cofense.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Submission: On February 17 via api (February 17th 2022, 9:26:12 pm UTC) from IN — Scanned from DE

Summary HTTP 215 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 55 IPs in 8 countries across 46 domains to perform 215 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is cofense.com. The Cisco Umbrella rank of the primary domain is 484997.
TLS certificate: Issued by R3 on February 2nd 2022. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
101	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
5	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
4	2a06:98c1:312... 2a06:98c1:3121::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:215... 2600:9000:2156:4000:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.111.214.240 104.111.214.240	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
7	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2a04:4e42:600... 2a04:4e42:600::622	54113 (FASTLY) (FASTLY)
9	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	54.197.98.98 54.197.98.98	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.98.29 143.204.98.29	16509 (AMAZON-02) (AMAZON-02)
2	2a03:5f80:a::... 2a03:5f80:a::b212:e7c0	50952 (DATAIX-AS...) (DATAIX-AS Peering Ltd.)
1	52.20.96.200 52.20.96.200	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
2	143.204.98.123 143.204.98.123	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	54.236.80.213 54.236.80.213	14618 (AMAZON-AES) (AMAZON-AES)
2 7	2600:9000:215... 2600:9000:2156:4800:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
1	143.204.98.104 143.204.98.104	16509 (AMAZON-02) (AMAZON-02)
1	34.200.97.200 34.200.97.200	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c0b::9b	15169 (GOOGLE) (GOOGLE)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	107.20.140.231 107.20.140.231	14618 (AMAZON-AES) (AMAZON-AES)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
2	178.62.192.243 178.62.192.243	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.24 108.174.10.24	14413 (LINKEDIN) (LINKEDIN)
13 16	52.209.209.218 52.209.209.218	16509 (AMAZON-02) (AMAZON-02)
1	34.255.23.179 34.255.23.179	16509 (AMAZON-02) (AMAZON-02)
1	54.229.132.122 54.229.132.122	16509 (AMAZON-02) (AMAZON-02)
1	2.16.186.18 2.16.186.18	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	52.58.50.64 52.58.50.64	16509 (AMAZON-02) (AMAZON-02)
1	70.42.32.95 70.42.32.95	13789 (INTERNAP-...) (INTERNAP-BLK3)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1 2	35.156.100.230 35.156.100.230	16509 (AMAZON-02) (AMAZON-02)
1 2	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 1	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	54.86.117.43 54.86.117.43	14618 (AMAZON-AES) (AMAZON-AES)
2	18.232.28.189 18.232.28.189	14618 (AMAZON-AES) (AMAZON-AES)
1	52.3.66.26 52.3.66.26	14618 (AMAZON-AES) (AMAZON-AES)
215	55

101 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:4000:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.214.240 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-240.deploy.static.akamaitechnologies.com

cdn.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

get.cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a04:4e42:600::622 (United States)

ASN54113 (FASTLY, US)

fast.wistia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.197.98.98 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-197-98-98.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-29.fra50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:5f80:a::b212:e7c0 (Russian Federation)

ASN50952 (DATAIX-AS Peering Ltd., RU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.20.96.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-96-200.compute-1.amazonaws.com

lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.98.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-123.fra50.r.cloudfront.net

static.oktopost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.236.80.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-80-213.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:2156:4800:6:9280:1080:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-104.fra50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.97.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-97-200.compute-1.amazonaws.com

okt.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.140.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-20-140-231.compute-1.amazonaws.com

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

404-jhu-612.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.62.192.243 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

hits-i.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.24 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-24.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.209.209.218 (Dublin, Ireland) 13 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-209-218.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.23.179 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-23-179.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.132.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-132-122.eu-west-1.compute.amazonaws.com

ws3.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.18 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-18.deploy.static.akamaitechnologies.com

embedwistia-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.50.64 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-50-64.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.95 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.156.100.230 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-100-230.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.53 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.86.117.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-117-43.compute-1.amazonaws.com

distillery.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.232.28.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-6-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.66.26 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-66-26.compute-1.amazonaws.com

pipedream.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
108	cofense.com cofense.com — Cisco Umbrella Rank: 484997 get.cofense.com	1 MB
23	adroll.com 15 redirects s.adroll.com — Cisco Umbrella Rank: 2263 d.adroll.com — Cisco Umbrella Rank: 1329	29 KB
16	wistia.net fast.wistia.net — Cisco Umbrella Rank: 6469	507 KB
9	gstatic.com fonts.gstatic.com	175 KB
7	iubenda.com cdn.iubenda.com — Cisco Umbrella Rank: 9812 www.iubenda.com — Cisco Umbrella Rank: 11366 hits-i.iubenda.com — Cisco Umbrella Rank: 10790	64 KB
5	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 574 script.hotjar.com — Cisco Umbrella Rank: 726 vars.hotjar.com — Cisco Umbrella Rank: 809 in.hotjar.com — Cisco Umbrella Rank: 1615 ws3.hotjar.com — Cisco Umbrella Rank: 59102	67 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	4 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 439 www.linkedin.com — Cisco Umbrella Rank: 602 px4.ads.linkedin.com — Cisco Umbrella Rank: 5087	3 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	176 KB
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 800	172 KB
3	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 67 googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175	3 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 197	59 KB
2	pardot.com pi.pardot.com — Cisco Umbrella Rank: 3601	3 KB
2	wistia.com distillery.wistia.com — Cisco Umbrella Rank: 5577 pipedream.wistia.com — Cisco Umbrella Rank: 5795	232 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net — Cisco Umbrella Rank: 265	1 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 356	741 B
2	advertising.com 1 redirects pixel.advertising.com — Cisco Umbrella Rank: 307	522 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 488	2 KB
2	google.de www.google.de — Cisco Umbrella Rank: 6342	565 B
2	google.com www.google.com — Cisco Umbrella Rank: 2	565 B
2	shareaholic.com analytics.shareaholic.com — Cisco Umbrella Rank: 19358 partner.shareaholic.com — Cisco Umbrella Rank: 22848	642 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 2821	6 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 830	3 KB
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 322	274 B
1	yahoo.com ads.yahoo.com — Cisco Umbrella Rank: 835	194 B
1	taboola.com sync.taboola.com — Cisco Umbrella Rank: 725	90 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 752	591 B
1	outbrain.com sync.outbrain.com — Cisco Umbrella Rank: 717	477 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 288	239 B
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 126	27 KB
1	akamaihd.net embedwistia-a.akamaihd.net — Cisco Umbrella Rank: 7246	39 KB
1	mktoresp.com 404-jhu-612.mktoresp.com	311 B
1	t.co t.co — Cisco Umbrella Rank: 456	336 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 468	459 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 99	15 KB
1	okt.to okt.to — Cisco Umbrella Rank: 23137	252 B
1	oktopost.com static.oktopost.com — Cisco Umbrella Rank: 31178	4 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 7499	477 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 539	6 KB
1	lltrck.com lltrck.com — Cisco Umbrella Rank: 27475
1	shareaholic.net www.shareaholic.net — Cisco Umbrella Rank: 18957	2 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com — Cisco Umbrella Rank: 19591	41 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 1464	36 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	5 KB
215	46

	Domain	Requested by
101	cofense.com	cofense.com
16	d.adroll.com	13 redirects s.adroll.com cofense.com
16	fast.wistia.net	cofense.com fast.wistia.net
9	fonts.gstatic.com	fonts.googleapis.com
7	s.adroll.com	2 redirects www.googletagmanager.com cofense.com s.adroll.com
7	get.cofense.com	cofense.com get.cofense.com
5	fonts.googleapis.com	cofense.com
4	cdn.iubenda.com	cofense.com cdn.iubenda.com
4	www.googletagmanager.com	cofense.com www.googletagmanager.com
4	use.fontawesome.com	cofense.com use.fontawesome.com
3	www.google-analytics.com	www.googletagmanager.com cofense.com
3	cdnjs.cloudflare.com	cofense.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	ib.adnxs.com	1 redirects cofense.com
2	x.bidswitch.net	1 redirects cofense.com
2	eb2.3lift.com	1 redirects cofense.com
2	pixel.advertising.com	1 redirects cofense.com
2	dsum-sec.casalemedia.com	1 redirects cofense.com
2	px.ads.linkedin.com	2 redirects
2	hits-i.iubenda.com	cdn.iubenda.com
2	www.google.de	cofense.com
2	www.google.com	cofense.com
2	munchkin.marketo.net	cofense.com munchkin.marketo.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
1	pipedream.wistia.com	fast.wistia.net
1	distillery.wistia.com	fast.wistia.net
1	cm.g.doubleclick.net	1 redirects
1	us-u.openx.net	cofense.com
1	ads.yahoo.com	cofense.com
1	sync.taboola.com	cofense.com
1	image2.pubmatic.com	cofense.com
1	sync.outbrain.com	cofense.com
1	pixel.rubiconproject.com	cofense.com
1	connect.facebook.net	d.adroll.com
1	embedwistia-a.akamaihd.net	cofense.com
1	ws3.hotjar.com	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	px4.ads.linkedin.com	cofense.com
1	www.linkedin.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	404-jhu-612.mktoresp.com	munchkin.marketo.net
1	vars.hotjar.com	static.hotjar.com
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	t.co	cofense.com
1	analytics.twitter.com	static.ads-twitter.com
1	www.googleadservices.com	www.googletagmanager.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	okt.to	static.oktopost.com
1	script.hotjar.com	static.hotjar.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	www.iubenda.com	cdn.iubenda.com
1	static.oktopost.com	cofense.com
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	lltrck.com	cofense.com
1	static.hotjar.com	www.googletagmanager.com
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	www.googleoptimize.com	cofense.com
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
215	60

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
support.cofense.com
cofenselabs.com
go.cofense.com
community.cofense.com
www.youtube.com
www.msspalert.com
www.cnet.com
www.bleepingcomputer.com
technical.ly
get.cofense.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com R3	`2022-02-02` - `2022-05-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.iubenda.com DigiCert SHA2 Secure Server CA	`2022-01-31` - `2023-01-31`	a year	crt.sh
get.cofense.com Cloudflare Inc ECC CA-3	`2022-01-23` - `2023-01-23`	a year	crt.sh
fast.wistia.net GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-12-24` - `2023-01-25`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.stackpathcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-31` - `2022-05-31`	a year	crt.sh
*.shareaholic.net R3	`2022-01-30` - `2022-04-30`	3 months	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2021-07-25` - `2022-08-26`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2021-06-04` - `2022-06-03`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.oktopost.com Sectigo RSA Organization Validation Secure Server CA	`2021-09-02` - `2022-09-29`	a year	crt.sh
shareaholic.com Amazon	`2021-06-05` - `2022-07-04`	a year	crt.sh
s.adroll.com Amazon	`2021-08-02` - `2022-08-31`	a year	crt.sh
okt.to R3	`2021-12-16` - `2022-03-16`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-06` - `2023-01-05`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-01-06` - `2023-01-05`	a year	crt.sh
*.shareaholic.com R3	`2022-01-26` - `2022-04-26`	3 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.iubenda.com Sectigo RSA Domain Validation Secure Server CA	`2022-01-14` - `2023-02-14`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2021-09-09` - `2022-10-08`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
a248.e.akamai.net DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-11-27` - `2022-02-25`	3 months	crt.sh
*.wistia.com Amazon	`2021-04-01` - `2022-04-30`	a year	crt.sh
pi.pardot.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-08` - `2022-11-07`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Frame ID: 541B7A4D223DBF32969455B397209CF1
Requests: 194 HTTP requests in this frame

Frame: https://fast.wistia.net/embed/iframe/3subrr6ozn
Frame ID: AA8211B1379226E9B1AF745385091A12
Requests: 17 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Frame ID: 8E4D688DF38ACBAE7FEBD8C86416D196
Requests: 1 HTTP requests in this frame

Frame: https://get.cofense.com/index.php/form/XDFrame
Frame ID: 51CF0CC6B8B8AF134A323FC64A872B12
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Purchase Order Email Scam with Phishing Link | Fake Domain

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Iubenda (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

iubenda\.com/cookie-solution/confs/js/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css
owl\.carousel.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

215
Requests

93 %
HTTPS

33 %
IPv6

46
Domains

60
Subdomains

55
IPs

8
Countries

2777 kB
Transfer

9223 kB
Size

53
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://support.cofense.com/
Title: Customer Resource Center

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Request a Demo

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cofense

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/cofense

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cofense/

Search URL Search Domain Scan URL

URL: https://www.msspalert.com/cybersecurity-guests/credential-phishing-insights-for-msps-the-key-to-your-customers-vulnerabilities/
Title: 12/1/2021 Credential Phishing Insights for MSPs: The Key to Your Customers’ Vulnerabilities MSSP Alert

Search URL Search Domain Scan URL

URL: https://www.cnet.com/tech/services-and-software/are-you-being-scammed-heres-how-to-know-and-what-to-do/
Title: 12/3/2021 Are You Being Scammed? Here’s How to Know What to Do c|net

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/emotet-now-drops-cobalt-strike-fast-forwards-ransomware-attacks/
Title: 12/7/2021 Emotet now drops Cobalt Strike, fast forwards ransomware attacks Bleeping Computer

Search URL Search Domain Scan URL

URL: https://technical.ly/2022/01/03/cybersecurity-predictions-2022/
Title: 1/3/2022 What will the cybersecurity industry look like in 2022? Technical.ly

Search URL Search Domain Scan URL

URL: https://get.cofense.com/Q3_2021_Phishing_Review.html
Title: Download Now

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 168

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 169

https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 175

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1645133167486%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%252Fbeware-purchase-order-scam-carries-phishing-link%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true&e_ipv6=AQJxqLFavJXa0gAAAX8Jk_3BbSvdCMoAX63YcW0h8FJe86E3f32EOOrqq7Fo3-SiUsL7g-oULQD2iuUVzEN6Xas8udjJoQ

Request Chain 191

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&pv=1525989509.2580411&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

Request Chain 194

https://d.adroll.com/cm/index/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167&C=1

Request Chain 195

https://d.adroll.com/cm/n/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expires=365

Request Chain 196

https://d.adroll.com/cm/onevideo/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

Request Chain 197

https://d.adroll.com/cm/outbrain/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

