 15 Aug 2024 15:33:01 GMT
marketo-form-spinner.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
3 KB
877 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/marketo-form-spinner.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5680e67bec883a7cc47635705afdaa0d28ad681a1bec515983784fe6c002356b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:08 GMT
X-CDN
Imperva
Etag
"d85f1d02"
Content-Type
image/svg+xml
X-Iinfo
18-11738158-0 0CNN RT(1722575411835 726) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1156709, public
Content-Length
408
Expires
Thu, 15 Aug 2024 14:28:41 GMT
footer-logo-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
5 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/footer-logo-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4ae79f6079013e0b6e62b871e558a573823eed1be52852634e13d3bee5663380
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"c5d52ce3"
Content-Type
image/svg+xml
X-Iinfo
10-947467-0 0CNN RT(1722575411836 743) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
1851
Expires
Thu, 15 Aug 2024 07:15:37 GMT
icon-facebook-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
416 B
746 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-facebook-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
a7de65ae8dbd3767d98f475502d97732a81ceecbc6f1b2f52f03e457207753d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"4e9616dc"
Content-Type
image/svg+xml
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 829) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
278
Expires
Thu, 15 Aug 2024 07:15:37 GMT
icon-x-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
425 B
762 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-x-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d790432627c2bcb0358551fe8035b2a90757cd31a6eccf189f2f0c809e89ad80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"42cf034a"
Content-Type
image/svg+xml
X-Iinfo
18-11738160-0 0CNN RT(1722575411835 801) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
293
Expires
Thu, 15 Aug 2024 07:15:37 GMT
icon-linkedin-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
930 B
864 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-linkedin-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
aa44e3c804607a8a17c2e9597537350b4e425c1708a1c7c6fc50a28dba1fd488
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"741a7867"
Content-Type
image/svg+xml
X-Iinfo
18-11738158-0 0CNN RT(1722575411835 802) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
395
Expires
Thu, 15 Aug 2024 07:15:37 GMT
icon-youtube-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
997 B
905 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-youtube-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6312cd49d1d0b91d2aa283cba2ad0365fc697b3e7fc5b34f6e749ba646b4ec31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"c7cf9483"
Content-Type
image/svg+xml
X-Iinfo
18-11738159-0 0CNN RT(1722575411835 814) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
436
Expires
Thu, 15 Aug 2024 07:15:37 GMT
icon-instagram-white.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
4 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/icon-instagram-white.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e4a844b79de8171a014dbfae6e5d1a16c4b32fff608dd28767bcaf88fefef93b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_87KZm0WRP3hPZim2FkJUdeG6hVjzQtQpGAB9gbhkfe8.css?delta=1&language=en&theme=particle&include=eJxdj8FuxDAIRH8ollX10r9ZgZfaVmywAK_Uv2-yFyd7QWIYzWPGeNSvH44NOE_IFJ7klFx0G-PRQXdyiX1yKnvlUzMCTSVOr83O3Qt1ii7SEHSzP3PqEcFoG6BeU6OYROliBWRArJyX41fEScPr-00ooBTf00u15cIm-ZrKTuxhHF_rzZT2YBMtaUUKON2F170QPG9s1ENJOjt-oFbI0i-5J-ceezRgeC0tN0FogdpRm93-AXhEi_s
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Thu, 25 Jul 2024 23:14:35 GMT
X-CDN
Imperva
Etag
"9df206ee"
Content-Type
image/svg+xml
X-Iinfo
10-947467-0 0CNN RT(1722575411836 820) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130725, public
Content-Length
1481
Expires
Thu, 15 Aug 2024 07:15:37 GMT
collect
analytics.google.com/g/
0
0
Fetch
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=45je47v0v890103917za200&_p=1722575411889&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250753&cid=2112287892.1722575413&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722575412&sct=1&seg=0&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&dt=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1155
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:12 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
256 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-B1V8SZE3GL&cid=2112287892.1722575413&gtm=45je47v0v890103917za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0&tag_exp=95250753
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1d::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 02 Aug 2024 03:24:11 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
6362
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 02 Aug 2024 05:24:11 GMT
destination
www.googletagmanager.com/gtag/
239 KB
84 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-950296937&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
80a26b40739bae7383ff5c4cc9de60a175044b55c7fbabf50ee4c7432cb3876a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86459
x-xss-protection
0
last-modified
Fri, 02 Aug 2024 03:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 02 Aug 2024 05:10:12 GMT
bat.js
bat.bing.com/
49 KB
14 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Fri, 02 Aug 2024 05:10:12 GMT
last-modified
Sat, 13 Jul 2024 20:42:16 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: BF75629331064587932B7FBD38A6AF9E Ref B: LAX311000108019 Ref C: 2024-08-02T05:10:13Z
etag
"044982565d5da1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
14183
insight.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:1408:c400:5::17c7:3719 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2024 05:33:09 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=23817
accept-ranges
bytes
content-length
14597
1594.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08913ba5cd15371345171107c16e008a85a792c8af6e8955259a05634f83fe6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
content-disposition
inline
x-xss-protection
0
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
origin-agent-cluster
?1
cf-ray
8acb8f6ba9882b6e-LAX
1644.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31ddb1ebfd6982bf2f8acb1ecac45083589aecca3ad757429edca40aea63df14
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
content-disposition
inline
x-xss-protection
0
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
origin-agent-cluster
?1
cf-ray
8acb8f6ba9862b6e-LAX
1645.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
2 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4d9a4c28a0d773774c936994ea6ec2ed3c3defba7c4f9d3d6adf4d9e6153e48
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
content-disposition
inline
x-xss-protection
0
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
origin-agent-cluster
?1
cf-ray
8acb8f6b997e2b6e-LAX
1646.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da344fbc0c0027b594a0eaa7d71fd4dc5124b5087e3e992eafefb1c42b151875
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
content-disposition
inline
x-xss-protection
0
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
origin-agent-cluster
?1
cf-ray
8acb8f6b99802b6e-LAX
1647.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6a5688acee0fb12dd3b53423dfecfeba26575a5a3681eb30de3f434c52e51f8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
x-permitted-cross-domain-policies
none
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
content-disposition
inline
x-xss-protection
0
referrer-policy
no-referrer
server
cloudflare
cross-origin-opener-policy
same-origin
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
origin-agent-cluster
?1
cf-ray
8acb8f6ba9842b6e-LAX
5dfsgn7m2kst.js
js.driftt.com/include/1722575700000/
221 KB
62 KB
Script
General
Full URL
https://js.driftt.com/include/1722575700000/5dfsgn7m2kst.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.208.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-208-17.iad66.r.cloudfront.net
Software
istio-envoy /
Resource Hash
889da033525190aa887d2361d6cb460c50e9b128e017c33f4499063aeaa73632
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
x-amz-version-id
y3tne.Y80za7KusdtSa.ECjRnvsUlRYa
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 ee2aae92a0963bbb2d1a2d667fe2ad2c.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD66-C1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
x-envoy-upstream-service-time
27
last-modified
Wed, 24 Jul 2024 21:19:18 GMT
server
istio-envoy
etag
W/"a69573aefab19654390c860151e62853"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
OIjy7azebizgRdXKHsNxJjgO_-HipwCnql0ciIoWpgHd5tyLsXuRyQ==
fbevents.js
connect.facebook.net/en_US/
224 KB
60 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy
default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 02 Aug 2024 05:10:13 GMT
document-policy
force-load-at-top
x-fb-server-load
30
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
58677
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
GOOD; q=0.7, rtt=120, rtx=0, c=12, mss=1297, tbw=2800, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma
public
x-fb-debug
r3TJxYBQFxBjZVJJs2UAjl9vrDZIy9EqUlZZUvKQLz3hKrc0odhv87o0CGSk97jlhWvL+aQiL8ZtOFX9zUGcKw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security
max-age=0; includeSubDomains; preload
age
10303
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1200
cf-ray
8acb8f6d4f33cb83-LAX
expires
Fri, 02 Aug 2024 05:30:13 GMT
events.js
tags.srv.stackadapt.com/
22 KB
7 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.35.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-35-213.compute-1.amazonaws.com
Software
/
Resource Hash
bea5360119eaab571e35e9ec9e3952403d70953c298c9c5fde7700d9fc0773f9

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Aug 2024 05:10:13 GMT
cache-control
max-age=5
content-encoding
gzip
content-type
text/javascript
report-csp-violation
www.proofpoint.com/
0
7 KB
Other
General
Full URL
https://www.proofpoint.com/report-csp-violation
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
application/csp-report

