labs.sentinelone.com Open in urlscan Pro
2620:12a:8001::3  Public Scan

42 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

• https://cloud.typography.com/7197018/6979812/css/fonts.css HTTP 302
• https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css

Request Chain 76

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1620747552044%26url%3Dhttps%253A%252F%252Flabs.sentinelone.com%252Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&liSync=true&e_ipv6=AQIHiIQOqxHqmAAAAXlcFQm14NKfBxVrWeINJgiQf8guG2OfPg9yHGH7VXrFvqLHYxEBV4FW

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/	98 KB 26 KB	2280ms 2239ms	Document text/html	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2f683ecdbb5c5ca502ab20d3fbbcd3056f7a3974ce8310096acc8fb936600cf9 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :method GET :authority labs.sentinelone.com :scheme https :path /purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers cache-control public, max-age=600 cf-edge-cache cache,platform=wordpress content-encoding gzip content-type text/html; charset=UTF-8 link <https://labs.sentinelone.com/wp-json/>; rel="https://api.w.org/" <https://labs.sentinelone.com/wp-json/wp/v2/posts/27501>; rel="alternate"; type="application/json" <https://labs.sentinelone.com/?p=27501>; rel=shortlink server nginx set-cookie pvc_visits[0]=1620833948b27501; expires=Wed, 12-May-2021 15:39:08 GMT; Max-Age=86400; path=/; secure; HttpOnly strict-transport-security max-age=300 x-pantheon-styx-hostname styx-fe3-a-84464c49f8-5cz9x x-pingback https://labs.sentinelone.com/xmlrpc.php x-styx-req-id 0665c7b0-b26f-11eb-951e-fa6dafc547e1 date Tue, 11 May 2021 15:39:10 GMT x-served-by cache-mdw17365-MDW, cache-fra19149-FRA x-cache MISS, MISS x-cache-hits 0, 0 x-timer S1620747548.276790,VS0,VE2226 vary Accept-Encoding, Cookie, Cookie age 0 accept-ranges bytes via 1.1 varnish, 1.1 varnish
GET H2	200	style.min.css labs.sentinelone.com/wp-includes/css/dist/block-library/	50 KB 10 KB	14ms 13ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/css/dist/block-library/style.min.css?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5c2288ca7b324881faae5e368eb4d69457e2784e042e868de335d3827bb90981 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/css/dist/block-library/style.min.css?ver=660a951873600c5f9b6f4e2588e1174b pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60713987-c8e9" age 2687375 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-pxd4m x-cache HIT, HIT content-length 9895 x-served-by cache-mdw17351-MDW, cache-fra19149-FRA last-modified Sat, 10 Apr 2021 05:37:11 GMT server nginx x-timer S1620747551.535864,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Mon, 11 Apr 2022 13:09:35 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id ff3ce4a3-99fd-11eb-8cc4-3241f098aabf x-cache-hits 1, 1
GET H2	200	styles.css labs.sentinelone.com/wp-content/plugins/contact-form-7/includes/css/	2 KB 1 KB	14ms 13ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash fbf8ab57db7f9981bd71d79c7daaa01a3c578ffa0aa8e9b4a9b2bfe2e9927427 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.3.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60713986-780" age 2666615 x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm x-cache HIT, HIT content-length 783 x-served-by cache-mdw17368-MDW, cache-fra19149-FRA last-modified Sat, 10 Apr 2021 05:37:10 GMT server nginx x-timer S1620747551.536291,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Mon, 11 Apr 2022 18:55:35 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 55761459-9a2e-11eb-b2ab-da1a83e8ae90 x-cache-hits 1, 1
GET H2	200	style.css labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/	4 KB 1 KB	14ms 12ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/style.css?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 61fd30b9ee3933d916d6a53b10d7100e3ece7d6760ccbaa6ed41499c1daf0a07 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/style.css?ver=660a951873600c5f9b6f4e2588e1174b pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6090070a-11a3" age 647316 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-7l75w x-cache MISS, HIT content-length 1255 x-served-by cache-mdw17335-MDW, cache-fra19149-FRA last-modified Mon, 03 May 2021 14:22:02 GMT server nginx x-timer S1620747551.536245,VS0,VE0 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Thu, 05 May 2022 03:50:34 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id e17d2252-ac8b-11eb-9981-6a95877c33eb x-cache-hits 0, 2666