Request Chain 198

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 199

https://d.adroll.com/cm/taboola/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

Request Chain 200

https://d.adroll.com/cm/triplelift/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 201

https://d.adroll.com/cm/r/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 202

https://d.adroll.com/cm/b/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

Request Chain 203

https://d.adroll.com/cm/x/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

Request Chain 205

https://d.adroll.com/cm/o/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=fd3559fe349048c33d1b5d68854e42d4

Request Chain 206

https://d.adroll.com/cm/g/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=_TVZ_jSQSMM9G11ohU5C1A HTTP 302
https://d.adroll.com/cm/g/in

215 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/ 222 KB
40 KB 225ms
179ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / WP Engine
Resource Hash: 69aaf64ca6bc5de1be389666770dd16765ca10ee8c1e6bc52d5cddbc98b011de

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://cofense.com/wp-json/>; rel="https://api.w.org/" <https://cofense.com/wp-json/wp/v2/posts/28527>; rel="alternate"; type="application/json" <https://cofense.com/?p=28527>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 1
x-cache-group: normal
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6df21791cd5b9110-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 cache.skin.css
cofense.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
282 B 51ms
49ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 14 Feb 2022 22:12:17 GMT
server: cloudflare
age: 203922
etag: W/"620ad3c1-d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fa09110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.min.css
cofense.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 62ms
59ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:21:29 GMT
server: cloudflare
age: 2034918
etag: W/"61ef2669-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fa39110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 styles.css
cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/ 5 KB
1015 B 84ms
79ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/styles.css?ver=2.3.7
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2029089
etag: W/"61ef26d4-1421"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fa99110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/css/ 10 KB
2 KB 51ms
46ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/css/style.css?ver=1645049484
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:24 GMT
server: cloudflare
age: 82367
etag: W/"620d768c-2678"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931faa9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 all.min.css
cofense.com/wp-content/plugins/download-manager/assets/fontawesome/css/ 56 KB
12 KB 64ms
60ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/fontawesome/css/all.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-dff5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fae9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/ 56 KB
10 KB 51ms
47ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-e1e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fb09110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front.css
cofense.com/wp-content/plugins/download-manager/assets/css/ 65 KB
12 KB 80ms
76ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 15:04:01 GMT
server: cloudflare
age: 689795
etag: W/"6203d7e1-10321"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fb19110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ihover.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
74 KB 96ms
90ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-6ae1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fb79110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
657 B 51ms
45ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:15 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d3-568"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fb99110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 font-awesome.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
7 KB 58ms
52ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:15 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d3-9226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217931fbd9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 page-list.css
cofense.com/wp-content/plugins/page-list/css/ 2 KB
626 B 84ms
78ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 15:03:59 GMT
server: cloudflare
age: 689795
etag: W/"6203d7df-60c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fde9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front.css
cofense.com/wp-content/plugins/simple-social-buttons/assets/css/ 96 KB
10 KB 79ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 14 Feb 2022 22:12:15 GMT
server: cloudflare
age: 203922
etag: W/"620ad3bf-17e39"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe09110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 t4bnewsticker.css
cofense.com/wp-content/plugins/t4b-news-ticker/assets/css/ 2 KB
704 B 64ms
57ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/t4b-news-ticker/assets/css/t4bnewsticker.css?v=1.2.3&ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-7d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe19110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 400 css
fonts.googleapis.com/ 0
0 75ms
27ms Stylesheet
text/html 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.googleapis.com/css?family&ver=1.4.5
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 font-awesome.min.css
cofense.com/wp-content/plugins/wp-floating-menu/css/font-awesome/ 30 KB
7 KB 79ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-floating-menu/css/font-awesome/font-awesome.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cfcdebf8f38725bebe6f58ff39a6d044806bca0220a1e0b7e3257f9ad7392d1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-7906"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe39110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 genericons.css
cofense.com/wp-content/plugins/wp-floating-menu/css/ 28 KB
16 KB 64ms
58ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-floating-menu/css/genericons.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-6e6a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe59110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front-end.css
cofense.com/wp-content/plugins/wp-floating-menu/css/ 44 KB
5 KB 79ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-floating-menu/css/front-end.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9b187b51d0f4969c50c20aa90c2452ee4f2a7b566dafde8e9164a0f7649fa89

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-b166"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe69110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 dashicons.min.css
cofense.com/wp-includes/css/ 58 KB
35 KB 72ms
66ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/css/dashicons.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:21:28 GMT
server: cloudflare
age: 2034918
etag: W/"61ef2668-e688"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fe99110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 vesper-icons.css
cofense.com/wp-content/plugins/wp-floating-menu/css/ 5 KB
1 KB 80ms
74ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-floating-menu/css/vesper-icons.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 320a9f05b4f381627902b628ce5e0b4b52faea13478a19098b77021d547c9169

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-1429"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932feb9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.min.css
cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/ 245 B
244 B 90ms
84ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbdc00cbfda953b528c24dbb0bf24357f6916cc7c3602b8e8dc09f7eb777eee8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 25 Jan 2022 22:10:20 GMT
server: cloudflare
age: 1926448
etag: W/"61f0754c-f5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fee9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chosen.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/ 10 KB
2 KB 78ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 15:03:57 GMT
server: cloudflare
age: 689795
etag: W/"6203d7dd-29ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932fef9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 search-filter.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/ 24 KB
5 KB 57ms
51ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:13 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d1-61cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ff09110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
13 KB 83ms
44ms Stylesheet
text/css 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

Referer: https://cofense.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 679529
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 9A9BAJKPW7V9ZXYC
x-amz-id-2: 9gzf6eNdkE6LJdyHuj94JLP+5yGV8c1E3BdG+pEJjSGrmP09zF77M51mmJ8KHMlF5sOfyakSneA=
last-modified: Wed, 30 Jun 2021 15:38:38 GMT
server: cloudflare
etag: W/"76cb46c10b6c0293433b371bae2414b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9DhtvGvMOt09iV1NtNX7NFQGbUF137a343ISEVNjjw5OGsXRL9xyhqermAaM7dB%2BGiLRsyFcDnZ76Bl35thye6DhCLaLzomj8U4Y24zX4yP1FoDooSxxwZKH2q0aGbOAn21G%2FHD6TY1DR9GF1AIFNix"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 6df217935e3991e4-FRA

GET
H2 200 js_composer.min.css
cofense.com/wp-content/plugins/js_composer/assets/css/ 449 KB
45 KB 80ms
74ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-70240"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ff29110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 pum-site-styles.css
cofense.com/wp-content/uploads/pum/ 21 KB
3 KB 57ms
52ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/uploads/pum/pum-site-styles.css?generated=1644270656&ver=1.7.30
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dfef5e0ce124a2dd7aa37c621392d01f8644b677a20e86ac4c5b9058b2c52f78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 07 Feb 2022 22:14:56 GMT
server: cloudflare
age: 857399
etag: W/"620199e0-54ed"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ff39110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 magnific-popup.min.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 78ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-1802"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ff49110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 animate.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 59ms
54ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-10cbc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ffb9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 5 KB
645 B 72ms
27ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

52a034771e615f209e16877f12a0d203a643b125de783f95342efaa9ffb80737

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 19:52:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Feb 2022 21:26:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H2 200 elegant-icons.min.css
cofense.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 88ms
83ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26ce-103d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ffc9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 owl.carousel.css
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 78ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26ce-577a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217932ffe9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 theme-styles.css
cofense.com/wp-content/themes/copro/css/ 608 KB
73 KB 77ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:13 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d1-980d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328009110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 theme-shortcodes.css
cofense.com/wp-content/themes/copro/css/ 28 KB
5 KB 78ms
74ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26ce-6f98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328019110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 custom-styles.css
cofense.com/wp-content/themes/copro/css/ 150 KB
23 KB 80ms
76ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa1ed22cf0302b8cd03329b5ed3aa83c395c624b85c72e8f683b9b8d2caf517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:18 GMT
server: cloudflare
age: 82367
etag: W/"620d7686-2560f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328069110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 wmx-styles.css
cofense.com/wp-content/themes/copro/css/ 5 KB
1 KB 121ms
117ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/wmx-styles.css?ver=1645049477
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7208f49c630621bb7bbb72fa5d5c4db1cbba9f07ba6bb4726746eaba5a0e8259

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:17 GMT
server: cloudflare
age: 82367
etag: W/"620d7685-1572"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328099110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 responsive.css
cofense.com/wp-content/themes/copro/css/ 102 KB
12 KB 89ms
84ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26ce-198c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793280a9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 select2.min.css
cofense.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 76ms
72ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:09 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cd-3aed"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793280b9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
cofense.com/wp-content/themes/copro/ 94 KB
17 KB 80ms
76ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f0f89916b6f2f912a1813ee5ef7acf4a95d7df852c88805e4a60411379acde8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 14 Feb 2022 22:12:12 GMT
server: cloudflare
age: 203922
etag: W/"620ad3bc-178aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793280e9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 24 KB
2 KB 70ms
26ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.8.3

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1bf5b1b16e02956377f2b4a2dda9eea5c5a4d1488137b2be48b3abc6b354090d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 20:18:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Feb 2022 21:26:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 81ms
44ms Stylesheet
text/css 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

Referer: https://cofense.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1338023
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: RCQZTE4FCYRV161H
x-amz-id-2: w+fCr38T+qIOWbAKYh1lmAB9QvVNblYSCBP0bui0pcV4OBFe5b74s+HZyACyqA0I4HU8wI1oAs0=
last-modified: Wed, 30 Jun 2021 15:38:38 GMT
server: cloudflare
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f28Bgr6WnY5aTeXaj6aNDSWtAhOTkhI1fVBsVEpn%2BAEC79mntidk68BCVkWgdHo%2FYgbyXeJL4msB7ltQW%2BAoJ5skB9LVbkxbJYjpScMim05xmfvy7iBbYk3FaydzvqaCNpBASBRTGIbRiER4905L72jz"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 6df217935e3a91e4-FRA

GET
H2 200 css
fonts.googleapis.com/ 24 KB
1 KB 80ms
37ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100italic%2C100%2C300italic%2C300%2C400italic%2C400%2C500italic%2C500%2C700italic%2C700%2C900italic%2C900&ver=5.8.3

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1bf5b1b16e02956377f2b4a2dda9eea5c5a4d1488137b2be48b3abc6b354090d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 21:26:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Feb 2022 21:26:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H2 200 jquery-1.12.4-wp.js Show response
cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/ 95 KB
34 KB 87ms
84ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-17a56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328119110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery-migrate-1.4.1-wp.js Show response
cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/ 23 KB
8 KB 78ms
75ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-5c79"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328139110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 bootstrap.bundle.min.js Show response
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/ 79 KB
23 KB 86ms
84ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.bundle.min.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-13b0a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328149110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front.js Show response
cofense.com/wp-content/plugins/download-manager/assets/js/ 39 KB
10 KB 77ms
74ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/js/front.js?ver=3.1.11
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-9a93"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328179110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chosen.jquery.min.js Show response
cofense.com/wp-content/plugins/download-manager/assets/js/ 51 KB
9 KB 78ms
75ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/download-manager/assets/js/chosen.jquery.min.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 27 Jan 2022 22:14:25 GMT
server: cloudflare
age: 1775000
etag: W/"61f31941-cbc3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328189110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 core.min.js Show response
cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 4 KB
2 KB 78ms
76ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/core.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-f5b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328199110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 script.js Show response
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 118ms
116ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:15 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d3-c1c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793281b9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 front.js Show response
cofense.com/wp-content/plugins/simple-social-buttons/assets/js/ 7 KB
2 KB 75ms
73ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/simple-social-buttons/assets/js/front.js?ver=3.2.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:12 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d0-1d3b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793281d9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.liscroll.js Show response
cofense.com/wp-content/plugins/t4b-news-ticker/assets/js/ 2 KB
1 KB 86ms
84ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/t4b-news-ticker/assets/js/jquery.liscroll.js?ver=1.2.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-98a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21793281f9110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 frontend.js Show response
cofense.com/wp-content/plugins/wp-floating-menu/js/ 5 KB
1 KB 86ms
84ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/wp-floating-menu/js/frontend.js?ver=1.4.5
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7cbb19c8e9c94642c93139f904110c031faffc6412879f6f2fdf146f67bd19e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:11 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cf-15b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328209110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 modernizr.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
4 KB 86ms
85ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-283b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179328219110-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 10 KB
5 KB 72ms
18ms Script
application/javascript 2600:9000:2156:4000:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:4000:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e2f40b3a8aaf4a2abb1987007547690206251ee187f7594db715cfaebad6b654

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:16:31 GMT
content-encoding: gzip
age: 614
x-cache: Hit from cloudfront
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 4284
access-control-allow-origin: *
last-modified: Wed, 09 Feb 2022 20:54:56 GMT
server: nginx
etag: "879749224dc6aafa8a42879dc68cad9f"
content-type: application/javascript; charset=UTF-8
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
cache-control: max-age=1200, public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: -P5aWL7TLE-zXl59rG8-T2BwbGHr2Kpvwdxr4aZpVXecFXB5DjXOXA==

GET
H2 200 css
fonts.googleapis.com/ 3 KB
588 B 78ms
36ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Rubik:400,500

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aaddef3be92e4d00c978a826eecfbc3cec372a49f87a49ee5064bd2769a11963

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 20:23:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Feb 2022 21:26:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 216 KB
73 KB 86ms
38ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3fe26b8ccc76fc4d27d76d1b30c667f11131fb9f5e691012abf94ff725541d1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74023
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 21:06:39 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H3 200 wp-emoji-release.min.js Show response
cofense.com/wp-includes/js/ 18 KB
5 KB 127ms
122ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:21:28 GMT
server: cloudflare
age: 2034918
etag: W/"61ef2668-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478386973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/ 256 KB
54 KB 112ms
71ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/lottie.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1218355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54959
timing-allow-origin: *
last-modified: Mon, 02 Nov 2020 04:51:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f9f9048-3ff8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ES4T19cOPD259TRp9h1W9%2Bsyz1fuDsu4tDR5n4lJH%2ByE6cIdIz6j7ewJZxynD6FFIHlJGDi%2Fmhf5EzlTr%2FIo883uUu2C1VuW1lVJy4O%2FSztrXjsijD97CvdMCdMFCWsyPBoMo547jwYf1zzsjPIiooUR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6df2179378de5b86-FRA
expires: Tue, 07 Feb 2023 21:26:06 GMT