Response headers

Expires
Sat, 03 Aug 2024 05:10:13 GMT
Date
Fri, 02 Aug 2024 05:10:13 GMT
Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Via
varnish
X-Permitted-Cross-Domain-Policies
none
X-CDN
Imperva
Age
0
X-Cache
MISS
X-Iinfo
16-9603993-9604133 NNNY CT(21 21 0) RT(1722575411835 1256) q(0 0 0 -1) r(2 2) U6
Connection
keep-alive
X-AH-Environment
prod
Content-Length
0
X-Request-ID
v-7f904db0-508d-11ef-982d-fb3fdfaf1976
Referrer-Policy
origin-when-cross-origin
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-language
en
Content-Type
text/html; charset=UTF-8
Cache-Control
must-revalidate, no-cache, private
Feature-Policy
geolocation 'self'
Accept-Ranges
bytes
X-WebKit-CSP
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
X-Content-Security-Policy
default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
81ad4853-7699-4145-be50-4c0e963c8034.js
j.6sc.co/j/
0
0

/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=6233023589567718437
4 B
280 B
Image
General
Full URL
https://attr.ml-api.io/?domain=proofpoint.com&pId=6233023589567718437
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Server
2600:9000:250a:d000:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:14 GMT
via
1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD12-P3
x-cache
Miss from cloudfront
content-type
application/json
alt-svc
h3=":443"; ma=86400
content-length
4
apigw-requestid
b3WIlg9RoAMEPPw=
x-amz-cf-id
etcCnCLvKdRlqGIvIHhGm4FmX4SnilOIcLqE86N-bie9rI4VtcYS8Q==

Redirect headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:14 GMT
an-x-request-uuid
e955e40a-5f3e-4391-b76f-f825f196fba8
server
nginx/1.23.4
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=proofpoint.com&pId=6233023589567718437
x-proxy-origin
162.245.206.244; 162.245.206.244; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.44.149 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-44-149.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:13 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sun, 10 Nov 2024 05:10:13 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1722575413010&cv=9&fst=1722575413010&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&tiba=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.157 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f157.1e100.net
Software
cafe /
Resource Hash
3403420fd866a2ee4b53b50d0c57b63d88c80afb4ee28dbe8bae2a27f8929609
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1434
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
assign
tracking.g2crowd.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarygDCgumWn7jS4FPgo

Response headers

assign
tracking.g2crowd.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarysEbJhygQJbrrL56G

Response headers

assign
tracking.g2crowd.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryQJzXrhq2ualDnLBo

Response headers

assign
tracking.g2crowd.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryYnAtgcmiRxTnIYLR

Response headers

me
geoip-js.com/geoip/v2.1/country/
783 B
983 B
XHR
General
Full URL
https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Requested by
Host: geoip-js.com
URL: https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:b2b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1330c72ad950e7a9c7e6c3149323bbec7f9194150be1520756860f6d507bc9ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
8acb8f6d58030caf-LAX
content-length
783
getForm
app-abj.marketo.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getForm?munchkinId=309-RHV-619&form=19277&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&callback=jQuery37107173616069851463_1722575413160&_=1722575413161
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96d8da75e43ad51e68186287bcf102176826e00d48c079941e5b42abdba7bc19

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
gzip
server
cloudflare
cf-ray
8acb8f6c9b3a96de-SJC
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
facebook.svg
platform-cdn.sharethis.com/img/
301 B
742 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26c1:b600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 07 Jul 2024 07:05:08 GMT
via
1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
IAD61-P1
age
2239506
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
301
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"c6e9be45643e197ce1db1d7e24a99adc"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
Zq8-b_HMWdEtJi1cUnB0xiJVPn2am6Q8AFj7S3SL1Ln2lhaBGqMaeQ==
twitter.svg
platform-cdn.sharethis.com/img/
368 B
780 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26c1:b600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:08:04 GMT
via
1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Fri, 15 Sep 2023 16:58:49 GMT
server
AmazonS3
x-amz-cf-pop
IAD61-P1
age
134
x-amz-server-side-encryption
AES256
etag
"2deb3d5121d475d195577a70b0a91a0c"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
368
x-amz-cf-id
FS7ktHPMUqO1TrNPR6UbWWDqn6X0JgSOH7941Ty4FCQ1ClWFfJYuBw==
linkedin.svg
platform-cdn.sharethis.com/img/
456 B
901 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26c1:b600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:07:57 GMT
via
1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
IAD61-P1
age
1634537
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
456
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"fa43b4ede18498b114fc7185993f6da7"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
b5Q1YMvps8ewD909GyiadY_o5z-ekX8l1zkRuSWKaU-p9lzmKmJNCg==
email.svg
platform-cdn.sharethis.com/img/
343 B
788 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26c1:b600:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sun, 14 Jul 2024 07:08:07 GMT
via
1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
IAD61-P1
age
1634527
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
343
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"5977437466e857c7ddcadda6f6d88c2a"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=2592000
accept-ranges
bytes
x-amz-cf-id
qZVtXxt7iZEN9UDk_kVkJmHfvPgQJmV1kWl3L4WEQSpmIWhABVvHzA==
activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698
4788165.fls.doubleclick.net/ Frame 92A0
Redirect Chain
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698?
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698?
0
0
Document
General
Full URL
https://4788165.fls.doubleclick.net/activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bj-in-f148.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
2057
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 02 Aug 2024 05:10:13 GMT
expires
Fri, 02 Aug 2024 05:10:13 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 02 Aug 2024 05:10:13 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://4788165.fls.doubleclick.net/activityi;dc_pre=CKrsgL3F1YcDFXASdgYd4kUP3Q;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=6455261137189.698?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
187130029.js
bat.bing.com/p/action/
4 KB
2 KB
Script
General
Full URL
https://bat.bing.com/p/action/187130029.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
56176a50de3d60c3b2eb019e64ce06771c2e5cacbbaa528caa2d5b040747622a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
date
Fri, 02 Aug 2024 05:10:12 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: A75FB10491BA4CD8B4B6126F1A592519 Ref B: LAX311000108019 Ref C: 2024-08-02T05:10:13Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
cache-control
private,max-age=60
assign
tracking.g2crowd.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryTw9uIsMPSGZGvUBR

Response headers

/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1722575413255&cv=11&fst=1722575413255&bg=ffffff&guid=ON&async=1&gtm=45be47v0v885828997z876619393za201zb76619393&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&npa=0&pscdl=noapi&auid=1676228874.1722575413&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-950296937&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.16.157 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f157.1e100.net
Software
cafe /
Resource Hash
f9484e55fa69641bda505c9f9916c928544b15a2c7425234ff138d2931f39911
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1440
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
309-rhv-619.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://309-rhv-619.mktoresp.com/webevents/visitWebPage?_mchNc=1722575413271&_mchCn=&_mchId=309-RHV-619&_mchTk=_mch-proofpoint.com-1722575413270-98259&_mchHo=www.proofpoint.com&_mchPo=&_mchRu=%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:13 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
9cab5ca2-8353-45f7-b346-5aaeecb323a8
t.dhj
t.sharethis.com/1/k/
2 KB
2 KB
Script
General
Full URL
https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=B&dmn=www.proofpoint.com&rnd=1722575413281
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.207.9 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-73-207-9.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2b43985f685b3a6d06db8f8bb999847c8363d2992e0840cfe0eae3a4a79e6469
Security Headers
Name Value
Strict-Transport-Security max-age=2628000 ; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:13 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=2628000 ; includeSubDomains
Content-Type
application/javascript
Cache-Control
private, max-age=3600
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
1385
Expires
Fri, 02 Aug 2024 06:10:13 GMT
panorama.js
platform-api.sharethis.com/
39 KB
12 KB
Script
General
Full URL
https://platform-api.sharethis.com/panorama.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.165.83.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-165-83-61.iad55.r.cloudfront.net
Software
/
Resource Hash
a782015ceceb595c8305a944456587c4f2c4b3f0ca82aac8e5c6d7b33138f392
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 04:25:42 GMT
content-encoding
gzip
via
1.1 d4564d6809e10e731bfdfae814a717f8.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Tue, 19 Mar 2024 22:24:27 GMT
x-amz-cf-pop
IAD55-P3
age
2671
etag
W/"9a71-18e58d0dd78"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
x-cache
Hit from cloudfront
cache-control
public, max-age=3600
accept-ranges
bytes
x-amz-cf-id
ItquaQWfMZZn6oymt_h6UQqHMZ6fpzOC2bSfJXSZU9gMcEg8uS8C1w==
forms2.css
app-abj.marketo.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63113904
cf-cache-status
HIT
age
2042
content-length
2623
last-modified
Fri, 19 Jul 2024 20:11:11 GMT
server
cloudflare
etag
"2e50b6-3437-61d9f4beb95c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
8acb8f6d4b9996de-SJC
expires
Fri, 02 Aug 2024 09:10:13 GMT
forms2-theme-plain.css
app-abj.marketo.com/js/forms2/css/
828 B
398 B
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2042
content-length
246
last-modified
Fri, 19 Jul 2024 20:11:11 GMT
server
cloudflare
etag
"2e50b4-33c-61d9f4beb95c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
8acb8f6d4b9a96de-SJC
expires
Fri, 02 Aug 2024 09:10:13 GMT
getKnownLead
app-abj.marketo.com/index.php/form/
48 B
257 B
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getKnownLead?form=19277&lpId=&munchkinId=309-RHV-619&filledFields=true&_mkt_trk=id%3A309-RHV-619%26token%3A_mch-proofpoint.com-1722575413270-98259&callback=jQuery37107173616069851463_1722575413160&_=1722575413162
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f355e3a4d50868a329ee1c1f3f67ba9a69be91088c75e361194f3eee8c7e756
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
strict-transport-security
max-age=63113904
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
server
cloudflare
content-type
application/javascript; charset=utf-8
cf-ray
8acb8f6d4b9c96de-SJC
187130029
www.clarity.ms/tag/uet/
816 B
1 KB
Script
General
Full URL
https://www.clarity.ms/tag/uet/187130029
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/187130029.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3c2ccc286ad453a58ef10a1645225144b3512fe11c991fcb97bf3ffed6f851c