GET H2	200	font-awesome.min.css labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/font-awesome/css/	28 KB 8 KB	15ms 13ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/font-awesome/css/font-awesome.min.css?ver=1.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 6f005368978df37b680de2dc8a22007a600378ba5568a573432a3fdeb8bdb674 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/meks-flexible-shortcodes/css/font-awesome/css/font-awesome.min.css?ver=1.3.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60934e0f-7189" age 469719 x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm x-cache MISS, HIT content-length 7496 x-served-by cache-mdw17326-MDW, cache-fra19149-FRA last-modified Thu, 06 May 2021 02:01:51 GMT server nginx x-timer S1620747551.536727,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 05:10:31 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 61145e1a-ae29-11eb-b2ab-da1a83e8ae90 x-cache-hits 0, 1
GET H2	200	simple-line-icons.css labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/	11 KB 3 KB	16ms 14ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/simple-line-icons.css?ver=1.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f293486948d4cba26c6b835bdd574b4085e62da749b86019f5f6fab3535b0e39 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/meks-flexible-shortcodes/css/simple-line/simple-line-icons.css?ver=1.3.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6092ec8f-2d25" age 487125 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-p7kjx x-cache HIT, HIT content-length 2502 x-served-by cache-mdw17321-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 19:05:51 GMT server nginx x-timer S1620747551.537188,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 00:20:24 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id da18f5b9-ae00-11eb-b835-a6502054c70c x-cache-hits 1, 1
GET H2	200	style.css labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/	15 KB 3 KB	16ms 13ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/css/style.css?ver=1.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4bc4b508bb0ccc41052f6a18eb23441543da2d209c152f62577e954367b4d62d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/meks-flexible-shortcodes/css/style.css?ver=1.3.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6092ec8f-3c15" age 496928 x-pantheon-styx-hostname styx-fe3-a-655dc95778-w8j4l x-cache HIT, HIT content-length 3306 x-served-by cache-mdw17335-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 19:05:51 GMT server nginx x-timer S1620747551.537574,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Fri, 06 May 2022 21:37:02 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 076364db-adea-11eb-814b-2e53d52f95a9 x-cache-hits 1, 1
GET H2	200	dashicons.min.css labs.sentinelone.com/wp-includes/css/	58 KB 36 KB	16ms 14ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/css/dashicons.min.css?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 8273f0538929ede9599e3cfea8142a252a7d0cb6dbacb230bf188490dde79d4b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/css/dashicons.min.css?ver=660a951873600c5f9b6f4e2588e1174b pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60923738-e682" age 496928 x-pantheon-styx-hostname styx-fe3-a-655dc95778-w8j4l x-cache HIT, HIT content-length 36699 x-served-by cache-mdw17336-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 06:12:08 GMT server nginx x-timer S1620747551.538192,VS0,VE2 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Fri, 06 May 2022 21:37:02 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 076e4fc4-adea-11eb-814b-2e53d52f95a9 x-cache-hits 1, 1