GET
H2 200 iubenda_cons.js Show response
cdn.iubenda.com/cons/ 228 B
385 B 102ms
44ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e259d98d40ae247d8c1f7a77627a2a4957edb1e171d642b5fb65d33341d4ebde

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
last-modified: Thu, 17 Feb 2022 10:34:14 GMT
etag: "620e24a6-83"
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 131
expires: Fri, 18 Feb 2022 00:26:06 GMT

GET
H2 200 iubenda_cs.js Show response
cdn.iubenda.com/cs/ 591 B
562 B 106ms
49ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b7bf07619723b09c61449c27f9283a18d5bece588608f2b7932a1e0d6f1510ac

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
last-modified: Thu, 17 Feb 2022 10:34:01 GMT
etag: "620e2499-133"
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 307
expires: Fri, 18 Feb 2022 00:26:06 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
40 KB 112ms
65ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9319a38fda7d675755efe4ab0fff7e25db41c2dbdf72f9b11b608ed05c324d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40753
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 92 KB
36 KB 81ms
38ms Script
application/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-K29SPQM

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a977c1ccf0de7e4c8bb54167556ad16062075289fad71c4e1376b32077e45b70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36685
x-xss-protection: 0
last-modified: Thu, 17 Feb 2022 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 17 Feb 2022 21:26:06 GMT

GET
H3 200 cofense-logo.svg
cofense.com/wp-content/themes/copro/images/ 3 KB
1 KB 144ms
139ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 11 Feb 2022 22:16:52 GMT
server: cloudflare
age: 368371
etag: W/"6206e054-b20"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478476973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 Product-Icons_Protect_RED-small.png
cofense.com/wp-content/uploads/2022/01/ 4 KB
5 KB 145ms
139ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2022/01/Product-Icons_Protect_RED-small.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e060666c0ffa695f03f242e34acc4b1fed9029a1201d65d8e8fed823dfcb466d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 93129
cf-polished: origFmt=png, origSize=11536
content-disposition: inline; filename="Product-Icons_Protect_RED-small.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4562
last-modified: Tue, 15 Feb 2022 22:15:22 GMT
server: cloudflare
etag: "620c25fa-2d10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478496973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 cofense-cbfree.png
cofense.com/wp-content/uploads/2019/01/ 1 KB
1 KB 145ms
140ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 867ac884372c9972d7eb79534e0b54eec666b3650d876d3039d98b7c4d3d1797

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 368370
cf-polished: origFmt=png, origSize=3114
content-disposition: inline; filename="cofense-cbfree.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1172
last-modified: Fri, 11 Feb 2022 22:16:26 GMT
server: cloudflare
etag: "6206e03a-c2a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794784a6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 Product-Icons_SOURCE_RGB2_lms.png
cofense.com/wp-content/uploads/2021/06/ 926 B
1 KB 145ms
140ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/06/Product-Icons_SOURCE_RGB2_lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6656b81dfd8535c86090beb20ad5e8e07499ca97ca2a41111b2ecdfba2c0ec63

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 135635
cf-polished: origFmt=png, origSize=2244
content-disposition: inline; filename="Product-Icons_SOURCE_RGB2_lms.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 926
last-modified: Tue, 15 Feb 2022 22:15:34 GMT
server: cloudflare
etag: "620c2606-8c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794784e6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 cofense-reporter.png
cofense.com/wp-content/uploads/2019/01/ 1 KB
1 KB 145ms
140ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e326bc288939c65be14d1bbb438492338a4fbfd225199a02575469acff3e1f43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 368369
cf-polished: origFmt=png, origSize=2862
content-disposition: inline; filename="cofense-reporter.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1100
last-modified: Fri, 11 Feb 2022 22:16:26 GMT
server: cloudflare
etag: "6206e03a-b2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478506973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 cofense-triage.png
cofense.com/wp-content/uploads/2019/01/ 1 KB
2 KB 145ms
140ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f3140014b069aed6d165b4b1a29bf9836aff01662c24600c57d660f3ffd8aa1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 314821
cf-polished: origFmt=png, origSize=3076
content-disposition: inline; filename="cofense-triage.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1240
last-modified: Fri, 11 Feb 2022 22:16:26 GMT
server: cloudflare
etag: "6206e03a-c04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478516973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 cofense-vision.png
cofense.com/wp-content/uploads/2019/01/ 1 KB
1 KB 145ms
141ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0d35bcdbbb34bb81c88fa64187668ad0a0f0abbba5b8f3ee8701c1d090b2f09

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 135635
cf-polished: origFmt=png, origSize=2773
content-disposition: inline; filename="cofense-vision.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1054
last-modified: Tue, 15 Feb 2022 22:16:28 GMT
server: cloudflare
etag: "620c263c-ad5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478526973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 cofense-intelligence.png
cofense.com/wp-content/uploads/2019/01/ 1 KB
2 KB 146ms
141ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86d51c7e4430483add879db55577d1ed79e1718cd50142331cf0cb4a4ae0a5c6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 135635
cf-polished: origFmt=png, origSize=3124
content-disposition: inline; filename="cofense-intelligence.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1210
last-modified: Tue, 15 Feb 2022 22:16:28 GMT
server: cloudflare
etag: "620c263c-c34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478536973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 Validator_Nav_Icon_96x96.png
cofense.com/wp-content/uploads/2022/01/ 7 KB
7 KB 277ms
272ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2022/01/Validator_Nav_Icon_96x96.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49f5bd8445ae359c8eca7f2f73e22c66d3478bde0eaf7369645c38a9f34a2bec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:10:13 GMT
server: cloudflare
etag: "620d7645-1bb3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478556973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7091

GET
H3 200 cofense-pds.png
cofense.com/wp-content/uploads/2019/01/ 2 KB
2 KB 146ms
141ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb40e45d50cb26a920ac6fb1315e65f986b494b3ab213cc8b657dca2ab471e87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 368368
cf-polished: origFmt=png, origSize=4084
content-disposition: inline; filename="cofense-pds.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1578
last-modified: Fri, 11 Feb 2022 22:16:26 GMT
server: cloudflare
etag: "6206e03a-ff4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478576973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 protect-icon.png
cofense.com/wp-content/uploads/2021/07/ 2 KB
2 KB 146ms
142ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/07/protect-icon.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a2fe6914ce8a3720960d1b7d642a867c1294c17aa8ff4eb676e42087cff8ed6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 396420
cf-polished: origFmt=png, origSize=4188
content-disposition: inline; filename="protect-icon.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2138
last-modified: Fri, 11 Feb 2022 22:15:55 GMT
server: cloudflare
etag: "6206e01b-105c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478596973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 usa-flag.png
cofense.com/wp-content/uploads/flags/ 363 B
617 B 146ms
142ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/flags/usa-flag.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecb41a446898049a11e8d0bc0015b80486734ab9feca322382c933b74419828d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:10:12 GMT
server: cloudflare
age: 15626
etag: "620d7644-16b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794785a6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 363

GET
H3 200 linkedin.png
cofense.com/wp-content/uploads/2017/03/ 526 B
858 B 147ms
142ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2017/03/linkedin.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdb389a7933053f3de23a14717d5797ed4e25e617ce4d05f8021e17c9d2b9864

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 135635
cf-polished: origFmt=png, origSize=723
content-disposition: inline; filename="linkedin.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 526
last-modified: Tue, 15 Feb 2022 22:16:40 GMT
server: cloudflare
etag: "620c2648-2d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794785b6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 twitter.png
cofense.com/wp-content/uploads/2017/03/ 554 B
884 B 147ms
142ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2017/03/twitter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69f4b4b34a2fea095f7094ecbaaaf5fe656d989163c3850f179734b8595999f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 26448
cf-polished: origFmt=png, origSize=809
content-disposition: inline; filename="twitter.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 554
last-modified: Wed, 16 Feb 2022 22:11:06 GMT
server: cloudflare
etag: "620d767a-329"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794785c6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 youtube_circle-512.png
cofense.com/wp-content/uploads/2021/05/ 7 KB
7 KB 147ms
143ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/05/youtube_circle-512.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f8d426ab4dc525e19f34bee2d237f72fdedc34f40857f1ef76e0ea1c9bd2668

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 26448
cf-polished: origFmt=png, origSize=14476
content-disposition: inline; filename="youtube_circle-512.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7168
last-modified: Wed, 16 Feb 2022 22:10:21 GMT
server: cloudflare
etag: "620d764d-388c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794785e6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 facebook.png
cofense.com/wp-content/uploads/2017/03/ 488 B
819 B 150ms
146ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2017/03/facebook.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3999a205f552084a50e7ac2ec40a6b1c0f048a7aa55cade2fa650196a7e1c18

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 196069
cf-polished: origFmt=png, origSize=666
content-disposition: inline; filename="facebook.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 488
last-modified: Mon, 14 Feb 2022 22:11:59 GMT
server: cloudflare
etag: "620ad3af-29a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794785f6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 email-decode.min.js Show response
cofense.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
937 B 35ms
34ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://cofense.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Feb 2022 13:46:32 GMT
server: cloudflare
etag: W/"620d0038-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 6df217940f1b6973-FRA
vary: Accept-Encoding
expires: Sat, 19 Feb 2022 21:26:06 GMT

GET
H2 200 forms2.min.js Show response
get.cofense.com/js/forms2/js/ 205 KB
68 KB 236ms
48ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cofense.com/js/forms2/js/forms2.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 12 Jan 2022 18:47:30 GMT
server: cloudflare
age: 2160
etag: "2980e92-33210-5d567007b9480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 6df217954e845b9e-FRA
expires: Fri, 18 Feb 2022 01:26:06 GMT

GET
H3 200 Q3-2021-Cofense-Phishing-Review-Cover-200x260.png
cofense.com/wp-content/uploads/2021/10/ 63 KB
63 KB 277ms
273ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/10/Q3-2021-Cofense-Phishing-Review-Cover-200x260.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5e1c6ae644e02960bfb7b8c0d64fc68ea760d7bb4895e0c09a98c8548938ee1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:10:15 GMT
server: cloudflare
etag: "620d7647-fb49"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478626973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64329

GET
H3 200 style.min.css
cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/ 2 KB
770 B 46ms
44ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/style.min.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53a997bd51a3a1ad45ca16653c6044aa62fe3e120816276195538914db2c1dfd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:19 GMT
server: cloudflare
age: 22476
etag: W/"620d7687-6df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217946ff56973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 infobox.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 2 KB
867 B 109ms
106ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/infobox.css?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 19 Jan 2022 22:14:07 GMT
server: cloudflare
age: 2446203
etag: W/"61e88d2f-821"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df217946fff6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 swiped-events.min.js Show response
cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 2 KB
1 KB 56ms
50ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/js/swiped-events.min.js?ver=1.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:17 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d5-6e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478116973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 imagesloaded.min.js Show response
cofense.com/wp-includes/js/ 5 KB
2 KB 64ms
58ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 22:01:54 GMT
server: cloudflare
age: 2127971
etag: W/"61eb2d52-15fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478136973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 effect.min.js Show response
cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 13 KB
5 KB 90ms
83ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/effect.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:16 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d4-33d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478146973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 ditty-news-ticker.min.js Show response
cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 14 KB
3 KB 66ms
59ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ditty-news-ticker.min.js?ver=1645049483
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:23 GMT
server: cloudflare
age: 82994
etag: W/"620d768b-3670"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478166973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.form.min.js Show response
cofense.com/wp-includes/js/jquery/ 16 KB
6 KB 66ms
59ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.3.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dcbd9ddb813cf06084d60b6158da5289b9e33ba3f9e7c463fd20e7ec8462014

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:21:28 GMT
server: cloudflare
age: 2034918
etag: W/"61ef2668-3ef4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478186973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.t-countdown.js Show response
cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 109ms
102ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 09 Sep 2021 16:42:22 GMT
server: cloudflare
age: 13631447
etag: W/"613a396e-23d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478196973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 js_composer_front.min.js Show response
cofense.com/wp-content/plugins/js_composer/assets/js/dist/ 18 KB
6 KB 87ms
80ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:15 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26d3-49dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21794781e6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 position.min.js Show response
cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 6 KB
3 KB 110ms
103ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/position.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 22:03:40 GMT
server: cloudflare
age: 2127971
etag: W/"61eb2dbc-1952"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478206973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 pum-site-scripts.js Show response
cofense.com/wp-content/uploads/pum/ 51 KB
15 KB 111ms
104ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/uploads/pum/pum-site-scripts.js?defer&generated=1644270656&ver=1.7.30
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 846adcafc16c52d59dc55c02ca3b3ffa0bb2f19e9c94356982d622b95af3ba53