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
date
Fri, 02 Aug 2024 05:10:13 GMT
x-azure-ref
20240802T051013Z-15db5b49bf6q2klmd9dntkw8dn0000000bd000000000n76k
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
816
expires
-1
0
bat.bing.com/action/
0
361 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=187130029&tm=gtm002&Ver=2&mid=6eec0d63-4fad-43cd-b949-65890ad5045b&sid=7f9b0470508d11ef817dcda4fb373534&vid=7f9b28c0508d11efb6d549c1de68d02e&vids=1&msclkid=N&gtm_tag_source=1&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&r=&lt=1689&evt=pageLoad&sv=1&cdb=AQAQ&rn=373378
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 02 Aug 2024 05:10:12 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 79ECE599BE9449C2BCC484F5A2E34571 Ref B: LAX311000108019 Ref C: 2024-08-02T05:10:13Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
gif.gif
ibc-flow.techtarget.com/a/
43 B
442 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1268939&r=1722575413408&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&version=2.4
Requested by
Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier
1268939
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
via
1.1 google
x-guploader-uploadid
AHxI1nN-pU2OON5nLbl7OuPDmpDcUKA9Nwnq2fJNTjjjlj4q4F4VLV7TAQbMX4PgHfFD8aq6Lzo
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
server
nginx/1.20.2
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
vary
Origin
x-goog-generation
1670534369365034
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control
public, max-age=3600
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-length
43
accept-ranges
bytes
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires
Fri, 02 Aug 2024 06:10:13 GMT
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1268939&r=1722575413408&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Fri, 02 Aug 2024 05:10:13 GMT
expires
Fri, 02 Aug 2024 05:10:13 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
AHxI1nNzxT0UKEhtRLzbivxH3JDE5pPI-UO41_5FMXVihhgfqZgjmQ5MO1Lh_Y5WdxLgJVtFeNqmMAM1tw
attribution_trigger
px.ads.linkedin.com/
2 B
759 B
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept
*
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
gzip
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 307856349BCE4887BFAD2A16E033E5EA Ref B: LAXEDGE2022 Ref C: 2024-08-02T05:10:13Z
access-control-allow-methods
GET, OPTIONS
x-li-fabric
prod-lva1
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
content-type
application/json
x-li-proto
http/2
x-restli-protocol-version
1.0.0
access-control-allow-headers
*
x-li-uuid
AAYerFeghCiLTZ1i/zB1ZA==
x-fs-uuid
00061eac57a084288b4d9d62ff307564
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-t...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-t...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%252C3976212%26time%3D1722575413413%26url%3Dhttps%253A%252F%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-t...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-...
0
489 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&cookiesTest=true&liSync=true&e_ipv6=AQL4GVPXgPAy8gAAAZERfuMPL9EzNgZFra0XJiJJC39iGLdm-_YxGDk3AwivBfd67lapew
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Server
2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: FCD9364E2FB24C678FF4D9AE9D906EE1 Ref B: LAX311000109035 Ref C: 2024-08-02T05:10:14Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYerFerxmjHILs7sbBPLw==

Redirect headers

date
Fri, 02 Aug 2024 05:10:13 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 55CA07B37C2140E596929AF191886C06 Ref B: LAX311000110047 Ref C: 2024-08-02T05:10:13Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1722575413413&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&cookiesTest=true&liSync=true&e_ipv6=AQL4GVPXgPAy8gAAAZERfuMPL9EzNgZFra0XJiJJC39iGLdm-_YxGDk3AwivBfd67lapew
x-li-proto
http/2
content-length
0
x-li-uuid
AAYerFem16ExYTfuxuT1eA==
/
px.ads.linkedin.com/wa/
0
485 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: C4EC68A7883547B8B1C473C464C5C672 Ref B: LAX311000110047 Ref C: 2024-08-02T05:10:13Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
access-control-allow-origin
https://www.proofpoint.com
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYerFeggwZA3iby97eZ9w==
collect
www.google-analytics.com/j/
3 B
210 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1913271713&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&ul=en-us&de=UTF-8&dt=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAEK~&jid=941676686&gjid=926487546&cid=2112287892.1722575413&tid=UA-2257074-1&_gid=160953874.1722575413&_r=1&_slc=1&gtm=45He47v0n81MGR7P8Xv76619393za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&cd19=2112287892.1722575413&z=1277619718
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
map
bcp.crwdcntrl.net/6/
156 B
535 B
XHR
General
Full URL
https://bcp.crwdcntrl.net/6/map
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/panorama.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.23.203.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-23-203-136.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
9468b3c6d60ddfdc2092e07b23137f1a002a7f78c30cce756ac280fddc7516d3

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
server
Jetty(9.4.38.v20210224)
content-type
application/json;charset=utf-8
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache
x-server
10.40.52.14
access-control-allow-credentials
true
content-length
156
expires
0
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.35.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-35-213.compute-1.amazonaws.com
Software
/
Resource Hash
7b8112efa2e817f2534339b1a48bf487e65a54d6e3c17ac91c61b7bfb396dc5d

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Aug 2024 05:10:13 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.35.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-35-213.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 02 Aug 2024 05:10:13 GMT
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
content-type
image/jpeg
/
www.google.com/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1722575413010&cv=9&fst=1722574800000&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=-600&u_java=false&u_nplug=5&u_nmime=2&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&tiba=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&uaa=&uab=&uam=&uap=&uapv=&uaw=0&uafvl=&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDaQooLTOpcC4zP8SL8LGGFb3-Y3ER6a1_OlQ&random=4276872351&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f105.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1722575413255&cv=11&fst=1722574800000&bg=ffffff&guid=ON&async=1&gtm=45be47v0v885828997z876619393za201zb76619393&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&hn=www.googleadservices.com&frm=0&tiba=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&npa=0&pscdl=noapi&auid=1676228874.1722575413&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDaQooLGD0I5AOnYoqddhHx6IqpjYgY0LzLYQ&random=3841038390&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f105.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:13 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
143852102935619
connect.facebook.net/signals/config/
69 KB
14 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/143852102935619?v=2.9.162&r=stable&domain=www.proofpoint.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a7d2d6455a4b73acd2020310ee328d8b47447be303d47fa573b8e4d724787b55
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy
default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 02 Aug 2024 05:10:13 GMT
document-policy
force-load-at-top
x-fb-server-load
25
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
GOOD; q=0.7, rtt=126, rtx=0, c=66, mss=1297, tbw=64222, tp=-1, tpl=-1, uplat=188, ullat=0
pragma
public
x-fb-debug
i97Og3hmlu7vU8heulQBqgQ4vL5TLKWUnUiMC/fqnONg5Q5k7A/yUZzXxg9OErDrGkIeHqLbkOiWuan74AOkeg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/
582 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a6a60dd10bf839e3cfb6082e2911b15f2870027d4ab2a7509e48056440f13e2