GET H2	200	frontend.css labs.sentinelone.com/wp-content/plugins/post-views-counter/css/	289 B 453 B	16ms 13ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/post-views-counter/css/frontend.css?ver=1.3.3 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f46d96d805c7e9e467422dfe516c43edb4632c0273cea26722fee7ba885f869e Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/post-views-counter/css/frontend.css?ver=1.3.3 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"608882c3-121" age 1177091 x-pantheon-styx-hostname styx-fe3-a-655dc95778-6l4g9 x-cache HIT, HIT content-length 201 x-served-by cache-mdw17348-MDW, cache-fra19149-FRA last-modified Tue, 27 Apr 2021 21:31:47 GMT server nginx x-timer S1620747551.539028,VS0,VE0 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Fri, 29 Apr 2022 00:40:59 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 66d4e736-a7ba-11eb-bd20-821926e29a3f x-cache-hits 1, 2647
GET H2	200	tp_twitter_plugin.css labs.sentinelone.com/wp-content/plugins/recent-tweets-widget/	529 B 519 B	26ms 23ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"606ebd03-211" age 2797498 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-tl5lp x-cache HIT, HIT content-length 286 x-served-by cache-mdw17357-MDW, cache-fra19149-FRA last-modified Thu, 08 Apr 2021 08:21:23 GMT server nginx x-timer S1620747551.538976,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sun, 10 Apr 2022 06:34:12 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 993100a8-98fd-11eb-b2d2-9e32a43b7522 x-cache-hits 1, 1
GET H2	200	asiana.plugins.css labs.sentinelone.com/wp-content/themes/asiana/assets/css/	114 KB 26 KB	26ms 23ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a470dd851d641f475025281f279294e780b628d7ce461dc1d136c4fc9982eeab Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"608039a4-1c669" age 1667712 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-pxd4m x-cache HIT, HIT content-length 26859 x-served-by cache-mdw17374-MDW, cache-fra19149-FRA last-modified Wed, 21 Apr 2021 14:41:40 GMT server nginx x-timer S1620747551.539588,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sat, 23 Apr 2022 08:23:58 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 15afb8cb-a344-11eb-8cc4-3241f098aabf x-cache-hits 1, 1
GET H2	200	style.css labs.sentinelone.com/wp-content/themes/asiana-child/	200 B 436 B	26ms 23ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana-child/style.css?ver=1.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a499f48ecde7f3facc8bca422454fdd01015a0dc66ec7a6b9cbe0892aae09dbc Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana-child/style.css?ver=1.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60934e0f-c8" age 450892 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-p7kjx x-cache HIT, HIT content-length 163 x-served-by cache-mdw17354-MDW, cache-fra19149-FRA last-modified Thu, 06 May 2021 02:01:51 GMT server nginx x-timer S1620747551.539575,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 10:24:18 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 372b6656-ae55-11eb-b835-a6502054c70c x-cache-hits 1, 1
GET H2	200	css fonts.googleapis.com/	2 KB 633 B	17ms 14ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=IBM+Plex+Sans:500 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 5c865b8026135aabaa6557abc3f20052a6276d9c9e4397d1fcec5af34471b116 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 11 May 2021 15:39:10 GMT server ESF date Tue, 11 May 2021 15:39:10 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 11 May 2021 15:39:10 GMT
GET H2	200	css fonts.googleapis.com/	2 KB 627 B	16ms 14ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Raleway:600 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cb44dbfbce007c5a31d1206af3520d7287ebe545508edbf0e9ebd789ed26d1bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 11 May 2021 13:53:31 GMT server ESF date Tue, 11 May 2021 15:39:10 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 11 May 2021 15:39:10 GMT
GET H2	200	style.css labs.sentinelone.com/wp-content/themes/asiana-child/	200 B 467 B	27ms 24ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana-child/style.css Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a499f48ecde7f3facc8bca422454fdd01015a0dc66ec7a6b9cbe0892aae09dbc Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana-child/style.css pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6092ec94-c8" age 448895 x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm x-cache HIT, HIT content-length 163 x-served-by cache-mdw17322-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 19:05:56 GMT server nginx x-timer S1620747551.540255,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 10:57:35 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id dd5c2366-ae59-11eb-b2ab-da1a83e8ae90 x-cache-hits 1, 1