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 07 Feb 2022 22:14:56 GMT
server: cloudflare
age: 859695
etag: W/"620199e0-cd00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478236973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 wow.min.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 125ms
118ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 23 Aug 2021 21:10:19 GMT
server: cloudflare
age: 15361311
etag: W/"61240ebb-1ff6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478246973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 modules.min.js Show response
cofense.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
36 KB 111ms
105ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 06 Jan 2022 22:44:51 GMT
server: cloudflare
age: 3616200
etag: W/"61d770e3-1e4e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478266973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 owl.carousel.js Show response
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 172ms
166ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 1985607
etag: W/"61ef26ce-99c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478276973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.sticky.js Show response
cofense.com/wp-content/themes/copro/js/ 10 KB
3 KB 126ms
119ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:09 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cd-2765"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478286973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 custom.js Show response
cofense.com/wp-content/themes/copro/js/ 13 KB
4 KB 126ms
120ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/custom.js?ver=1645049477
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 248eda360e7a19602f644e608be85f727ea06cd57b455349e532b1aa153feaa4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:17 GMT
server: cloudflare
age: 82994
etag: W/"620d7685-33f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478296973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 theme-scripts.js Show response
cofense.com/wp-content/themes/copro/js/ 139 KB
40 KB 127ms
120ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 22:03:34 GMT
server: cloudflare
age: 2127971
etag: W/"61eb2db6-22de9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21794782b6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 select2.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 88ms
82ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:10 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26ce-10964"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21794782e6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.waypoints.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 65ms
59ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 21 Jan 2022 22:03:33 GMT
server: cloudflare
age: 2127971
etag: W/"61eb2db5-2344"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df21794782f6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 sticky.min.js Show response
cofense.com/wp-content/themes/copro/js/vendor/ 1 KB
840 B 127ms
121ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:23:09 GMT
server: cloudflare
age: 2034918
etag: W/"61ef26cd-4db"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478316973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 comment-reply.min.js Show response
cofense.com/wp-includes/js/ 3 KB
2 KB 128ms
121ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/comment-reply.min.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 03 Feb 2022 22:12:42 GMT
server: cloudflare
age: 1182979
etag: W/"61fc535a-ba8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478326973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 wp-embed.min.js Show response
cofense.com/wp-includes/js/ 1 KB
987 B 128ms
121ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-embed.min.js?ver=5.8.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Jan 2022 22:21:28 GMT
server: cloudflare
age: 2034918
etag: W/"61ef2668-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478346973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 script.min.js Show response
cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/ 449 B
543 B 244ms
238ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-dropdown/script.min.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b5fc18167c9bb2e3e5a3c27a8cf951a5d32770462a143b87989a5853d034dc8d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 16 Feb 2022 22:11:19 GMT
server: cloudflare
age: 21722
etag: W/"620d7687-1c1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6df2179478376973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 jquery.modal.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 5 KB
2 KB 51ms
24ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2035893
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1399
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-1359"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FgK245%2F9794WrJe0CqZmI22xtDuAXMn41q%2F9txwYs1omHkcfju5BLZqcHayMQuzN5whVOleusNAnkpUvp0cAZV16O4wgZiPmNQqjdZ9AP5fGHSxNGraXjc6PdNjncGbIxy0k1cKjS%2Fc%2B79BVCDV1r%2F7f"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6df217949c7e901f-FRA
expires: Tue, 07 Feb 2023 21:26:06 GMT

GET
H3 200 jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 3 KB
2 KB 52ms
26ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1777
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1541
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-c81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0R1pnDWxg12hRo2v2hvIVg33jkrpe%2Bq%2BXLmaF6PHpWT7knzfkjk1d5YHx%2Fig%2BZExW2ZOAyivZGvZDiFdlxMrjFaOFsAQB1sFmUgdM3T6EPn0RNrnUYTPbeI9SwZ11GxyfG25kftPmzYkZwW6ABRa9T8b"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6df217949c7a901f-FRA
expires: Tue, 07 Feb 2023 21:26:06 GMT

GET
H2 200 E-v1.js Show response
fast.wistia.net/assets/external/ 592 KB
112 KB 62ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/E-v1.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd76b2a49faf7ebdba125487bebec28e89c77673470cef9bf7add376ca77c823

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
vary: Accept-Encoding
age: 793
x-cache: HIT, HIT
content-length: 114421
x-served-by: cache-iad-kcgs7200106-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133167.840163,VS0,VE0
etag: "620aadc5-1bef5"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 38

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v26/ 46 KB
46 KB 92ms
47ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v26/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 06:13:05 GMT
x-content-type-options: nosniff
age: 227581
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47312
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 00:15:33 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 15 Feb 2023 06:13:05 GMT

GET
H3 200 nav-arrow.png
cofense.com/wp-content/themes/copro/images/ 144 B
477 B 146ms
146ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e02049ae3343b26a2f49d208a4edbe308c07957264f6cf933de55373a516024

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 368371
cf-polished: origFmt=png, origSize=2957
content-disposition: inline; filename="nav-arrow.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 144
last-modified: Fri, 11 Feb 2022 22:16:52 GMT
server: cloudflare
etag: "6206e054-b8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478636973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 icn-nav-search@2x.png
cofense.com/wp-content/themes/copro/images/ 584 B
923 B 146ms
146ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8432e6f4eb2fdd17b52483e38a7caae28aac4d35b8904521dcf7b062f9511a5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cf-cache-status: HIT
age: 368371
cf-polished: origFmt=png, origSize=1300
content-disposition: inline; filename="icn-nav-search@2x.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 584
last-modified: Fri, 11 Feb 2022 22:16:52 GMT
server: cloudflare
etag: "6206e054-514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478666973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 Wave-06.png
cofense.com/wp-content/uploads/2020/12/ 69 KB
69 KB 328ms
328ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2020/12/Wave-06.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 708096587b019f43c56a6eb77fec4de5b6cbdbd1211745d0f9557a31e0741552

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:10:25 GMT
server: cloudflare
etag: "620d7651-1138b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179478686973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70539

GET
H3 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 50ms
27ms Font
font/woff2 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
access-control-allow-methods: GET
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1979892
cf-ray: 6df21794ad0a9293-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 79444
x-amz-id-2: jZLtaRfJws0oGIko8yu96+gMK1QDIx/hCfiZGthS1SYPucL6HKbHj4QCT0qkwuzqN/2+mJCwbKY=
last-modified: Wed, 30 Jun 2021 15:39:01 GMT
server: cloudflare
etag: "b15db15f746f29ffa02638cb455b8ec0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zObiy12L4xgIabI3%2F3JMgWoC8wy9gIxwTcuSv1rkpVurl%2FvTzwCJMmfRsTxzaWV6mhHDe3ZFOGzPylgq5B9cmbsBHka1RIlvF4thARZTuov%2BfWhalh6h%2F2ppxUDaqN9fJNb3FsPqwdYJ07J%2F7hW3d7Oi"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: CE83PG0BGKCGY6WK
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
content-type: font/woff2

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 16 KB
16 KB 42ms
23ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.8.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 14:02:00 GMT
x-content-type-options: nosniff
age: 199446
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 15 Feb 2023 14:02:00 GMT

GET
H3 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
76 KB 67ms
44ms Font
font/woff2 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
access-control-allow-methods: GET
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1979891
cf-ray: 6df21794ad089293-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 76612
x-amz-id-2: EHAIW2UAOOV+bpUoC2B+3cGvZZIRJCwD6wDBJpfDLsexbT/b86diO35JzBIySa7ca+5l4t9gHa8=
last-modified: Wed, 30 Jun 2021 15:39:01 GMT
server: cloudflare
etag: "a06da7f0950f9dd366fc9db9d56d618a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FSGCazKDQqHzKlONwiVI0XZYRUg96rCdLZ%2Bba3nRRXIkrPsS1SbAI6JydqHw0D6bqNd8XdLBkFbQxq9BpppiwsPPOYQ69w%2FyfPFwnwzrJmEwAwT6dJYkxteXpYQ%2Bjn4UXmjVu3RS%2BtQJsqWTZBxWwr7n"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: 2QRMAS8EH0KWV496
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
content-type: font/woff2

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 54ms
36ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 98987
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Feb 2023 17:56:19 GMT

GET
H2 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 76ms
58ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 08:04:00 GMT
x-content-type-options: nosniff
age: 220926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15712
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 15 Feb 2023 08:04:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 36ms
18ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 09:48:03 GMT
x-content-type-options: nosniff
age: 560283
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 11 Feb 2023 09:48:03 GMT

GET
H2 200 KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 60ms
42ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ec2c7c341db456f2c057a73bdcc82be478efc0834741036198d9589765af6a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 21:26:48 GMT
x-content-type-options: nosniff
age: 259158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17016
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 14 Feb 2023 21:26:48 GMT

GET
H3 200 Email-Body-474x480.png
cofense.com/wp-content/uploads/2021/12/ 72 KB
72 KB 266ms
266ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/12/Email-Body-474x480.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2908d2879892a8b689eadfc9f128eaeaf5da64e741afccfc8081758e05dfa7c2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:10:14 GMT
server: cloudflare
etag: "620d7646-12060"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794b8be6973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 73824

GET
H3 200 Phishing-Landing-Page-480x231.png
cofense.com/wp-content/uploads/2021/12/ 25 KB
25 KB 215ms
215ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/12/Phishing-Landing-Page-480x231.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 898d104ad1ca7600c3aa62bb74c4d7c5391719d9504be1f46810646c50737332

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:10:14 GMT
server: cloudflare
etag: "620d7646-6220"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21794b8c26973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 25120

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/f41e75ff/ 148 KB
41 KB 64ms
20ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/f41e75ff/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 59b04a15dacf5d7c6befe6dd8f0c26a66bfab4ac12cf05b7d9acd177e22f5b03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 20:54:53 GMT
server: nginx
x-amz-request-id: NFB49KNGRGY1YFX2
etag: "88fa1ed2ddaaae4bf29d6c2a0672314d"
x-hw: 1645133166.cds154.fr8.hn,1645133166.cds155.fr8.c
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
content-length: 41836
x-amz-id-2: HePZJCSNFUOhrCXRPUbrxu5S1nhbgH3/YLE4IrdrYwEBjmZFAYqLDzXrMDSe198oV2+ZRwpicaU=

GET
H2 200 core-8fdcb29dc2a89f2172df78c5f7cb048f.js Show response
cdn.iubenda.com/cons/iubenda_cons/ 21 KB
6 KB 59ms
59ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons/core-8fdcb29dc2a89f2172df78c5f7cb048f.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3bb400d80bf9e313ba80cefff36a1c1268c5cab84caae0869af064c531aca74c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
last-modified: Thu, 17 Feb 2022 10:34:14 GMT
etag: "620e24a6-185c"
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 6236
expires: Fri, 17 Feb 2023 21:26:06 GMT

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 308ms
99ms XHR
application/json 54.197.98.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.197.98.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-197-98-98.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6c0a9d58396bf55f5e5d9de24812bc89ff26b92bdda1201a6a66c4c4de59ae92

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-client-geo-country: DE,Deutschland
date: Thu, 17 Feb 2022 01:33:09 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
content-length: 1723
server: nginx
x-client-geo-region: NW,Nordrhein-Westfalen
x-client-geo-metrocode
etag: W/"6c0a9d58396bf55f5e5d9de24812bc89"
access-control-max-age: 2000
x-client-geo-city: Gelsenkirchen
x-varnish: 706008330 689820059
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 45889
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 51.530500,7.114300

GET
H2 200 core-en.js Show response
cdn.iubenda.com/cookie_solution/iubenda_cs/1.36.2/ 271 KB
56 KB 48ms
41ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.36.2/core-en.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f694ce570f9785dd10d595f5c5f75821386fcac08c115eac501fc465f7135af4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
content-encoding: br
last-modified: Thu, 17 Feb 2022 10:33:41 GMT
etag: "620e2485-df69"
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 57193
expires: Fri, 17 Feb 2023 21:26:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 173 KB
63 KB 69ms
45ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6a5997a9741a3f64e591e0fee900dda3fea48f1f04b1f8a41a97b239c633c6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64852
x-xss-protection: 0
expires: Thu, 17 Feb 2022 21:26:07 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 6 KB
3 KB 83ms
47ms Script
application/javascript 143.204.98.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.29 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-29.fra50.r.cloudfront.net

Software

Resource Hash

80f9e3fad747d80b23122d4c2b9fba7eba5fb5031250f35962299846b1e88e6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: FRA50-C1
etag: W/0d7d43bed79db9367e118b22cf4542d8
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: iCZbuAcjEYcPm9OO6V35Fu80SH-Z-JAR4F2yA_QxGrtFd5pcd16fVA==
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1006 B
792 B 291ms
74ms Script
application/x-javascript 2a03:5f80:a::b212:e7c0
DATAIX-AS Peering...

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:5f80:a::b212:e7c0 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software: /
Resource Hash: 0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Feb 2022 18:48:07 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=76907
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 479

GET
H2 403 lt-v3.js
lltrck.com/scripts/ 0
0 308ms
100ms Script
text/html 52.20.96.200
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lltrck.com/scripts/lt-v3.js?llid=19612
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.96.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-96-200.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 50ms
17ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
last-modified: Sat, 05 Feb 2022 00:44:37 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kjyo7100029-IAD, cache-fra19170-FRA

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
477 B 243ms
192ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 6df21795dc179235-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length: 0

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 65ms
15ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 oktrk.js Show response
static.oktopost.com/ 9 KB
4 KB 79ms
17ms Script
application/javascript 143.204.98.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.oktopost.com/oktrk.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-123.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 16:26:55 GMT
content-encoding: gzip
last-modified: Mon, 27 Jan 2020 09:47:41 GMT
server: AmazonS3
age: 17953
etag: W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 fb8c0300277bd0137c1693d3d64ab550.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: yVXvb7zrR9owbcnhn1SNYVTVWtZWqew04OYZkiW-nakoQd7i9zs2dQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 60ms
18ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6674
date: Thu, 17 Feb 2022 19:34:53 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 17 Feb 2022 21:34:53 GMT

GET
H2 200 getForm Show response
get.cofense.com/index.php/form/ 7 KB
2 KB 345ms
345ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://get.cofense.com/index.php/form/getForm?munchkinId=404-JHU-612&form=1492&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&callback=jQuery1124012265274176923269_1645133166989&_=1645133166990
Requested by: Host: get.cofense.com
URL: https://get.cofense.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 817ca84a4f48e4933fe60737db0c211a29cc16cfe315ea0e89e78610c80674be

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6df21795cf805b9e-FRA
cached: true

GET
H3 200 b-g.png
cofense.com/wp-content/themes/copro/images/ 151 KB
151 KB 141ms
140ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c3de9c1a4366978fd4ae02d13201bebf8b3fb26d7703c053524297dcfb43ec6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1645049478
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
age: 128376
cf-polished: origFmt=png, origSize=860335
content-disposition: inline; filename="b-g.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 154598
last-modified: Tue, 15 Feb 2022 22:16:49 GMT
server: cloudflare
etag: "620c2651-d20af"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795ebba6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 i-mpdr-stop-attacks-8-min-510x240.jpg
cofense.com/wp-content/uploads/2021/05/ 23 KB
23 KB 50ms
50ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2021/05/i-mpdr-stop-attacks-8-min-510x240.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1487c3a6c11655bbcf61697254ee7032fabb6e6043fef5bd0d49f15db94b9f7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
age: 196034
cf-polished: origSize=32900, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23537
last-modified: Mon, 14 Feb 2022 22:11:14 GMT
server: cloudflare
etag: "620ad382-8084"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795ebbd6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 footer-graphic.png
cofense.com/wp-content/uploads/2016/07/ 2 KB
3 KB 44ms
44ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4be9115c018cb2338a736b6c12ec731db56dcc069088f0b1f41b7a0fdffb713