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
584 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3666e420f1e9ea50d544484f433bb0613fe24e0891935549f12ab937e379440

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
XDFrame
app-abj.marketo.com/index.php/form/ Frame CF8C
0
0
Document
General
Full URL
https://app-abj.marketo.com/index.php/form/XDFrame
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.92.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
8acb8f71390667fe-SJC
content-encoding
gzip
content-length
650
content-type
text/html; charset=utf-8
date
Fri, 02 Aug 2024 05:10:14 GMT
server
cloudflare
strict-transport-security
max-age=63113904
vary
Accept-Encoding
x-content-type-options
nosniff
041a2319-35c7-47e8-926a-ea9c18e7683c
https://www.proofpoint.com/
43 B
0
Image
General
Full URL
blob:https://www.proofpoint.com/041a2319-35c7-47e8-926a-ea9c18e7683c
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length
43
Content-Type
image/gif
saq_pxl
tags.srv.stackadapt.com/
185 B
381 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=dG-GbvdPxi8YOQyjVLjRlg&is_js=true&landing_url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&t=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&tip=8hO8m7pmKEnMkzJ9qh5zT9KP2QRoebj1fvi7SkQeB4I&host=https%3A%2F%2Fwww.proofpoint.com&sa_conv_data_css_value=%270-1dd84340-a531-5dcb-747b-2ecda36f7582%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd91dd84340a5315dcb747b2ecda36f7582a2f5cef4&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgtdSxtQYwAToEFPvsiUIEYtEzSA.mETEn%252FJd5r9p20PdLHhVj8YalSk4B2hO%252B%252BHyaBolkK8&sa-user-id-v2=s%253AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%252BkYvU00tEs&sa-user-id=s%253A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%252Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%252F2Sgg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.35.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-35-213.compute-1.amazonaws.com
Software
/
Resource Hash
00a028b6540a3f5309fccc8c5c6d5d5e1da884807e21931d907f29f7247ea734

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Fri, 02 Aug 2024 05:10:13 GMT
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
185
access-control-allow-methods
GET
content-type
text/plain; charset=utf-8
clarity.js
www.clarity.ms/s/0.7.41/
62 KB
26 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.41/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/187130029
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
63bb2e926bb71d9af20024a237718b3cbd8bcb03af6fe3510132024571005f69

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:13 GMT
content-encoding
br
last-modified
Fri, 26 Jul 2024 23:49:00 GMT
etag
W/"0x8DCADCD85F8E42A"
vary
Accept-Encoding
x-azure-ref
20240802T051013Z-15db5b49bf6q2klmd9dntkw8dn0000000bd000000000n773
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
x-ms-request-id
2015e98c-401e-0078-762c-e08d23000000
cache-control
public, max-age=86400
x-cache
TCP_HIT
x-ms-version
2018-03-28
x-fd-int-roxy-purgeid
51562430
t_.htm
t.sharethis.com/a/ Frame C95F
0
0
Document
General
Full URL
https://t.sharethis.com/a/t_.htm?ver=1.1497.23399&cid=c010&cls=B
Requested by
Host: t.sharethis.com
URL: https://t.sharethis.com/1/k/t.dhj?cid=c010&cls=B&dmn=www.proofpoint.com&rnd=1722575413281
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.207.9 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-73-207-9.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=2628000 ; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control
max-age=604800
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1174
Content-Type
text/html
Date
Fri, 02 Aug 2024 05:10:14 GMT
Expires
Fri, 09 Aug 2024 05:10:14 GMT
Strict-Transport-Security
max-age=2628000 ; includeSubDomains
X-Robots-Tag
noindex, nofollow
/
www.facebook.com/tr/
0
270 B
Image
General
Full URL
https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&rl=&if=false&ts=1722575414066&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1722575414064.98818117172438297&cs_est=true&ler=empty&cdl=API_unavailable&it=1722575413730&coo=false&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality
GOOD; q=0.7, rtt=118, rtx=0, c=10, mss=1297, tbw=2781, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 02 Aug 2024 05:10:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/privacy_sandbox/pixel/register/trigger/
67 B
4 KB
Image
General
Full URL
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&rl=&if=false&ts=1722575414066&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4126&fbp=fb.1.1722575414064.98818117172438297&cs_est=true&ler=empty&cdl=API_unavailable&it=1722575413730&coo=false&rqm=FGET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger
{"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x75f6ec2466c4d3dd","source_keys":["1","2"]},{"key_piece":"0x081f3d22ae928103","source_keys":["1","2"]}],"aggregatable_values":{"1":1},"filters":{"2":["24:6037276976347112","24:4267499059953199","7830:6037276976347112","7830:4267499059953199","10853:6037276976347112","10853:4267499059953199","41:6037276976347112","41:4267499059953199","8046:6037276976347112","8046:4267499059953199"]},"debug_reporting":true,"debug_key":"1"}
content-encoding
zstd
x-content-type-options
nosniff
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security
max-age=15552000; preload
document-policy
force-load-at-top
date
Fri, 02 Aug 2024 05:10:14 GMT
x-fb-server-load
25
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7398405068104379810", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
GOOD; q=0.7, rtt=118, rtx=0, c=10, mss=1297, tbw=3095, tp=-1, tpl=-1, uplat=87, ullat=0
pragma
no-cache
x-fb-debug
xOyx+4mIP3ZgZS/2cFVY85uCpCcMXOziOHNwaXSmRv/7GlK6lTH5CFUw7WfptL89vjVN78B+9yH6iojtNZzVNQ==
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7398405068104379810"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
image/png
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
private, no-store, no-cache, must-revalidate
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
h.clarity.ms/
0
282 B
XHR
General
Full URL
https://h.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.41/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.64.151 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.proofpoint.com
Date
Fri, 02 Aug 2024 05:10:14 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
core
js.driftt.com/ Frame 5F6D
0
0
Document
General
Full URL
https://js.driftt.com/core?d=1&embedId=5dfsgn7m2kst&eId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=86f9959d-0c9b-43c1-9f90-3762bbb275fc&sessionStarted=1722575414.793&campaignRefreshToken=836ebe01-6aa9-4758-8293-b22c5d5482d7&hideController=false&pageLoadStartTime=1722575411927&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1722575700000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.208.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-208-104.iad66.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 02 Aug 2024 05:10:15 GMT
etag
W/"9274c0ff52d0ea301eff17185711c576"
last-modified
Wed, 24 Jul 2024 21:19:01 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 9e18259ccc98f7a9dcd0fe17b60688c2.cloudfront.net (CloudFront)
x-amz-cf-id
NadBkLJ0K-qTESGvqORSpWm4DYF5sgfrX0GpgDVLqnrNRxIFrDRjXw==
x-amz-cf-pop
IAD66-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
e.x5p6Pj3I94qvY0w0S0kqCQS7PUrPBy
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
22
chat
js.driftt.com/core/ Frame F3FD
0
0
Document
General
Full URL
https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1722575411927
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1722575700000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.208.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-208-104.iad66.r.cloudfront.net
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 02 Aug 2024 05:10:15 GMT
etag
W/"9274c0ff52d0ea301eff17185711c576"
last-modified
Wed, 24 Jul 2024 21:19:01 GMT
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 9e18259ccc98f7a9dcd0fe17b60688c2.cloudfront.net (CloudFront)
x-amz-cf-id
yHYv0muRZJzrpLyLdDr9TJb7KkF17du688r43N4ZbvU8isQ4PJAXWw==
x-amz-cf-pop
IAD66-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
e.x5p6Pj3I94qvY0w0S0kqCQS7PUrPBy
x-cache
RefreshHit from cloudfront
x-envoy-upstream-service-time
29
zi-tag.js
js.zi-scripts.com/
9 KB
3 KB
Script
General
Full URL
https://js.zi-scripts.com/zi-tag.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Fri, 02 Aug 2024 05:10:14 GMT
x-amz-version-id
PTl7rnF_EEhUwyN5J882FhdYw1E0brGf
via
1.1 8309a274a116732f82ddcbb1f86e3614.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
content-encoding
gzip
x-amz-cf-pop
SFO53-P4
age
14706
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 18 Jul 2024 08:13:46 GMT
server
cloudflare
etag
W/"b2877da906a3216c4f3fc4030b205e54"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
8acb8f773cbbcb7a-LAX
x-amz-cf-id
iDyABd302euZoK7Khr6PzYrT8FuJiZcZnAy3ROnQqPXKv0O92UyDgg==
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&RedC=c.clarity.ms&MXFR=1C3FD3F0B51C63B601E8C73FB11C6D47
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&MUID=253A83F6A33A6CDD12AE9739A2D46D41
42 B
466 B
Image
General
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&MUID=253A83F6A33A6CDD12AE9739A2D46D41
Protocol
H2
Server
20.110.205.119 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:15 GMT
last-modified
Thu, 01 Aug 2024 17:49:37 GMT
server
Microsoft-IIS/10.0
etag
"3f6e7b2d3be4da1:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 2EF5AA2122824459B673332159CF49E0 Ref B: LAX311000108019 Ref C: 2024-08-02T05:10:15Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=11AEDD4F42A7494D9B16B39E7E342A35&MUID=253A83F6A33A6CDD12AE9739A2D46D41
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame
0
0
Preflight
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,visited_url
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods
POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin
https://www.proofpoint.com
alt-svc
h3=":443"; ma=86400
apigw-requestid
b3WIuiAkPHcESJQ=
cf-cache-status
DYNAMIC
cf-ray
8acb8f78382478da-LAX
date
Fri, 02 Aug 2024 05:10:15 GMT
server
cloudflare
vary
Origin
via
1.1 da2461b9060bf6aac3082da0d5161794.cloudfront.net (CloudFront)
x-amz-cf-id
fE-G1QvugGftbTEst1rpJ5y8eW2clifC0YP2vzy0Tjq7jqhmFr_CYQ==
x-amz-cf-pop
LAX50-P4
x-cache
Miss from cloudfront
x-powered-by
Express
getSubscriptions
js.zi-scripts.com/unified/v1/master/
150 B
546 B
Fetch
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
cb7ea45b6afaabef071ccfd7cea29b192dc89a3a7ecf12175a1c20afd8b23a4e