GET H2	200	overlay.css app.cdn.lookbookhq.com/libraries/overlay/	632 B 965 B	85ms 26ms	Stylesheet text/css	13.224.193.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.cdn.lookbookhq.com/libraries/overlay/overlay.css Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-87.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 19a299c21eda40ac6ccd1d311b72bd8b781c69457badcfbb8d046ce9b856fa91 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-version-id null via 1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront) last-modified Fri, 07 Aug 2020 13:53:51 GMT server AmazonS3 age 88110 etag "6f1a49aa92489534fe143cc98cf2d3f0" x-cache Hit from cloudfront content-type text/css date Mon, 10 May 2021 19:14:22 GMT x-amz-cf-pop FRA2-C1 accept-ranges bytes content-length 632 x-amz-cf-id -OvCZeH1Q_jKcFj4xKO3FdbMqrRCKqNtksHxYAdMAXP3dy8j2okHyA==
GET H2	200	tomorrow-night-blue.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.10/styles/	630 B 560 B	18ms 15ms	Stylesheet text/css	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.10/styles/tomorrow-night-blue.min.css Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e4aafb4988825fef255b33b8a5f04fc98f7c77151704e6dc74ec3cb5cb85fd06 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1585316 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 238 cf-request-id 09fdae174500004aa3ee156000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e7a-276" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XH0Nk8Vo5Mz6yGrDBvQ8pGjFW6oNFidWNRjtReSpOCNu4DafdltCrAwRfAyRb4v%2BAUy2lCpLpmvHqfSBuuzqOcfhNEhGT5TSBxB%2FouHqRGjp9hYL61ssck2KKPeI0R84Pg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 64dc7f9edfbd4aa3-FRA expires Sun, 01 May 2022 15:39:10 GMT
GET H2	200	2EC96BA1F5C4837D6.css www.sentinelone.com/fonts/804059/ Redirect Chain https://cloud.typography.com/7197018/6979812/css/fonts.css https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css	104 KB 80 KB	42ms 13ms	Stylesheet text/css	2620:12a:8001::2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"609911f9-1a12c" age 64709 x-pantheon-styx-hostname styx-fe2-b-d65d59d6b-568bv x-cache HIT, HIT content-length 81369 x-served-by cache-mdw17344-MDW, cache-hhn4061-HHN last-modified Mon, 10 May 2021 10:59:05 GMT server nginx x-timer S1620747552.620632,VS0,VE0 date Tue, 11 May 2021 15:39:11 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Wed, 11 May 2022 21:40:43 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 5f0b304c-b1d8-11eb-ab43-d22b8ecde9c3 x-cache-hits 1, 2 Redirect headers Date Tue, 11 May 2021 15:39:11 GMT Last-Modified Tue, 01 Dec 2020 05:53:09 GMT Server AkamaiNetStorage ETag "899001ab6b567a7d825fb8979f065c90:1614555950.059262" Content-Type text/html Location https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css Cache-Control must-revalidate, private Connection keep-alive X-HCo-pid 16 Content-Length 154 Expires Tue, 11 May 2021 15:39:11 GMT
GET H2	200	style.min.css labs.sentinelone.com/wp-content/themes/asiana-child/assets/css/	127 KB 24 KB	27ms 25ms	Stylesheet text/css	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana-child/assets/css/style.min.css?ver=1620740758 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 06a44434b60e5bcbe674ed28a720bbf5b5ef536c78208b8888664814c911e166 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana-child/assets/css/style.min.css?ver=1620740758 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"609a8a96-1fc3f" age 6783 x-pantheon-styx-hostname styx-fe3-a-84464c49f8-bbmcq x-cache HIT, HIT content-length 24811 x-served-by cache-mdw17354-MDW, cache-fra19149-FRA last-modified Tue, 11 May 2021 13:45:58 GMT server nginx x-timer S1620747551.540293,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type text/css via 1.1 varnish, 1.1 varnish expires Thu, 12 May 2022 13:46:07 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 3c7b5ec2-b25f-11eb-a11f-5eabd668333e x-cache-hits 2, 1