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
age: 368367
cf-polished: origFmt=png, origSize=3662
content-disposition: inline; filename="footer-graphic.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2464
last-modified: Fri, 11 Feb 2022 22:16:45 GMT
server: cloudflare
etag: "6206e04d-e4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795ebbf6973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 footer-graphic-b.png
cofense.com/wp-content/uploads/2016/07/ 212 B
459 B 188ms
188ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Feb 2022 22:11:09 GMT
server: cloudflare
etag: "620d767d-d4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795ebc06973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 212

GET
H3 200 footer-graphic-a.png
cofense.com/wp-content/uploads/2016/07/ 50 B
385 B 59ms
59ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18072bfe1772627d7a3c3a60e704e45d8e2c68b687db9c340b0a341c7b447476

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/style.css?ver=5.8.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
age: 385786
cf-polished: origFmt=png, origSize=107
content-disposition: inline; filename="footer-graphic-a.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 50
last-modified: Fri, 11 Feb 2022 22:16:45 GMT
server: cloudflare
etag: "6206e04d-6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795ebc16973-FRA
cf-bgj: imgq:100,h2pri

GET
H3 200 ssb-icon.ttf
cofense.com/wp-content/plugins/simple-social-buttons/assets/fonts/ 6 KB
6 KB 85ms
85ms Font
application/octet-stream 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-content/plugins/simple-social-buttons/assets/fonts/ssb-icon.ttf?eahqa2
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131

Request headers

Referer: https://cofense.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.4
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
last-modified: Thu, 03 Feb 2022 22:14:22 GMT
server: cloudflare
age: 1182980
etag: "61fc53be-17f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df21795fbd26973-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6136

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 44ms
19ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 17:58:32 GMT
x-content-type-options: nosniff
age: 98855
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Feb 2023 17:58:32 GMT

GET
H3 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 44ms
23ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 09:57:46 GMT
x-content-type-options: nosniff
age: 559701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17484
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 11 Feb 2023 09:57:46 GMT

GET
H2 200 76856514.js Show response
www.iubenda.com/cookie-solution/confs/js/ 63 B
450 B 37ms
29ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.iubenda.com/cookie-solution/confs/js/76856514.js

Requested by

Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.36.2/core-en.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-214-240.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=63072000
access-control-request-method: *
etag: "620e2f47-3f"
content-encoding: gzip
content-length: 69
last-modified: Thu, 17 Feb 2022 11:19:35 GMT
server: nginx
date: Thu, 17 Feb 2022 21:26:07 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Fri, 18 Feb 2022 21:26:07 GMT

GET
H2 200 3subrr6ozn Show response
fast.wistia.net/embed/iframe/ Frame AA82 22 KB
9 KB 18ms
18ms Document
text/html 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/embed/iframe/3subrr6ozn

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f2d67720bce2ad348402f350df0df47ff3fdf6a512915e6cd750b4111db791d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/

Response headers

access-control-allow-origin: *
cache-control: public, no-cache
content-encoding: br
content-type: text/html; charset=utf-8
etag: W/"f2d67720bce2ad348402f350df0df47f"
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
referrer-policy: strict-origin-when-cross-origin
timing-allow-origin: *
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-request-id: 3f777cd80c684ad49521ac2cff2a8f95
x-runtime: 0.060989
accept-ranges: bytes
date: Thu, 17 Feb 2022 21:26:07 GMT
age: 18710
x-served-by: cache-iad-kcgs7200132-IAD, cache-hhn4027-HHN
x-cache: HIT, HIT
x-cache-hits: 1, 1
x-timer: S1645133167.127757,VS0,VE1
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
strict-transport-security: max-age=0
x-ecma-v: modern
x-browser: chrome
x-browser-version: 98
content-length: 8935

POST
H2 200 e
analytics.shareaholic.com/ 43 B
377 B 313ms
101ms Ping
image/gif 54.236.80.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/f41e75ff/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.236.80.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-236-80-213.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 19ms
19ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cofense.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 09:29:12 GMT
x-content-type-options: nosniff
age: 561415
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17304
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 11 Feb 2023 09:29:12 GMT

GET
H2 200 getForm Show response
get.cofense.com/index.php/form/ 24 KB
5 KB 341ms
341ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://get.cofense.com/index.php/form/getForm?munchkinId=404-JHU-612&form=1378&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&callback=jQuery1124012265274176923269_1645133166991&_=1645133166992
Requested by: Host: get.cofense.com
URL: https://get.cofense.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 464a6faf227def5b5cc7e34f0ac97cf094371c483db65675d53e7a3531b769a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6df21796fa015b9e-FRA
cached: true

POST
H3 200 admin-ajax.php Show response
cofense.com/wp-admin/ 77 B
575 B 4804ms
4804ms XHR
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://cofense.com/wp-admin/admin-ajax.php

Requested by

Host: cofense.com
URL: https://cofense.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

c45cc031ebc4bd7cfc95286a542b4af08f05f998cd07829e888545f976b33b46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 17 Feb 2022 21:26:11 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: WP Engine
p3p: CP="NOI"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-robots-tag: noindex
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://cofense.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6df21796fe2a6973-FRA
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 16ms
16ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Sat, 28 May 2022 21:26:07 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 46 KB
15 KB 75ms
19ms Script
text/javascript 2600:9000:2156:4800:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:4800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d62a3b924d49cc3909d8c7e7d66c6fda8780c357fae0f927993f424928401b20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id: mLgRV7jYHDvB6wDphJKX5Q2F5vg5l49f
Content-Encoding: gzip
Etag: W/"b8caabe626e64605e61edd5174246bf4"
Age: 2065
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Last-Modified: Mon, 07 Feb 2022 16:47:41 GMT
Server: AmazonS3
Date: Thu, 17 Feb 2022 20:52:21 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: ZrZI_zbDusr3TRCoFGzDjuYLR6PGPWqm7lHOlZ0JEy3j6UVpMvDc4g==

GET
H2 200 modules.7d6d0311dc6eb2c0bc38.js Show response
script.hotjar.com/ 235 KB
62 KB 54ms
18ms Script
application/javascript 143.204.98.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-104.fra50.r.cloudfront.net

Software

Resource Hash

01dfdc130cd3e3b7ed01572613ea6552ab9819ca803c688076f850d06aa627a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 14:12:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26041
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 62769
access-control-allow-origin: *
last-modified: Thu, 17 Feb 2022 14:12:00 GMT
etag: "fb6a0182102480f4b418874ee97e7e39"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 0d37b2e69745cd9f0c5457fbf1a83128.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: rdyqrntIrjbeI6xJ-xOmRsHPRfhaOx8jctnWWk6d1JhVgjpjDwvSTQ==

GET
H2 200 ping Show response
okt.to/ 0
252 B 334ms
121ms Script
text/javascript 34.200.97.200
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://okt.to/ping?uri=%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&aid=001shx33p56dsdg&ts=1645133167268
Requested by: Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.200.97.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-97-200.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-type: text/javascript;charset=UTF-8

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 81ms
27ms XHR
text/plain 2a00:1450:400c:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-114787942-1&cid=1897341707.1645133167&jid=1453357357&gjid=1854793317&_gid=1224488670.1645133167&_u=YGBAgUABAAAAAE~&z=35163508

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 17 Feb 2022 21:26:07 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 43ms
17ms Image
image/gif 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=183679078&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&ul=en-us&de=UTF-8&dt=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgUAB~&jid=1453357357&gjid=1854793317&cid=1897341707.1645133167&tid=UA-114787942-1&_gid=1224488670.1645133167&gtm=2wg2g05RQ37KH&z=1910772350

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 00:46:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 74367
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 40ms
26ms Ping
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0HTW6C6HJS&gtm=2oe2g0&_p=183679078&sr=1600x1200&ul=en-us&cid=1897341707.1645133167&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&dt=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&sid=1645133166&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 84ms
37ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14879
x-xss-protection: 0
server: cafe
etag: 17635014576153706337
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 17 Feb 2022 21:26:07 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
459 B 167ms
132ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=148a8bf9-e515-407a-9b9d-037e1744be5c&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 115
date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
server: tsa_o
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: dd74ac449a4c14ac853e57e9e6177ef45e395d8bdabb6a55787f504bf1aa8dde
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H2 200 adsct
t.co/i/ 43 B
336 B 161ms
128ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=148a8bf9-e515-407a-9b9d-037e1744be5c&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 112
date: Thu, 17 Feb 2022 21:26:06 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 3fa9aad583d0773c014393ef2a5db4cd1db7a0d2ba404123f4dfbe0740f82de6
content-length: 43

GET
H2 200 iframeApi.js Show response
fast.wistia.net/assets/external/ 77 KB
20 KB 18ms
18ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/iframeApi.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1c622daaf5be22edd8c3286e95af9048a8caa62fc7887387f52e3dada51a2928

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 793
x-cache: HIT, HIT
content-length: 20068
x-served-by: cache-iad-kiad7000162-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133167.315833,VS0,VE0
etag: "620aadc5-4e64"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 4

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 311ms
102ms Script
application/javascript 107.20.140.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&cl=en-US&id_sync=cab26ee9-e9a2-4474-aa25-5420c239143c&minify=1&pvs=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/f41e75ff/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.140.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-20-140-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 box-acca23410e696f2ca3087d947271c3d0.html Show response
vars.hotjar.com/ Frame 8E4D 2 KB
1 KB 62ms
17ms Document
text/html 143.204.98.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-123.fra50.r.cloudfront.net
Software: /
Resource Hash: e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/

Response headers

content-type: text/html
content-length: 1044
date: Fri, 04 Feb 2022 08:52:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "6f65fac4e8efe167ff5132c0c54c5729"
last-modified: Fri, 04 Feb 2022 08:51:39 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 1DollZmktKaK_cCiRbWF3hgF4qsdqZSA-2N1p2sBQDx7A53EEr3h-w==
age: 1168441

GET
H2 200 insideIframe.js Show response
fast.wistia.net/assets/external/ Frame AA82 47 KB
13 KB 24ms
24ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/insideIframe.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/embed/iframe/3subrr6ozn

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

df981a01695742a1661653eedb6ee05ef84c79ada6eb8a4bedbbc6a981e25005

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 12799
x-served-by: cache-iad-kcgs7200154-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133167.341378,VS0,VE0
etag: "620aadc5-31ff"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 25

GET
H2 200 E-v1.js Show response
fast.wistia.net/assets/external/ Frame AA82 592 KB
112 KB 23ms
23ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/E-v1.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/embed/iframe/3subrr6ozn

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd76b2a49faf7ebdba125487bebec28e89c77673470cef9bf7add376ca77c823

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 793
x-cache: HIT, HIT
content-length: 114421
x-served-by: cache-iad-kcgs7200106-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133167.341484,VS0,VE0
etag: "620aadc5-1bef5"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 39

GET
H2 200 swatch
fast.wistia.net/embed/medias/3subrr6ozn/ Frame AA82 4 KB
4 KB 18ms
17ms Image
image/jpeg 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.net/embed/medias/3subrr6ozn/swatch

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/embed/iframe/3subrr6ozn

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a7afc437a25ed0ed4140e6c752258aaaf5cf853de67e5cecfba89ed3bab2e958

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
access-control-request-method: *
age: 19198
x-cache: HIT, HIT
content-disposition: inline
content-length: 4176
x-served-by: cache-iad-kcgs7200175-IAD, cache-hhn4027-HHN
access-control-allow-origin: *, *
x-browser-version: 98
last-modified: Wed, 20 Oct 2021 20:44:11 UTC
x-timer: S1645133167.355490,VS0,VE1
strict-transport-security: max-age=0
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
access-control-expose-headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
cache-control: public, no-cache, max-age=30808071
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 1

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 74ms
74ms Script
application/x-javascript 2a03:5f80:a::b212:e7c0
DATAIX-AS Peering...

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:5f80:a::b212:e7c0 , Russian Federation, ASN50952 (DATAIX-AS Peering Ltd., RU),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Feb 2022 23:50:54 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=11414
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

POST
H/1.1 200
OK visitWebPage
404-jhu-612.mktoresp.com/webevents/ 2 B
311 B 596ms
101ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://404-jhu-612.mktoresp.com/webevents/visitWebPage?_mchNc=1645133167366&_mchCn=&_mchId=404-JHU-612&_mchTk=_mch-cofense.com-1645133167365-52897&_mchHo=cofense.com&_mchPo=&_mchRu=%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 8edc1752-c88f-4200-bb6d-b39bf2ad950e

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 71ms
30ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-114787942-1&cid=1897341707.1645133167&jid=1453357357&_u=YGBAgUABAAAAAE~&z=2018491689

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 85ms
43ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-114787942-1&cid=1897341707.1645133167&jid=1453357357&_u=YGBAgUABAAAAAE~&z=2018491689

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.css
get.cofense.com/js/forms2/css/ 13 KB
3 KB 65ms
64ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cofense.com/js/forms2/css/forms2.css

Requested by

Host: get.cofense.com
URL: https://get.cofense.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2160
content-length: 2623
last-modified: Wed, 12 Jan 2022 18:47:30 GMT
server: cloudflare
etag: "2980ecb-3437-5d567007b9480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6df217982c3e5b9e-FRA
expires: Fri, 18 Feb 2022 01:26:07 GMT

GET
H2 200 forms2-theme-plain.css
get.cofense.com/js/forms2/css/ 828 B
368 B 39ms
39ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cofense.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: get.cofense.com
URL: https://get.cofense.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2160
content-length: 246
last-modified: Wed, 12 Jan 2022 18:47:30 GMT
server: cloudflare
etag: "2da087c-33c-5d567007b9480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6df217982c415b9e-FRA
expires: Fri, 18 Feb 2022 01:26:07 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js
https://s.adroll.com/j/exp/index.js

28 B
762 B

22ms
19ms

Script
application/javascript

2600:9000:2156:4800:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 2600:9000:2156:4800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id: VxC0v7SN4NsT_sJxZYoy27yA4ALlRfhC
Via: 1.1 ad46d498157a92ab1076f74db460670c.cloudfront.net (CloudFront)
Etag: "5816cced8568d223aa09d889f300692b"
Age: 11501
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28
Last-Modified: Mon, 18 Oct 2021 21:07:54 GMT
Server: AmazonS3
Date: Thu, 17 Feb 2022 18:14:27 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: zOmtU8fiVjeynxLzrAp0b2oaHn0lMtc1R5JyOL8_zl9WxzYuqSP2vg==