Request headers

Content-Type
application/json
Referer
https://www.proofpoint.com/
Authorization
Bearer 13181347861669635920
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
visited_url
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats

Response headers

date
Fri, 02 Aug 2024 05:10:15 GMT
via
1.1 da2461b9060bf6aac3082da0d5161794.cloudfront.net (CloudFront)
content-encoding
gzip
cf-cache-status
DYNAMIC
x-amz-cf-pop
LAX50-P4
x-powered-by
Express
x-cache
Miss from cloudfront
alt-svc
h3=":443"; ma=86400
apigw-requestid
b3WIwg5XPHcESrQ=
server
cloudflare
etag
W/"96-zgXtJ1O9tt+aJy27ERHepFSAMco"
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.proofpoint.com
cf-ray
8acb8f7bdc9178da-LAX
x-amz-cf-id
GtUnAy2ZpQGES-C-MOcqAK143JlkGwBdorLAH0yGT78TkeejaEoHMQ==
collect
h.clarity.ms/
0
282 B
XHR
General
Full URL
https://h.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.41/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.64.151 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.proofpoint.com
Date
Fri, 02 Aug 2024 05:10:15 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
/
ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/
3 KB
2 KB
Fetch
General
Full URL
https://ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/?iszitag=true
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
1e9e001d54ead701d7a71dd133f2b8546ecbac2d48e8f5e1fa4a88562b8f08bc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

visited-url
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
_vtok
MTYyLjI0NS4yMDYuMjQ0
_zitok
5b63dfe37c74cb713c011722575415
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type
text/javascript

Response headers

date
Fri, 02 Aug 2024 05:10:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc
h3=":443"; ma=86400
cf-ray
8acb8f7efee71588-SJC
/
ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/pixel/63891d4486f0b2c0bdf44a74/?iszitag=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
_vtok,_zitok,content-type,visited-url
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin
https://www.proofpoint.com
allow
GET,HEAD
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8acb8f7d6a2d96b4-SJC
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 02 Aug 2024 05:10:16 GMT
server
cloudflare
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
70d12387-2ab1-4d7c-83ad-6ae5af4d4e41
https://www.proofpoint.com/
3 KB
0
Script
General
Full URL
blob:https://www.proofpoint.com/70d12387-2ab1-4d7c-83ad-6ae5af4d4e41
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e9e001d54ead701d7a71dd133f2b8546ecbac2d48e8f5e1fa4a88562b8f08bc

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length
3033
Content-Type
text/javascript
favicon.ico
www.proofpoint.com/themes/custom/proofpoint/apps/drupal/
8 KB
8 KB
Other
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/apps/drupal/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
c45c82a27f734de8594f06f5e4e0706d5452131d8cbb8be42e18233af4b374e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Jul 2024 01:20:07 GMT
X-CDN
Imperva
Etag
"ed4d56a0"
Content-Type
image/vnd.microsoft.icon
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 4846) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130723, public
Content-Length
7990
Expires
Thu, 15 Aug 2024 07:15:39 GMT
favicon-32x32.png
www.proofpoint.com/themes/custom/proofpoint/apps/drupal/images/favicons/
961 B
1 KB
Other
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-32x32.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:e6::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
006cdaab6ca61d79b8fecd9bb8a71fc9cf21e292d85b9d34d8a15ccce62c5f27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date
Fri, 02 Aug 2024 05:10:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Thu, 18 Jul 2024 23:31:59 GMT
X-CDN
Imperva
Etag
"11b1dbd8"
Content-Type
image/png
X-Iinfo
16-9603993-0 0CNN RT(1722575411835 4927) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=1130723, public
Content-Length
961
Expires
Thu, 15 Aug 2024 07:15:39 GMT
collect
analytics.google.com/g/
0
0
Fetch
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=45je47v0v890103917z876619393za200&_p=1722575411889&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250753&cid=2112287892.1722575413&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAC&_s=2&sid=1722575412&sct=1&seg=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&dt=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&en=page_view&_et=234&tfd=6397
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 02 Aug 2024 05:10:17 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
h.clarity.ms/
0
282 B
XHR
General
Full URL
https://h.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.41/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.64.151 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.proofpoint.com
Date
Fri, 02 Aug 2024 05:10:18 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=1913271713&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fthreat-actor-abuses-cloudflare-tunnels-deliver-rats&ul=en-us&de=UTF-8&dt=Threat%20Actor%20Abuses%20Cloudflare%20Tunnels%20to%20Deliver%20RATs%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202231051&_u=aDDAAEABAAAAACAEK~&jid=&gjid=&cid=2112287892.1722575413&tid=UA-2257074-1&_gid=160953874.1722575413&gtm=45He47v0n81MGR7P8Xv76619393za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&cd19=2112287892.1722575413&z=2024980546
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.101 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f101.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 01 Aug 2024 09:09:29 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72049
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
j.6sc.co
URL
https://j.6sc.co/j/81ad4853-7699-4145-be50-4c0e963c8034.js