Redirect headers

Date: Thu, 17 Feb 2022 20:51:17 GMT
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Age: 2089
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: sFLfJkWVgPhTdZn9SWaBrHYyb1Kw3nQZk_CY2_9lvNylhTRPoIfcvA==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
733 B

23ms
19ms

Script
application/javascript

2600:9000:2156:4800:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 2600:9000:2156:4800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 72223
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Thu, 17 Feb 2022 01:23:23 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: sXb6CIJ2SzEPqfwndBCEjOwQoSc5K52oEBhJViWZBHrqBsSg4lgRlA==

Redirect headers

Date: Thu, 17 Feb 2022 15:31:19 GMT
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Age: 21287
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: _hnHA2AspaY3IK7VbvhhPz4eANCXgUbbZPJnGHwtOr47-oucPv_bag==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/ 0
786 B 27ms
19ms Script
text/javascript 2600:9000:2156:4800:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:4800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id: _2IVH7brrOua2wP4OZIsVSH_lngxkN4o
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 3541
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Sat, 12 Feb 2022 00:23:05 GMT
Server: AmazonS3
Date: Thu, 17 Feb 2022 21:25:00 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: NMb8VCsM2cqbW77velBzLmizqxq0HcvpqPK9O3dqez1oBZR-En4p_w==

POST
H2 204 write Show response
hits-i.iubenda.com/ 0
397 B 41ms
40ms XHR
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.36.2/core-en.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Referer: https://cofense.com/
Accept-Language: de-DE,de;q=0.9
Authorization: Basic aGl0czFfdTpoaXRzMV91cHdk
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
server: nginx
x-influxdb-build: OSS
access-control-allow-methods: DELETE, GET, OPTIONS, POST, PUT
access-control-allow-origin: https://cofense.com
access-control-expose-headers: Date, X-InfluxDB-Version, X-InfluxDB-Build
request-id: 381dd142-9038-11ec-af39-0242ac110003
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Length, Content-Type, X-CSRF-Token, X-HTTP-Method-Override
x-influxdb-version: 1.8.2
x-request-id: 381dd142-9038-11ec-af39-0242ac110003

OPTIONS
H2 204 write
hits-i.iubenda.com/ Frame 0
0 85ms
24ms Preflight
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Thu, 17 Feb 2022 21:26:07 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: *, authorization
access-control-max-age: 1728000
access-control-allow-credentials: true
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
2 KB 72ms
28ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1645133167465&cv=9&fst=1645133167465&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2g0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&tiba=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3a02fa2512045f32f2a651246c117f9928881355ce37ffe3ee96bd2b1336386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1098
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 wistia-mux.js Show response
fast.wistia.net/assets/external/ Frame AA82 132 KB
35 KB 17ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/wistia-mux.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f8e7798ef36d36df1886eb4900f3644d3eabd5ef406d7b6fa9b91c8da4844ec1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 35560
x-served-by: cache-iad-kjyo7100040-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133167.490278,VS0,VE0
etag: "620aadc5-8ae8"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 28

GET
H/1.1

200
OK

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1645133167486%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true&e_ipv6=AQJxqLFav...

0
496 B

344ms
123ms

Image
application/javascript

108.174.10.24
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true&e_ipv6=AQJxqLFavJXa0gAAAX8Jk_3BbSvdCMoAX63YcW0h8FJe86E3f32EOOrqq7Fo3-SiUsL7g-oULQD2iuUVzEN6Xas8udjJoQ
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 108.174.10.24 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-24.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:08 GMT
Server: Play
LinkedIn-Action: 1
Content-Type: application/javascript
X-LI-Proto: http/1.1
Connection: keep-alive
X-Li-Pop: prod-lva1-x
content-length: 0
X-LI-UUID: AAXYPWoc2DRXdsPeiopQhQ==
X-Li-Fabric: prod-lva1

Redirect headers

date: Thu, 17 Feb 2022 21:26:07 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D55D8411A5AE4944B1045BEE52B05D54 Ref B: FRAEDGE0908 Ref C: 2022-02-17T21:26:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1645133167486&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&liSync=true&e_ipv6=AQJxqLFavJXa0gAAAX8Jk_3BbSvdCMoAX63YcW0h8FJe86E3f32EOOrqq7Fo3-SiUsL7g-oULQD2iuUVzEN6Xas8udjJoQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXYPWoXEGNhKoNesUnpSA==

GET
H2 200 midrollLink-v2.js Show response
fast.wistia.net/assets/external/ Frame AA82 18 KB
6 KB 17ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/midrollLink-v2.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5e0a6733a1a1b44634b61a191a430dad0e56e3bda6b0c4653566e880327feb48

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 5984
x-served-by: cache-iad-kjyo7100110-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.517274,VS0,VE0
etag: "620aadc5-1760"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 2

GET
H2 200 captions.js Show response
fast.wistia.net/assets/external/ Frame AA82 143 KB
31 KB 18ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/captions.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a6a86ca7c205b3349493033f73219fe1707899f778ac3601b2217ada8f94d0e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 31975
x-served-by: cache-iad-kiad7000021-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.517351,VS0,VE0
etag: "620aadc5-7ce7"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 7

GET
H2 200 TFV7KNIV3VHWLJ6GAQ3KFT Show response
d.adroll.com/consent/check/ 395 B
866 B 133ms
39ms Script
application/javascript 52.209.209.218
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT?arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&_s=d0a347f1140876092a35ca23bd33bc08&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.209.218 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-209-218.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 22bf27053c9be50624b324acb976215909e9b84e86fc7a9a809b18391c47e69a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-type: application/javascript
content-length: 395
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 postRoll-v2.js Show response
fast.wistia.net/assets/external/ Frame AA82 79 KB
21 KB 17ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/postRoll-v2.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cfd8766a4bb8bca854dd836aef28ef6228534a7d8bac2f583ed0c780d4cdb7c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 21196
x-served-by: cache-iad-kcgs7200091-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.553543,VS0,VE0
etag: "620aadc5-52cc"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 3

GET
H2 200 XDFrame Show response
get.cofense.com/index.php/form/ Frame 51CF 2 KB
861 B 289ms
288ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cofense.com/index.php/form/XDFrame

Requested by

Host: get.cofense.com
URL: https://get.cofense.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af5c2182a8fe3937512ec685e9f1ef633c68bad4badda35872b52fcf2d137818

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6df217995e395b9e-FRA
content-encoding: gzip

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1312741/ 146 B
323 B 124ms
42ms XHR
application/json 34.255.23.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1312741/visit-data?sv=7
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.23.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-23-179.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bd50219667293fd4ee2c24ca0ab2140a609854fc6b1facb507cbf1d5d1a5effd

Request headers

Referer: https://cofense.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H3 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
64 B 55ms
28ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1645133167465&cv=9&fst=1645131600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&tiba=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&async=1&fmt=3&is_vtc=1&random=1797099160&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
64 B 56ms
29ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1645133167465&cv=9&fst=1645131600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa2g0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&tiba=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&async=1&fmt=3&is_vtc=1&random=1797099160&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 select_ui.png
cofense.com/wp-content/themes/copro/images/ 158 B
490 B 59ms
59ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cofense.com/wp-content/themes/copro/images/select_ui.png
Requested by: Host: cofense.com
URL: https://cofense.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8df799499f0457b64ce173f8bd9bc217471b6b06cec69f8a9cc3abda1eebfab9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/wp-content/themes/copro/css/theme-styles.css?ver=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cf-cache-status: HIT
age: 125858
cf-polished: origFmt=png, origSize=1085
content-disposition: inline; filename="select_ui.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 158
last-modified: Tue, 15 Feb 2022 22:16:49 GMT
server: cloudflare
etag: "620c2651-43d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6df2179a1ea56973-FRA
cf-bgj: imgq:100,h2pri

POST
H2 200 content Show response
ws3.hotjar.com/api/v2/sites/1312741/recordings/ 66 B
259 B 405ms
154ms XHR
application/json 54.229.132.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws3.hotjar.com/api/v2/sites/1312741/recordings/content
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.7d6d0311dc6eb2c0bc38.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.132.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-132-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f00898efda9da3b8fe042f1bd682b5736a28e354991e876fe6685eefeada1082

Request headers

Referer: https://cofense.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 playPauseLoadingControl.js Show response
fast.wistia.net/assets/external/ Frame AA82 59 KB
16 KB 17ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/playPauseLoadingControl.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

705df238a5ec0beb0caf8c639555a4d32d9de27d2cd3be715f639c625f23f7d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 16471
x-served-by: cache-iad-kiad7000058-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.779491,VS0,VE0
etag: "620aadc5-4057"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 30

GET
H2 200 OverlaysBehavior.js Show response
fast.wistia.net/assets/external/vulcanV2Player/behaviors/ Frame AA82 62 KB
17 KB 17ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/vulcanV2Player/behaviors/OverlaysBehavior.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b93e8fca35612dfbb260de94728b333fa9c495a2c7a5a5f168515be280c628a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 793
x-cache: HIT, HIT
content-length: 16651
x-served-by: cache-iad-kcgs7200077-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.789676,VS0,VE0
etag: "620aadc5-410b"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 120

GET
H2 200 3subrr6ozn.json Show response
fast.wistia.net/embed/captions/ Frame AA82 18 KB
7 KB 18ms
17ms Script
text/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/embed/captions/3subrr6ozn.json?callback=wistiajson1

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/captions.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3125b8436d3b63bac30ec039b8787db45dd79446d90721d79b6887fe104fbf9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 67
x-cache: MISS, HIT
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 6818
x-request-id: 2fcb6730bc19a1bc5448f4b8eac59bf7
x-served-by: cache-iad-kjyo7100092-IAD, cache-hhn4027-HHN
x-runtime: 0.016701
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1645133168.791388,VS0,VE1
etag: W/"3125b8436d3b63bac30ec039b8787db4"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 98
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 1

GET
H2 200 swatch
fast.wistia.net/embed/medias/3subrr6ozn/ Frame AA82 4 KB
4 KB 17ms
17ms Image
image/jpeg 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.net/embed/medias/3subrr6ozn/swatch

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a7afc437a25ed0ed4140e6c752258aaaf5cf853de67e5cecfba89ed3bab2e958

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
access-control-request-method: *
age: 19198
x-cache: HIT, HIT
content-disposition: inline
content-length: 4176
x-served-by: cache-iad-kcgs7200175-IAD, cache-hhn4027-HHN
access-control-allow-origin: *, *
x-browser-version: 98
last-modified: Wed, 20 Oct 2021 20:44:11 UTC
x-timer: S1645133168.813923,VS0,VE0
strict-transport-security: max-age=0
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
access-control-expose-headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
cache-control: public, no-cache, max-age=30808071
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 2

GET
H/1.1 200
OK 9b321a6a31eba67043654ccd4e7ed045.webp
embedwistia-a.akamaihd.net/deliveries/ Frame AA82 39 KB
39 KB 78ms
22ms Image
image/webp 2.16.186.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9b321a6a31eba67043654ccd4e7ed045.webp?image_crop_resized=640x360
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.18 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c95c93c82ee0f9b7dd8773bbd54249483d9857f6395449d50a6714c999295b8f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:07 GMT
Access-Control-Request-Method: *
surrogate-key: 9b321a6a31eba67043654ccd4e7ed045 thumbnail-delivery
Last-Modified: Wed, 20 Oct 2021 20:44:11 UTC
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: image/webp
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
Cache-Control: max-age=29778952
content-disposition: inline
Connection: keep-alive
Accept-Ranges: none
Content-Length: 39538

GET
H/1.1

200
OK

LZCH7AGKEBFGLOFOIHTG7Q.js Show response
s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/
Redirect Chain

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-sc...
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

3 KB
2 KB

19ms
19ms

Script
text/javascript

2600:9000:2156:4800:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 2600:9000:2156:4800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d02f6c104b9121daaab59ea633d75fd7211af55e4157dc4e4fe697ba06eaf5b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-Amz-Version-Id: MYQmjAIa_KnA1ZGPAs4ygj9T4jfkA4z1
Content-Encoding: gzip
Etag: W/"06eb0e11fa9129d31f2fefcc410b6857"
Age: 384
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
Last-Modified: Wed, 02 Feb 2022 19:26:59 GMT
Server: AmazonS3
Date: Thu, 17 Feb 2022 21:19:44 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: wOOe2vrPey3ZnrRq9uT_ElQ_0IAqALL5lSct5tHwEp54e7ewDnvR8A==

Redirect headers

date: Thu, 17 Feb 2022 21:26:07 GMT
x-segment-display-name: Visitors to Unsegmented Pages
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type: p
content-length: 0
pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.20.0
x-rule: *
x-segment-eid: LZCH7AGKEBFGLOFOIHTG7Q
location: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
cache-control: no-store, no-cache, must-revalidate
x-pixel-eid: JLU6TD3D6FA2JAELGSQWLD
x-segment-name: *
x-advertisable-eid: TFV7KNIV3VHWLJ6GAQ3KFT
x-conversion-currency

GET
H2 200 forms2.min.js Show response
get.cofense.com/js/forms2/js/ Frame 51CF 205 KB
68 KB 30ms
30ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.cofense.com/js/forms2/js/forms2.min.js

Requested by

Host: get.cofense.com
URL: https://get.cofense.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://get.cofense.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 12 Jan 2022 18:47:30 GMT
server: cloudflare
age: 2161
etag: "2980e92-33210-5d567007b9480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 6df2179b39cf5b9e-FRA
expires: Fri, 18 Feb 2022 01:26:07 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 55ms
18ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d.adroll.com
URL: https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&pv=1525989509.2580411&cookie=&adroll_s_ref=&keyw=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26236
x-xss-protection: 0
pragma: public
x-fb-debug: lBmSjyBqtuwALhgTvGo6b7FszJ39ZjipzZypnWBtOHZHuU2kJRlw08lVyklpSJ2hd66EckhE2yNJK1bIjHJ60Q==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 17 Feb 2022 21:26:07 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisabl...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167&C=1

43 B
1 KB

35ms
34ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167&C=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Feb 2022 21:26:08 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 17 Feb 2022 21:26:08 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 17 Feb 2022 21:26:08 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expiration=1676669167&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Thu, 17 Feb 2022 21:26:08 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expires=365

0
239 B

64ms
15ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expires=365
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&expires=365
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

sync
pixel.advertising.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/onevideo/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertis...
https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

0
124 B

18ms
18ms

Image
text/plain

52.58.50.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Server

52.58.50.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-58-50-64.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/55980/sync?uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
date: Thu, 17 Feb 2022 21:26:08 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertis...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

0
477 B

403ms
98ms

Image
text/plain

70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:08 GMT
Cache-Control: no-cache
X-TraceId: 5c81f18b369bf94b7f86dc858d3b256c
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 100
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertis...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...

42 B
591 B

105ms
24ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:06 GMT
cache-control: no-store, no-cache, private
x-lat: amspug013:0:388
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 212
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisa...
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

0
90 B

96ms
23ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 22063

Redirect headers

location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advert...
https://eb2.3lift.com/xuid?mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

37 B
353 B

18ms
18ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=4714&xuid=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
date: Thu, 17 Feb 2022 21:26:08 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

204

v1
ads.yahoo.com/cms/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
194 B

59ms
17ms

Image
text/plain

2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

location: https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 165
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://x.bidswitch.net/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

43 B
495 B

18ms
18ms

Image
image/gif

35.156.100.230
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Server: 35.156.100.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-100-230.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 17 Feb 2022 21:26:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
Date: Thu, 17 Feb 2022 21:26:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://ib.adnxs.com/setuid?entity=172&code=ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

43 B
1 KB

42ms
42ms

Image
image/gif

185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

HTTP/1.1

Server

185.33.221.53 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Feb 2022 21:26:08 GMT
X-Proxy-Origin: 217.114.215.131; 217.114.215.131; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ff2e29a4-a4dd-4c98-a204-177325ed9fce
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 17 Feb 2022 21:26:08 GMT
X-Proxy-Origin: 217.114.215.131; 217.114.215.131; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f9c3c9a7-2023-4e64-861e-e25f1d6d2801
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 out
d.adroll.com/cm/l/ 42 B
180 B 78ms
77ms Image
image/gif 52.209.209.218
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/l/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.209.218 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-209-218.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.20.0
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=fd3559fe349048c33d1b5d68854e42d4

43 B
274 B

63ms
27ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537103138&val=fd3559fe349048c33d1b5d68854e42d4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:08 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537103138&val=fd3559fe349048c33d1b5d68854e42d4
pragma: no-cache
date: Thu, 17 Feb 2022 21:26:07 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.20.0
content-length: 87
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=92995bcbc5240c4ef2fa7186fa42af37-1645133167813&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&advertisable=TF...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=_TVZ_jSQSMM9G11ohU5C1A
https://d.adroll.com/cm/g/in

42 B
538 B

39ms
39ms

Image
image/gif

52.209.209.218
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: H2
Server: 52.209.209.218 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-209-218.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:08 GMT
server: nginx/1.20.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hls_video.js Show response
fast.wistia.net/assets/external/engines/ Frame AA82 419 KB
98 KB 18ms
17ms Script
application/javascript 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/assets/external/engines/hls_video.js

Requested by

Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

eab609633d113323aea890fbc91dd9723b98518d6dc98b9f63a11ea3c60372b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
content-encoding: br
vary: Accept-Encoding
age: 794
x-cache: HIT, HIT
content-length: 100359
x-served-by: cache-iad-kjyo7100032-IAD, cache-hhn4027-HHN
access-control-allow-origin: *
x-browser-version: 98
last-modified: Mon, 14 Feb 2022 19:30:13 GMT
x-timer: S1645133168.938141,VS0,VE0
etag: "620aadc5-18807"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 22

GET
H2 200 blank.gif
fast.wistia.net/assets/images/ Frame AA82 1 KB
1 KB 17ms
17ms Image
image/gif 2a04:4e42:600::622
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.net/assets/images/blank.gif

Requested by

Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:600::622 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://fast.wistia.net/embed/iframe/3subrr6ozn
Origin: https://fast.wistia.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:07 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
age: 4394
x-cache: HIT, HIT
x-cache-hits: 1, 177
content-length: 1214
x-served-by: cache-iad-kcgs7200063-IAD, cache-hhn4027-HHN
x-browser-version: 98
last-modified: Thu, 17 Feb 2022 20:08:35 GMT
x-timer: S1645133168.998900,VS0,VE0
etag: "620eab43-4be"
strict-transport-security: max-age=0
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=315360000, public
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 204 x Show response
distillery.wistia.com/ Frame AA82 0
96 B 323ms
105ms XHR
text/plain 54.86.117.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://distillery.wistia.com/x
Requested by: Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.117.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-117-43.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fast.wistia.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Thu, 17 Feb 2022 21:26:08 GMT
cache-control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 414ms
102ms Script
application/javascript 18.232.28.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-6-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: d2a0ed3481f0594245bc42536efbad044afe679a3f5a7993eb09774b94dc305c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
content-encoding: gzip
X-Pardot-Route: 8f46b7608980401223b1d0300f1fdf0e
X-Pardot-LB: e95a292e477f6214c8e77c2cf881a7d3
last-modified: Thu, 17 Feb 2022 05:17:47 GMT
Server: PardotServer
etag: "1547-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=63072000
accept-ranges: bytes
content-length: 1950
expires: Sat, 17 Feb 2024 21:26:08 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 26ms
26ms Image
image/gif 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=OPT-K29SPQM&cv=26&t=ol&s=h2&h=2&p=opts&o=4000&l=208&q=22&f=101&e=93&i=57&d=-346&c=-207&hc=0&sr=0.050000&ps=0.012229737620654157&cb=226585627

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Feb 2022 21:26:08 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 mput Show response
pipedream.wistia.com/ Frame AA82 2 B
136 B 323ms
103ms XHR
text/plain 52.3.66.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pipedream.wistia.com/mput?topic=metrics
Requested by: Host: fast.wistia.net
URL: https://fast.wistia.net/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.66.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-66-26.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://fast.wistia.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 17 Feb 2022 21:26:08 GMT
content-length: 2
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=utf-8

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 72 B
533 B 128ms
128ms Script
text/html 18.232.28.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=Purchase%20Order%20Email%20Scam%20with%C2%A0Phishing%20Link%C2%A0%7C%20Fake%20Domain&url=https%3A%2F%2Fcofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.232.28.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-6-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 21:26:08 GMT
content-encoding: gzip
X-Pardot-Route: 403edde838d926b2f64a33ea88db7473
X-Pardot-LB: e95a292e477f6214c8e77c2cf881a7d3
Server: PardotServer
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
cache-control: max-age=63072000
content-length: 89
expires: Sat, 17 Feb 2024 21:26:08 GMT

Verdicts & Comments Add Verdict or Comment

251 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

53 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cofense.com/	1970-01-20 03:08:29	Name: _gcl_au Value: 1.1.765658756.1645133167
.cofense.com/	1970-01-20 18:30:05	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F%22%2C%22date%22%3A%222022-02-17%22%2C%22timestamp%22%3A1645133166958%7D
.cofense.com/	1970-01-20 00:58:54	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fbeware-purchase-order-scam-carries-phishing-link%2F%22%2C%22date%22%3A%222022-02-17%22%2C%22timestamp%22%3A1645133166958%7D
.get.cofense.com/	1970-01-20 00:58:54	Name: __cf_bm Value: N5vIS1KtBxR4fbHnp3kNGhl8eqEi21amSSvJpIwKKzs-1645133166-0-AevNiFhzaY7XEgi/BSD6ESBFXfB0jxxZiZheLazhki1uzYFhMTn/4NJX/MYSL5MmYMxfz24Ca1J7TT381kujwzU=
.ws.zoominfo.com/	1970-01-20 09:44:29	Name: visitorId Value: ac0cdd028cd43405b4b29dfe21dd9de92f2477809c0ad58774c94df6ea52d1de
.cofense.com/	1970-01-20 01:00:19	Name: _gid Value: GA1.2.1224488670.1645133167
.cofense.com/	1970-01-20 00:58:53	Name: _dc_gtm_UA-114787942-1 Value: 1
.cofense.com/	1970-01-20 18:30:05	Name: _ga_0HTW6C6HJS Value: GS1.1.1645133166.1.0.1645133166.0
.cofense.com/	1970-01-20 18:30:05	Name: _ga Value: GA1.1.1897341707.1645133167
.cofense.com/	1970-01-20 18:30:05	Name: _mkto_trk Value: id:404-JHU-612&token:_mch-cofense.com-1645133167365-52897
.t.co/	1970-01-20 18:30:05	Name: muc_ads Value: 42196421-90af-4f66-802a-bb6ab9318921
.twitter.com/	1970-01-20 18:30:05	Name: personalization_id Value: "v1_tAEBtA/7CI7u7HCJ50RQqg=="
.cofense.com/	1970-01-20 09:44:29	Name: _hjSessionUser_1312741 Value: eyJpZCI6IjIyNmQ2YjA4LWM0YmMtNTExYi05MTIyLWQ5ODE3NGI3MTgzNiIsImNyZWF0ZWQiOjE2NDUxMzMxNjczNjEsImV4aXN0aW5nIjpmYWxzZX0=
.cofense.com/	1970-01-20 00:58:54	Name: _hjFirstSeen Value: 1
cofense.com/	1970-01-20 00:58:53	Name: _hjIncludedInSessionSample Value: 1
.cofense.com/	1970-01-20 00:58:54	Name: _hjSession_1312741 Value: eyJpZCI6IjQ5ZGJmZTU5LTJjOTItNDY0ZS04ZTQ5LTA0NDJiZjc4NDM4YyIsImNyZWF0ZWQiOjE2NDUxMzMxNjc1ODQsImluU2FtcGxlIjp0cnVlfQ==
cofense.com/	1970-01-20 00:58:53	Name: _hjIncludedInPageviewSample Value: 1
.cofense.com/	1970-01-20 00:58:54	Name: _hjAbsoluteSessionInProgress Value: 0
okt.to/	1970-01-20 09:44:29	Name: oktgid Value: tMIwVwyFlaS8g3HoXXuPY3udfgQlrWgh
okt.to/	1969-12-31 23:59:59	Name: oktsid Value: W4vIfprahg70t866CY26VDXMDgoAy1b5
.linkedin.com/	1970-01-20 01:42:05	Name: UserMatchHistory Value: AQL1XSGPK1eouAAAAX8Jk_wJP7BfWdk1uDzu-2G2v2sPjsLErgXIU-Vuz1pzbi-AqMSsvWieq8aXvg
.linkedin.com/	1970-01-20 01:42:05	Name: AnalyticsSyncHistory Value: AQIWC2vgxmmCIQAAAX8Jk_wJPD0XNhnC6IVuAebtMcVykBLEWYOsTkL0APvnb8hWGA5fC_xT5mUOBvzBA7DMJA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 18:30:47	Name: bcookie Value: "v=2&433dcebc-c086-44e4-865d-19e0d51cde17"
.cofense.com/	1970-01-20 09:44:50	Name: __adroll_fpc Value: 92995bcbc5240c4ef2fa7186fa42af37-1645133167813
get.cofense.com/	1969-12-31 23:59:59	Name: BIGipServerab46web-nginx-app_https Value: !P7qwITtTl7ifUCjaQbCLRqc3TBcuiulJLIA7rS4lbYBb5aDBL4jlnCgRRxpcWHxGAonBZuAx/fs7I9I=
.cofense.com/	1970-01-20 09:44:29	Name: __ar_v4 Value: %7CTFV7KNIV3VHWLJ6GAQ3KFT%3A20220219%3A1%7CJLU6TD3D6FA2JAELGSQWLD%3A20220219%3A1%7CLZCH7AGKEBFGLOFOIHTG7Q%3A20220219%3A1
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 18:30:47	Name: bscookie Value: "v=1&202202172126078200a3ed-1cee-43f4-832b-b1b28eb1d8a6AQGcys7N9-KkSTENqeaGAiAEdp4PGo9t"
.linkedin.com/	1970-01-20 18:27:13	Name: li_gc Value: MTswOzE2NDUxMzMxNjc7MjswMjE7V86ixt0izdYI3aqP4/gmQJMr1W5v1JyrQ0D0u67E7g==
.advertising.com/	1970-01-20 09:45:55	Name: APID Value: UP38611f0b-9038-11ec-b216-06c5884cf368
.casalemedia.com/	1970-01-20 09:44:29	Name: CMID Value: Yg69cA45xKxOfvWG6M8CFgAA
.casalemedia.com/	1970-01-20 03:08:29	Name: CMPS Value: 3192
.3lift.com/	1970-01-20 03:08:29	Name: tluid Value: 76786795264907330094
.pubmatic.com/	1970-01-20 03:08:29	Name: KRTBCOOKIE_10 Value: 22808-ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ&KRTB&22883-ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
.pubmatic.com/	1970-01-20 01:42:05	Name: PugT Value: 1645133166
.pubmatic.com/	1970-01-20 03:08:29	Name: PUBMDCID Value: 3
.casalemedia.com/	1970-01-20 03:08:29	Name: CMPRO Value: 1172
.casalemedia.com/	1970-01-20 09:44:29	Name: CMRUM3 Value: 69620ebd702760ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
.casalemedia.com/	1970-01-20 01:00:19	Name: CMST Value: Yg69cGIOvXAA
.doubleclick.net/	1970-01-20 10:20:29	Name: IDE Value: AHWqTUlAwuwgrGENaY527UdMr8aQwiYPSb5matCK2fGuCxuHqfrAtYuJSih6j8B4KUA
.adnxs.com/	1970-01-20 03:08:29	Name: uuid2 Value: 2997566381487192960
d.adroll.com/	1970-01-20 10:27:41	Name: __adroll Value: fd3559fe349048c33d1b5d68854e42d4-g_1645133168-a_1645133167
.adroll.com/	1970-01-20 10:27:41	Name: __adroll_shared Value: fd3559fe349048c33d1b5d68854e42d4-g_1645133168-a_1645133167
.adnxs.com/	1970-01-20 03:08:29	Name: anj Value: dTM7k!M4/rD>6NRF']wIg2In1qiq?(!]tbPl@/@8$-^=$U_hBKD%T*n[.k7OFY/5dK1J8@:`Dy]CffrdZi^kdYpzn_[)SFVCyKUvX^UAnb0ffV3If)y3KL9D3I?+]=LEtm
.bidswitch.net/	1970-01-20 09:44:29	Name: tuuid Value: 850c80d5-d9dc-423e-a31b-527607428bac
.bidswitch.net/	1970-01-20 09:44:29	Name: c Value: 1645133168
.bidswitch.net/	1970-01-20 09:44:29	Name: tuuid_lu Value: 1645133168
.outbrain.com/	1970-01-20 03:08:29	Name: obuid Value: 8db46d4f-20cc-48a7-adbc-d5c809e44caa
.outbrain.com/	1970-01-20 01:42:05	Name: adrl Value: ZmQzNTU5ZmUzNDkwNDhjMzNkMWI1ZDY4ODU0ZTQyZDQ
.linkedin.com/	1970-01-20 01:00:19	Name: lidc Value: "b=VGST01:s=V:r=V:a=V:p=V:g=2539:u=1:x=1:i=1645133168:t=1645219568:v=2:sig=AQEcng0MAhAaoTRqqekRaKUln2DNaGmB"
cofense.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 59310736ca5011115006885a5e60bcdc
cofense.com/	1970-01-20 01:03:12	Name: redux_blast Value: 1645133170