Verdicts & Comments Add Verdict or Comment

231 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| dataLayer function| gtag object| mutiny object| mutinyWpJsonp number| is_spa string| hide_element boolean| f object| d object| code number| settings_timer number| _vwo_settings_timer object| _vwo_code object| _VWO string| _vwo_mt string| _vwo_cookieDomain number| _vwo_acc_id object| VWO object| vwo_iehack_queue object| st object| __stdos__ boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| ua_fields object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal function| postscribe object| google_tag_manager_external string| GoogleAnalyticsObject function| ga object| vimeoGAJS string| _linkedin_partner_id object| _linkedin_data_partner_ids function| drift function| fbq function| _fbq object| techtargetic function| lintrk function| saq function| _saq object| zi string| ZIProjectKey function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| GooglemKTybQhCsO number| google_conversion_snippets number| google_conversion_first_time function| once function| _ function| jQuery object| Backbone object| drupalSettings object| Drupal object| tabbable object| Cookies object| geoip2 function| loadjs function| BaseClass object| webpackJsonp object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| FontAwesomeConfig object| ___FONT_AWESOME___ boolean| VimeoPlayerResizeEmbeds_ boolean| VimeoSeoMetadataAppended boolean| VimeoCheckedUrlTimeParam function| saveAs object| MktoForms2 function| subscribeToMarketoFormEvent string| axel number| a function| UET function| UET_init function| UET_push object| ueto_c411623e64 object| uetq object| GooglebQhCsO object| MunchkinTracker object| lotame_sync_16621 boolean| _already_called_lintrk object| ORIBILI object| gaplugins object| gaData function| lotameIsCompatible function| sync16621_aa function| sync16621_c function| sync16621_f object| sync16621_h function| sync16621_ca function| sync16621_j function| sync16621_da object| sync16621_ object| sync16621_ga object| sync16621_v object| sync16621_oa object| sync16621_xa object| sync16621_ya function| sync16621_a function| sync16621_b function| sync16621_g function| sync16621_i function| sync16621_k function| sync16621_l function| sync16621_m function| sync16621_n function| sync16621_o function| sync16621_p function| sync16621_q function| sync16621_r function| sync16621_fa function| sync16621_ea function| sync16621_s function| sync16621_t function| sync16621_u function| sync16621_w function| sync16621_ha function| sync16621_ia function| sync16621_y function| sync16621_ja function| sync16621_z function| sync16621_A function| sync16621_x function| sync16621_B function| sync16621_ka function| sync16621_C function| sync16621_D function| sync16621_E function| sync16621_F function| sync16621_G function| sync16621_H function| sync16621_I function| sync16621_J function| sync16621_K function| sync16621_L function| sync16621_la function| sync16621_ma function| sync16621_na function| sync16621_M function| sync16621_N function| sync16621_pa function| sync16621_O function| sync16621_qa function| sync16621_ra function| sync16621_sa function| sync16621_P function| sync16621_ta function| sync16621_ua function| sync16621_va function| sync16621_wa function| sync16621_Q function| sync16621_R function| sync16621_za function| sync16621_S function| sync16621_T function| sync16621_U function| sync16621_V function| sync16621_Aa function| sync16621_W function| sync16621_X function| sync16621_Y function| sync16621_Z function| sync16621__ function| sync16621_0 function| sync16621_Ea function| sync16621_Ba function| sync16621_1 function| sync16621_Da function| sync16621_Ca function| sync16621_2 function| sync16621_3 function| sync16621_4 function| sync16621_5 function| sync16621_Ga function| sync16621_Ha function| sync16621_Ja function| sync16621_Fa function| sync16621_7 function| sync16621_Ia function| sync16621_La function| sync16621_Ka function| sync16621_8 function| sync16621_6 function| sync16621_9 function| sync16621_Ma function| sync16621_Na function| sync16621_Oa function| sync16621_Pa function| sync16621_$ function| sync16621_Qa function| sync16621_Ra function| sync16621_Sa function| sync16621_Ta object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_46__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked function| addCaptchaScript object| res object| saCookies string| current_window_url_param function| clarity object| clarityuetq object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| drift_frameFactory object| drift_audio_context object| zitag object| ZILogs function| loadZILogs function| errorHandler object| ziws object| drift_sentry_config

75 Cookies

Domain/Path Name / Value
.proofpoint.com/ Name: visid_incap_177663
Value: EWWHTh8tQ56jarCjEjaB5TNqrGYAAAAAQUIPAAAAAADCGaChSMdrgjRsh56IrUlb
.proofpoint.com/ Name: incap_ses_1825_177663
Value: Yl/DBYJwzD4IfPCc8LNTGTNqrGYAAAAASrvTvA1Tm1WuwDF6Yxv4eQ==
.proofpoint.com/ Name: _vwo_uuid_v2
Value: D583D41428EEA3EF03E06E7DB8C82F136|61a65b51f479b678dba13b04b41607db
.proofpoint.com/ Name: _gcl_au
Value: 1.1.1676228874.1722575413
.proofpoint.com/ Name: _ga_B1V8SZE3GL
Value: GS1.1.1722575412.1.1.1722575412.60.0.0
.sharethis.com/ Name: __stid
Value: ZGAAC2asajUAAAAIPQSVAw==
.sharethis.com/ Name: __stidv
Value: 2
www.proofpoint.com/ Name: hide_lang_switcher
Value: 1
.g2crowd.com/ Name: __cf_bm
Value: d2L8OycrbO1rHPuiW80R3GvLJSVwY3xUaArQ8SWx7oM-1722575413-1.0.1.1-QqdUo0LGKvrfUVwJFTz2FX6ZOBFWgfuNN1pmj9Xf0gWoG5WNiCtMP1u3nqZ6KVsUtwsPrwuwY2YuaP_1r21pCg
.proofpoint.com/ Name: _mkto_trk
Value: id:309-RHV-619&token:_mch-proofpoint.com-1722575413270-98259
.proofpoint.com/ Name: fpestid
Value: P1HaQe1QorXPxVlalv92q9EmzPSPLsQb3ksS3mDMKcxHBXudFbbKY8XybeMVeH6Wc9HZ-g
.proofpoint.com/ Name: _uetsid
Value: 7f9b0470508d11ef817dcda4fb373534
.proofpoint.com/ Name: _uetvid
Value: 7f9b28c0508d11efb6d549c1de68d02e
.techtarget.com/ Name: __cf_bm
Value: bQwy5G65dmQd1StuCfqXPnoCagpHHsGbuMeo6x3hEa4-1722575413-1.0.1.1-R0kL1B3NgmbsXar3Mp_kXbVoH4C8RtRCzSthtTbsQr_pF6IHQ6.N6inejGMtHz3bjzDpAo.BgLboRAYcyyLWJg
www.proofpoint.com/ Name: pp_user_country
Value: us
.bing.com/ Name: MUID
Value: 253A83F6A33A6CDD12AE9739A2D46D41
.bat.bing.com/ Name: MR
Value: 0
.proofpoint.com/ Name: _ga
Value: GA1.2.2112287892.1722575413
.proofpoint.com/ Name: _gid
Value: GA1.2.160953874.1722575413
.proofpoint.com/ Name: _gat_UA-2257074-1
Value: 1
.proofpoint.com/ Name: lotame_domain_check
Value: proofpoint.com
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%2Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%2F2Sgg
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%2Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%2F2Sgg
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%2BkYvU00tEs
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%2BkYvU00tEs
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgtdSxtQYwAToEFPvsiUIEYtEzSA.mETEn%2FJd5r9p20PdLHhVj8YalSk4B2hO%2B%2BHyaBolkK8
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgtdSxtQYwAToEFPvsiUIEYtEzSA.mETEn%2FJd5r9p20PdLHhVj8YalSk4B2hO%2B%2BHyaBolkK8
www.proofpoint.com/ Name: sa-user-id
Value: s%253A0-1dd84340-a531-5dcb-747b-2ecda36f7582.fuHu9M0%252Br4TjuQnvOw1gr0O4MU1Ifg9Nborqwd%252F2Sgg
www.proofpoint.com/ Name: sa-user-id-v2
Value: s%253AHdhDQKUxXct0ey7No291gqL1zvQ.MlSPk5v4MUDwGgUiktoyvpGG0YaMjUPMN%252BkYvU00tEs
www.proofpoint.com/ Name: sa-user-id-v3
Value: s%253AAQAKINGcs0buF5CUQNN4YmnkIk9TX4HbLs5a9t3dtOVGqLwmENYBGAQgtdSxtQYwAToEFPvsiUIEYtEzSA.mETEn%252FJd5r9p20PdLHhVj8YalSk4B2hO%252B%252BHyaBolkK8
.linkedin.com/ Name: li_sugr
Value: 28ba28b6-56d2-41f7-86f9-1714be3afd30
.linkedin.com/ Name: lidc
Value: "b=VGST06:s=V:r=V:a=V:p=V:g=3060:u=1:x=1:i=1722575413:t=1722661813:v=2:sig=AQEDOlc2zS2NW7a3kmtcC-s2wntnznrF"
.linkedin.com/ Name: UserMatchHistory
Value: AQKF8OU_DlQ3XQAAAZERfuHUPOTgkEU6SmA3LfLJ8MGjTFBP-zIuM-7uEzySG67J_RBCZQDgSDZqKw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLe-o9MYM4x4gAAAZERfuHU8TNpANuXtsjihVQh8TLExiHcLpQ_4TG_JPFKbmOlNqVBa3avQ0qGmHr7v1w1Sg
.linkedin.com/ Name: bcookie
Value: "v=2&cef4de74-c10f-4b49-8029-1cea7302b6d7"
.crwdcntrl.net/ Name: _cc_id
Value: cbdfd1c49cec12347e92e9d59c823395
.proofpoint.com/ Name: _cc_id
Value: cbdfd1c49cec12347e92e9d59c823395
.proofpoint.com/ Name: panoramaId_expiry
Value: 1722661813766
.doubleclick.net/ Name: IDE
Value: AHWqTUnK6J8ZD6rGDkAsLIMUMdkIiHWg94dc_kQ8qNBziLvUaNpi4T4jb7PV9bCYMxA
.doubleclick.net/ Name: receive-cookie-deprecation
Value: 1
.www.linkedin.com/ Name: bscookie
Value: "v=1&20240802051013a743405f-8a1e-47a1-83ce-5cef18c34fc1AQH1_xK2PRSoYk5uVOFcY3gLoGdnN5m7"
www.clarity.ms/ Name: CLID
Value: f7f5db30d7074712970319b6769372b3.20240802.20250802
.proofpoint.com/ Name: _fbp
Value: fb.1.1722575414064.98818117172438297
.adnxs.com/ Name: XANDR_PANID
Value: AtjlVYEuN6h5Pgx0wdlOJ1sJLZSnhzHogavYFG3oZgymGMIDQCqbzkt9hPlOoUPoZuronR-rsdOljtqPhgQee3KOQ38npDXX-XYhw734MXM.
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
.adnxs.com/ Name: uuid2
Value: 6233023589567718437
.proofpoint.com/ Name: _clck
Value: 1bjih2m%7C2%7Cfnz%7C0%7C1675
.doubleclick.net/ Name: ar_debug
Value: 1
.app-abj.marketo.com/ Name: __cf_bm
Value: iGdwSceBf9o1HJEkD4j6Ive_LJTTbHAB4mZT0dy.nsA-1722575414-1.0.1.1-Hzr8rZvkiEb1SWEpV5xoVoKTo0jX1DJzR7znnbXCLLGg_vxtdATaegGG8L5Gw6gBzPFZzfBeNZbEVknhG.vHWA
.t.sharethis.com/ Name: pxcelPage_default_c010_B
Value: 0_6_1722575414646
www.proofpoint.com/ Name: drift_campaign_refresh
Value: 836ebe01-6aa9-4758-8293-b22c5d5482d7
.adsrvr.org/ Name: TDID
Value: 38c769a9-01f6-4f4d-bc26-ff6454cbfd77
.ml314.com/ Name: pi
Value: 3646000157295640636
.proofpoint.com/ Name: _clsk
Value: gjjwxy%7C1722575414923%7C1%7C1%7Ch.clarity.ms%2Fcollect
.exelator.com/ Name: EE
Value: "1705e451ce76b6caa52c10d68a2675bf"
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcHQ3MA01cTUMDnV3CzJLDkx0dQo2dAgxcwi0cjM3DQpbXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIfEl%252BUWb6otDgxUUpaQyLSopPBZ%252Fo2A8AnaQqvQ%253D%253D"
.eyeota.net/ Name: mako_uid
Value: 191117ee738-2a20000010a4084
.eyeota.net/ Name: SERVERID
Value: 16516~DM
.rlcdn.com/ Name: rlas3
Value: yB6rj+uAkHCWNNLhOJAE865LspR0ALudmqtlex41Kbo=
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.adsrvr.org/ Name: TDCPM
Value: CAEYBSABKAIyCwiOg7b9g6-ZPRAFOAE.
.rlcdn.com/ Name: pxrc
Value: CLfUsbUGEgUI6AcQABIFCNtOEAA=
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 253A83F6A33A6CDD12AE9739A2D46D41
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 253A83F6A33A6CDD12AE9739A2D46D41
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.yahoo.com/ Name: A3
Value: d=AQABBDdqrGYCEA9PMeS09p6MjaMZkaIKZxIFEgEBAQG7rWa2ZtwAAAAA_eMAAA&S=AQAAAsF8ViO3xGNE-tbyAmzFSBo
.analytics.yahoo.com/ Name: IDSYNC
Value: 19b8~2jw5
.www.proofpoint.com/ Name: _zitok
Value: 5b63dfe37c74cb713c011722575415
.zoominfo.com/ Name: __cf_bm
Value: nD4hG58x8_WHwrlq7YlSU8VhPNy6odDI5PzFDCJBBnI-1722575416-1.0.1.1-WpEYwZKopelLG.qPeeXdQccF.q9Fho8yabQSKrGoI7uaYg0n8J_oFk29TKgaoqzaYuPMTg4kK53F79DmeuTWug
.zoominfo.com/ Name: _cfuvid
Value: 9qC3hRhKVbkIGJNNUcxnskOH8KT.8d6_rpwaXupE.44-1722575416314-0.0.1.1-604800000
www.proofpoint.com/ Name: drift_aid
Value: 6c495965-6368-4c7d-941f-c17790cff07e
www.proofpoint.com/ Name: driftt_aid
Value: 6c495965-6368-4c7d-941f-c17790cff07e