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fonts.googleapis.com/css?family&ver=1.4.5 Message: Failed to load resource: the server responded with a status of 400 ()
other	warning	URL: https://cofense.com/blog/beware-purchase-order-scam-carries-phishing-link/(Line 4033) Message: Allow attribute will take precedence over 'allowfullscreen'.
network	error	URL: https://lltrck.com/scripts/lt-v3.js?llid=19612 Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

404-jhu-612.mktoresp.com
ads.yahoo.com
analytics.shareaholic.com
analytics.twitter.com
cdn.iubenda.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cofense.com
connect.facebook.net
d.adroll.com
distillery.wistia.com
dsms0mj1bbhn4.cloudfront.net
dsum-sec.casalemedia.com
eb2.3lift.com
embedwistia-a.akamaihd.net
fast.wistia.net
fonts.googleapis.com
fonts.gstatic.com
get.cofense.com
googleads.g.doubleclick.net
hits-i.iubenda.com
ib.adnxs.com
image2.pubmatic.com
in.hotjar.com
lltrck.com
m9m6e2w5.stackpathcdn.com
munchkin.marketo.net
okt.to
partner.shareaholic.com
pi.pardot.com
pipedream.wistia.com
pixel.advertising.com
pixel.rubiconproject.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.adroll.com
script.hotjar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
static.oktopost.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
us-u.openx.net
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
ws3.hotjar.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.iubenda.com
www.linkedin.com
www.shareaholic.net
x.bidswitch.net
104.111.214.240
104.111.234.67
104.17.73.206
104.244.42.3
104.244.42.5
107.20.140.231
108.174.10.24
13.248.245.213
141.193.213.20
141.226.228.48
142.250.185.162
143.204.98.104
143.204.98.123
143.204.98.29
151.101.12.157
151.139.128.11
178.62.192.243
18.232.28.189
185.33.221.53
185.64.189.110
192.28.144.124
2.16.186.18
2.18.234.21
216.58.212.162
2600:9000:2156:4000:c:d51b:4400:21
2600:9000:2156:4800:6:9280:1080:93a1
2606:4700::6810:125e
2606:4700::6810:a852
2620:1ec:21::14
2a00:1288:80:807::1
2a00:1450:4001:808::2003
2a00:1450:4001:808::2008
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2004
2a00:1450:4001:811::200e
2a00:1450:4001:82b::200a
2a00:1450:4001:831::2002
2a00:1450:4001:831::200e
2a00:1450:400c:c0b::9b
2a03:2880:f02d:12:face:b00c:0:3
2a03:5f80:a::b212:e7c0
2a04:4e42:600::622
2a06:98c1:3121::7
34.200.97.200
34.255.23.179
35.156.100.230
35.244.159.8
52.20.96.200
52.209.209.218
52.3.66.26
52.58.50.64
54.197.98.98
54.229.132.122
54.236.80.213
54.86.117.43
69.173.144.139
70.42.32.95
0055b9d0429e9c194b4aa6b5f49cbc2ec31a7220ee7c8c186a9ee951feabd482
014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5
01dfdc130cd3e3b7ed01572613ea6552ab9819ca803c688076f850d06aa627a0
083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
18072bfe1772627d7a3c3a60e704e45d8e2c68b687db9c340b0a341c7b447476
1bf5b1b16e02956377f2b4a2dda9eea5c5a4d1488137b2be48b3abc6b354090d
1c622daaf5be22edd8c3286e95af9048a8caa62fc7887387f52e3dada51a2928
1e02049ae3343b26a2f49d208a4edbe308c07957264f6cf933de55373a516024
1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230
22bf27053c9be50624b324acb976215909e9b84e86fc7a9a809b18391c47e69a
248eda360e7a19602f644e608be85f727ea06cd57b455349e532b1aa153feaa4
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
2908d2879892a8b689eadfc9f128eaeaf5da64e741afccfc8081758e05dfa7c2
2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87
2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be
2f8d426ab4dc525e19f34bee2d237f72fdedc34f40857f1ef76e0ea1c9bd2668
3125b8436d3b63bac30ec039b8787db45dd79446d90721d79b6887fe104fbf9a
320a9f05b4f381627902b628ce5e0b4b52faea13478a19098b77021d547c9169
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3bb400d80bf9e313ba80cefff36a1c1268c5cab84caae0869af064c531aca74c
3fe26b8ccc76fc4d27d76d1b30c667f11131fb9f5e691012abf94ff725541d1a
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
464a6faf227def5b5cc7e34f0ac97cf094371c483db65675d53e7a3531b769a3
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
49f5bd8445ae359c8eca7f2f73e22c66d3478bde0eaf7369645c38a9f34a2bec
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762
4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
52a034771e615f209e16877f12a0d203a643b125de783f95342efaa9ffb80737
539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1
53a997bd51a3a1ad45ca16653c6044aa62fe3e120816276195538914db2c1dfd
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
59b04a15dacf5d7c6befe6dd8f0c26a66bfab4ac12cf05b7d9acd177e22f5b03
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5cfcdebf8f38725bebe6f58ff39a6d044806bca0220a1e0b7e3257f9ad7392d1
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
5e0a6733a1a1b44634b61a191a430dad0e56e3bda6b0c4653566e880327feb48
5ec2c7c341db456f2c057a73bdcc82be478efc0834741036198d9589765af6a2
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131
6656b81dfd8535c86090beb20ad5e8e07499ca97ca2a41111b2ecdfba2c0ec63
69aaf64ca6bc5de1be389666770dd16765ca10ee8c1e6bc52d5cddbc98b011de
69f4b4b34a2fea095f7094ecbaaaf5fe656d989163c3850f179734b8595999f6
6c0a9d58396bf55f5e5d9de24812bc89ff26b92bdda1201a6a66c4c4de59ae92
6c3de9c1a4366978fd4ae02d13201bebf8b3fb26d7703c053524297dcfb43ec6
705df238a5ec0beb0caf8c639555a4d32d9de27d2cd3be715f639c625f23f7d6
708096587b019f43c56a6eb77fec4de5b6cbdbd1211745d0f9557a31e0741552
708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c
70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
7208f49c630621bb7bbb72fa5d5c4db1cbba9f07ba6bb4726746eaba5a0e8259
7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc
737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1
7dcbd9ddb813cf06084d60b6158da5289b9e33ba3f9e7c463fd20e7ec8462014
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
80f9e3fad747d80b23122d4c2b9fba7eba5fb5031250f35962299846b1e88e6b
817ca84a4f48e4933fe60737db0c211a29cc16cfe315ea0e89e78610c80674be
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
846adcafc16c52d59dc55c02ca3b3ffa0bb2f19e9c94356982d622b95af3ba53
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
867ac884372c9972d7eb79534e0b54eec666b3650d876d3039d98b7c4d3d1797
86d51c7e4430483add879db55577d1ed79e1718cd50142331cf0cb4a4ae0a5c6
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
898d104ad1ca7600c3aa62bb74c4d7c5391719d9504be1f46810646c50737332
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117
8df799499f0457b64ce173f8bd9bc217471b6b06cec69f8a9cc3abda1eebfab9
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9319a38fda7d675755efe4ab0fff7e25db41c2dbdf72f9b11b608ed05c324d3c
9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf
9a2fe6914ce8a3720960d1b7d642a867c1294c17aa8ff4eb676e42087cff8ed6
9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649
9f0f89916b6f2f912a1813ee5ef7acf4a95d7df852c88805e4a60411379acde8
9f3140014b069aed6d165b4b1a29bf9836aff01662c24600c57d660f3ffd8aa1
9fa1ed22cf0302b8cd03329b5ed3aa83c395c624b85c72e8f683b9b8d2caf517
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d35bcdbbb34bb81c88fa64187668ad0a0f0abbba5b8f3ee8701c1d090b2f09
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4be9115c018cb2338a736b6c12ec731db56dcc069088f0b1f41b7a0fdffb713
a6a5997a9741a3f64e591e0fee900dda3fea48f1f04b1f8a41a97b239c633c6c
a6a86ca7c205b3349493033f73219fe1707899f778ac3601b2217ada8f94d0e8
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2
a7afc437a25ed0ed4140e6c752258aaaf5cf853de67e5cecfba89ed3bab2e958
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
a977c1ccf0de7e4c8bb54167556ad16062075289fad71c4e1376b32077e45b70
aaddef3be92e4d00c978a826eecfbc3cec372a49f87a49ee5064bd2769a11963
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
af5c2182a8fe3937512ec685e9f1ef633c68bad4badda35872b52fcf2d137818
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3999a205f552084a50e7ac2ec40a6b1c0f048a7aa55cade2fa650196a7e1c18
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b5fc18167c9bb2e3e5a3c27a8cf951a5d32770462a143b87989a5853d034dc8d
b7bf07619723b09c61449c27f9283a18d5bece588608f2b7932a1e0d6f1510ac
b93e8fca35612dfbb260de94728b333fa9c495a2c7a5a5f168515be280c628a6
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
bd50219667293fd4ee2c24ca0ab2140a609854fc6b1facb507cbf1d5d1a5effd
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c1487c3a6c11655bbcf61697254ee7032fabb6e6043fef5bd0d49f15db94b9f7
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7
c45cc031ebc4bd7cfc95286a542b4af08f05f998cd07829e888545f976b33b46
c5e1c6ae644e02960bfb7b8c0d64fc68ea760d7bb4895e0c09a98c8548938ee1
c7cbb19c8e9c94642c93139f904110c031faffc6412879f6f2fdf146f67bd19e
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
c95c93c82ee0f9b7dd8773bbd54249483d9857f6395449d50a6714c999295b8f
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cb40e45d50cb26a920ac6fb1315e65f986b494b3ab213cc8b657dca2ab471e87
cbdc00cbfda953b528c24dbb0bf24357f6916cc7c3602b8e8dc09f7eb777eee8
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd76b2a49faf7ebdba125487bebec28e89c77673470cef9bf7add376ca77c823
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
cfd8766a4bb8bca854dd836aef28ef6228534a7d8bac2f583ed0c780d4cdb7c0
d02f6c104b9121daaab59ea633d75fd7211af55e4157dc4e4fe697ba06eaf5b8
d2a0ed3481f0594245bc42536efbad044afe679a3f5a7993eb09774b94dc305c
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1
d62a3b924d49cc3909d8c7e7d66c6fda8780c357fae0f927993f424928401b20
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
df981a01695742a1661653eedb6ee05ef84c79ada6eb8a4bedbbc6a981e25005
dfef5e0ce124a2dd7aa37c621392d01f8644b677a20e86ac4c5b9058b2c52f78
e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19
e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265
e060666c0ffa695f03f242e34acc4b1fed9029a1201d65d8e8fed823dfcb466d
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e0f23d16bb40b894855d19e097cc0b9f4695b98a7db1fed18625cfb1ce8bda35
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406
e259d98d40ae247d8c1f7a77627a2a4957edb1e171d642b5fb65d33341d4ebde
e2f40b3a8aaf4a2abb1987007547690206251ee187f7594db715cfaebad6b654
e326bc288939c65be14d1bbb438492338a4fbfd225199a02575469acff3e1f43
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
eab609633d113323aea890fbc91dd9723b98518d6dc98b9f63a11ea3c60372b4
ecb41a446898049a11e8d0bc0015b80486734ab9feca322382c933b74419828d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f00898efda9da3b8fe042f1bd682b5736a28e354991e876fe6685eefeada1082
f2d67720bce2ad348402f350df0df47ff3fdf6a512915e6cd750b4111db791d4
f3a02fa2512045f32f2a651246c117f9928881355ce37ffe3ee96bd2b1336386
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f694ce570f9785dd10d595f5c5f75821386fcac08c115eac501fc465f7135af4
f8432e6f4eb2fdd17b52483e38a7caae28aac4d35b8904521dcf7b062f9511a5
f8e7798ef36d36df1886eb4900f3644d3eabd5ef406d7b6fa9b91c8da4844ec1
f9b187b51d0f4969c50c20aa90c2452ee4f2a7b566dafde8e9164a0f7649fa89
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
fdb389a7933053f3de23a14717d5797ed4e25e617ce4d05f8021e17c9d2b9864
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

cofense.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

215 Requests

93 %HTTPS

33 %IPv6

46 Domains

60 Subdomains

55 IPs

8 Countries

2777 kBTransfer

9223 kBSize

53 Cookies

16 Outgoing links

Redirected requests

215 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cofense.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

215
Requests

93 %
HTTPS

33 %
IPv6

46
Domains

60
Subdomains

55
IPs

8
Countries

2777 kB
Transfer

9223 kB
Size

53
Cookies

215 HTTP transactions
0 data transactions