3 Console Messages

Source Level URL
Text
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats(Line 1117)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats(Line 1117)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security error URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X(Line 784)
Message:
Refused to load the script 'https://j.6sc.co/j/81ad4853-7699-4145-be50-4c0e963c8034.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://www.google-analytics.com/analytics.js https://www.googleoptimize.com/optimize.js https://www.googletagmanager.com https://munchkin.marketo.net https://app-abj.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://geoip-js.com https://ads.avocet.io https://trk.techtarget.com https://j.6sc.co/6si.min.js https://tags.srv.stackadapt.com https://ads.avct.cloud https://js.driftt.com https://js-agent.newrelic.com https://bam.nr-data.net https://cdn.jsdelivr.net/simplemde/latest/simplemde.min.js https://cdn.jsdelivr.net/npm/@json-editor/json-editor@latest/dist/jsoneditor.min.js https://js.adsrvr.org/up_loader.1.1.0.js https://go.affec.tv https://bat.bing.com/bat.js https://s7.addthis.com/js/300/addthis_widget.js https://m.addthis.com https://z.moatads.com https://cdn.jsdelivr.net/npm/datalist-polyfill@latest/datalist-polyfill.min.js https://snap.licdn.com https://tracking.g2crowd.com https://bat.bing.com https://connect.facebook.net https://tags.srv.stackadapt.com https://widget.spreaker.com *.visualwebsiteoptimizer.com app.vwo.com *.sharethis.com https://unpkg.com/dropzone@5/dist/min/dropzone.min.js https://d1hgczpbubj217.cloudfront.net/video-widget/ https://www.youtube.com/ https://app-static.turtl.co/embed/turtl.embed.v1.js https://js.zi-scripts.com/zi-tag.js *.mutinycdn.com https://www.clarity.ms; object-src 'self'; style-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com s3.amazonaws.com *; img-src 'self' 'unsafe-inline' data: blob: *.visualwebsiteoptimizer.com chart.googleapis.com wingify-assets.s3.amazonaws.com app.vwo.com * *.mutinycdn.com; media-src 'self'; frame-src 'self' 'unsafe-inline' app.vwo.com *.visualwebsiteoptimizer.com *; frame-ancestors 'self' https://app.mutinyhq.com; child-src 'self' 'unsafe-inline' blob:; worker-src 'self' blob:; font-src 'self' 'unsafe-inline' data: *; connect-src 'self' 'unsafe-inline' *.visualwebsiteoptimizer.com app.vwo.com * *.mutinyhq.com *.mutinyhq.io *.mutinycdn.com; report-uri /report-csp-violation
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

309-rhv-619.mktoresp.com
4788165.fls.doubleclick.net
analytics.google.com
app-abj.marketo.com
attr.ml-api.io
bat.bing.com
bcp.crwdcntrl.net
buttons-config.sharethis.com
c.bing.com
c.clarity.ms
client-registry.mutinycdn.com
connect.facebook.net
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
geoip-js.com
googleads.g.doubleclick.net
h.clarity.ms
ibc-flow.techtarget.com
j.6sc.co
js.driftt.com
js.zi-scripts.com
l.sharethis.com
munchkin.marketo.net
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.ml-attr.com
secure.adnxs.com
snap.licdn.com
stats.g.doubleclick.net
t.sharethis.com
tags.srv.stackadapt.com
tracking.g2crowd.com
trk.techtarget.com
ws.zoominfo.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.proofpoint.com
j.6sc.co
104.16.118.43
104.16.92.80
104.16.93.80
107.23.203.136
13.32.208.104
13.32.208.17
142.250.31.148
142.250.31.97
142.251.16.157
142.251.163.155
142.251.179.101
151.101.65.91
172.253.115.105
172.64.150.44
18.165.83.61
192.28.144.124
20.110.205.119
2001:4860:4802:38::181
23.1.44.149
23.73.207.9
2600:1408:c400:5::17c7:3719
2600:9000:250a:d000:5:7a81:86c0:93a1
2600:9000:250b:e800:c:abe:f440:93a1
2600:9000:26c1:b600:1d:85c3:6640:93a1
2606:4700:4400::ac40:973c
2606:4700::6812:1eb0
2606:4700::6812:b2b
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c0b::61
2607:f8b0:4004:c1d::9c
2607:f8b0:4004:c1f::71
2620:1ec:21::14
2620:1ec:50::12
2620:1ec:bdf::40
2620:1ec:c11::237
2a02:e980:e6::cf
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
3.17.237.129
34.111.208.231
34.198.35.213
34.96.102.137
51.8.64.151
68.67.153.60
68.67.160.184
006cdaab6ca61d79b8fecd9bb8a71fc9cf21e292d85b9d34d8a15ccce62c5f27
00a028b6540a3f5309fccc8c5c6d5d5e1da884807e21931d907f29f7247ea734
0423f69dc0e5f863d923e48c8c61298979b1c3fbdacbf6976d2b36f160bdea88
0660976790bb5eed64d9617a793a7fcd80b6180f6793c9a68162d0ea12114f2a
08913ba5cd15371345171107c16e008a85a792c8af6e8955259a05634f83fe6f
0b291571122aec79a4f86f9e799ff7707ee3dc914413f425feede8259612ecc4
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
1330c72ad950e7a9c7e6c3149323bbec7f9194150be1520756860f6d507bc9ee
1519ceaa67bcd32243176aa59028ac713011d3fdb6e9ef4dffa70cce31ae8cf9
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e9e001d54ead701d7a71dd133f2b8546ecbac2d48e8f5e1fa4a88562b8f08bc
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
27a16b821d4421779cf21f213da4cc950c3a3eab3b3811f0937c40bc02a75328
2b43985f685b3a6d06db8f8bb999847c8363d2992e0840cfe0eae3a4a79e6469
2b72026eaaae017cb9535ad20f82d00bc0ce390c76fbf5268e4708f9bf5e9bf8
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31ddb1ebfd6982bf2f8acb1ecac45083589aecca3ad757429edca40aea63df14
3403420fd866a2ee4b53b50d0c57b63d88c80afb4ee28dbe8bae2a27f8929609
3d827d05f0c1502d3b245e544611619ddb4d0eec78f55940594ae531e4f62cfc
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
446380f8e7c7baddebcb2fc82da913bd6087bd07ea6b28fc6e92a8208d6d18bb
480dfc4f346103ef7f50a60ef2462bc7ef967a06ee6ed20c6dcb50a6ef48d66e
49652ad86154be80557ff54bff8ffca4a611acbe4d70bbc174be39e8472de17f
4ae79f6079013e0b6e62b871e558a573823eed1be52852634e13d3bee5663380
4b274cd219e6f9e664781b8997843f0881f8911ffbc922349ec4c7b35d50ed78
4f355e3a4d50868a329ee1c1f3f67ba9a69be91088c75e361194f3eee8c7e756
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
55bda2f21018d051f95b3aebea318bd719370a3a870245f92dd9c3e7d6348a59
56176a50de3d60c3b2eb019e64ce06771c2e5cacbbaa528caa2d5b040747622a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5680e67bec883a7cc47635705afdaa0d28ad681a1bec515983784fe6c002356b
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5f3083b731588016304b0ac105b66985b8ffc9d2c7a2e627f0435da5e86a4648
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6312cd49d1d0b91d2aa283cba2ad0365fc697b3e7fc5b34f6e749ba646b4ec31
63bb2e926bb71d9af20024a237718b3cbd8bcb03af6fe3510132024571005f69
6450691706460a0ed12542c899ec8108a2856abefd157b9ef298661ebb5ab506
64ac610477f4c2a19d7ade073fef3eccaa7db99efa5ff86733fb44c33c55226a
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6a6a60dd10bf839e3cfb6082e2911b15f2870027d4ab2a7509e48056440f13e2
6cb491c38ad0fdf859e49d3b3653b2bf4c99bdc68d6299583c6566da6e66fb77
72a15930d7a4561b6af10b65f0e28f3956ef3001404e6fa5ed15ae795567befc
737324c6a9ca813b87b9a4a164306097cbcb07bc96b74db797f9cd8cee9fc31a
73ed76bb6de95a184c2bc13662075980a6c88be5efd5eb1de0fa3a38188217d6
751b1a09760d9c50041b5f070968f1ae898dfb4f6f89b86d0bfa6526d0dc89ae
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76ffdc5337cd5a509f15d70767b85a793aead82975d0d86912e1607e963c9aed
79c5866be02e93324059c6cda1612ff9044daaf4f842c7a18c89c3ed755070a3
7b8112efa2e817f2534339b1a48bf487e65a54d6e3c17ac91c61b7bfb396dc5d
80a26b40739bae7383ff5c4cc9de60a175044b55c7fbabf50ee4c7432cb3876a
8277ddf1278fc0cfc43a6d5cc9ed62f66e7ce2b9790390343d7c62745f4503fe
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8638dcf82ad4b91ff673b4bde5bafa7c695a4836a3d4ab314bfc541962dd0bb7
889da033525190aa887d2361d6cb460c50e9b128e017c33f4499063aeaa73632
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
88dfd6fc2bf5814e1fd826b25417ab4e0f11354c5adf2fa49dad6d97e444ebb6
8fd5dcb3427fad9f1304d5a1eafd0f9db5aafdf9eabe50bb1e5c2a16fc521efe
9468b3c6d60ddfdc2092e07b23137f1a002a7f78c30cce756ac280fddc7516d3
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
96d8da75e43ad51e68186287bcf102176826e00d48c079941e5b42abdba7bc19
96f878284acab47e825e2b385085430c9d76cc746bb05aa2e751d9421bfa6b0c
98d32b00fca86fc6994df33302e051a6ad03461a43ff5797d5b10ace4cf4772f
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c1b1066c42f920ce30aee11e0645fc48f66f13f828e31865b34abe54d6dd4e0
a54fee5912de81021ec64a51dc08b3781b38be49e178936b134ff777e23185ae
a782015ceceb595c8305a944456587c4f2c4b3f0ca82aac8e5c6d7b33138f392
a7d2d6455a4b73acd2020310ee328d8b47447be303d47fa573b8e4d724787b55
a7de65ae8dbd3767d98f475502d97732a81ceecbc6f1b2f52f03e457207753d2
aa44e3c804607a8a17c2e9597537350b4e425c1708a1c7c6fc50a28dba1fd488
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb
afdd76f6919dc340e54a1045e6f4a8fc840a922c8efd1d07cc5bcdf448373a66
b6a5688acee0fb12dd3b53423dfecfeba26575a5a3681eb30de3f434c52e51f8
bd5584dd3ce86c6fc33cf17cc82ee828026eaa7c7b7ac0699db83efade55f06b
bea5360119eaab571e35e9ec9e3952403d70953c298c9c5fde7700d9fc0773f9
c3666e420f1e9ea50d544484f433bb0613fe24e0891935549f12ab937e379440
c45c82a27f734de8594f06f5e4e0706d5452131d8cbb8be42e18233af4b374e6
cb7ea45b6afaabef071ccfd7cea29b192dc89a3a7ecf12175a1c20afd8b23a4e
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
d2ff1d7d7ca94f39ff764e0650c5d3ca48404df97284f1940b7c24797da5730e
d756aa94bf52a495078ecadd896d7deec037433e2df5609d7bd0d5388f084997
d790432627c2bcb0358551fe8035b2a90757cd31a6eccf189f2f0c809e89ad80
d9e6caeb8d34d33a957ddfb11bfd04565231812c653f9380a09737765495a341
da344fbc0c0027b594a0eaa7d71fd4dc5124b5087e3e992eafefb1c42b151875
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0d9ca9316294d8c98704da12c55856a2bc837adf42106bb0b7ab89f77115540
e2a193fa1b1801dcdddf024a250b04b496f5e36e4324a8de73948e6421ff5865
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c2ccc286ad453a58ef10a1645225144b3512fe11c991fcb97bf3ffed6f851c
e4a844b79de8171a014dbfae6e5d1a16c4b32fff608dd28767bcaf88fefef93b
e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407
e8362a6b3607b4974b228b7148f5e7163bb351fd4acc9a54b5a8bd35ec3f45ce
eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e
ece2d0c67a92dd2e9092416cd1c60151504e8f7eed717af3b152420c3684a3f5
edd5487f216469726314ae2b829b221d70e2a02674477e3c8f69a0d5f0b1ea49
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4d9a4c28a0d773774c936994ea6ec2ed3c3defba7c4f9d3d6adf4d9e6153e48
f9484e55fa69641bda505c9f9916c928544b15a2c7425234ff138d2931f39911
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a