GET H2	200	jquery.min.js Show response labs.sentinelone.com/wp-includes/js/jquery/	87 KB 35 KB	28ms 26ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/jquery/jquery.min.js?ver=3.5.1 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"608010a0-15d98" age 1704065 x-pantheon-styx-hostname styx-fe3-a-655dc95778-n6x5p x-cache HIT, HIT content-length 36073 x-served-by cache-mdw17333-MDW, cache-fra19149-FRA last-modified Wed, 21 Apr 2021 11:46:40 GMT server nginx x-timer S1620747551.540740,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Fri, 22 Apr 2022 22:18:05 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 7200b0f7-a2ef-11eb-b072-e2013244f13b x-cache-hits 1, 1
GET H2	200	jquery-migrate.min.js Show response labs.sentinelone.com/wp-includes/js/jquery/	11 KB 5 KB	34ms 32ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"608fde48-2bd8" age 688796 x-pantheon-styx-hostname styx-fe3-a-655dc95778-n6x5p x-cache HIT, HIT content-length 4565 x-served-by cache-mdw17360-MDW, cache-fra19149-FRA last-modified Mon, 03 May 2021 11:28:08 GMT server nginx x-timer S1620747551.547437,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Wed, 04 May 2022 16:19:15 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 4d974443-ac2b-11eb-b072-e2013244f13b x-cache-hits 1, 1
GET H2	200	script.js Show response labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/scripts/	6 KB 2 KB	34ms 32ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/scripts/script.js?ver=1.0.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ce901532c3b54288f4bbbaf16b5e8e78ea9e99942526fc3cb59035d6590972fa Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/invitations-for-slack/invitations-for-slack/scripts/script.js?ver=1.0.2 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6082e7b3-19f1" age 1534694 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-tnhhj x-cache HIT, HIT content-length 2180 x-served-by cache-mdw17370-MDW, cache-fra19149-FRA last-modified Fri, 23 Apr 2021 15:28:51 GMT server nginx x-timer S1620747551.547417,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sun, 24 Apr 2022 21:20:55 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id ca5b3197-a479-11eb-a23e-56e349bf8523 x-cache-hits 1, 1
GET H2	200	forms2.min.js Show response go.sentinelone.com/js/forms2/js/	204 KB 68 KB	117ms 34ms	Script application/x-javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/js/forms2/js/forms2.min.js Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:10 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Wed, 28 Apr 2021 17:50:01 GMT server cloudflare age 2932 etag "c20a88-33187-5c10c0201e440" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 64dc7f9f6c73fa3c-AMS cf-request-id 09fdae179e0000fa3cc7bcf000000001 expires Tue, 11 May 2021 19:39:10 GMT
GET H2	200	overlay.js Show response app.cdn.lookbookhq.com/libraries/overlay/	4 KB 2 KB	84ms 26ms	Script application/javascript	13.224.193.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.cdn.lookbookhq.com/libraries/overlay/overlay.js Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-87.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash b3f187f345fd1fcb61a6e62e813655dad81a4d1f0a093ac53e6bc7b2c5ad70c5 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip last-modified Fri, 07 Aug 2020 13:53:50 GMT server AmazonS3 age 46395 etag W/"a31bfe025c4d20585edfb2d6b5670638" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront) date Tue, 11 May 2021 02:47:35 GMT x-amz-cf-pop FRA2-C1 x-amz-cf-id iYEo6_jdC9tyPDFABmZ46-QpXtmFlR94Hgx0dLD0FZtNGmg-9KWOZw==
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.10/	49 KB 18 KB	16ms 14ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.10/highlight.min.js Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d73bbedc19cb615f4b76263ce6e5ccce28b76ddae47a5ca9dfb7b46724c0421d Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2096098 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 17935 cf-request-id 09fdae174500004aa3f6a25000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e7a-c343" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WhhyFGA%2F3%2BBNY1ivwStWMEK5o59drczv%2B0%2FDlAViH0uULibcLAa48xjMm0TI0ohRN%2FpOtwyqXsvSDSXJqBXKO3RqAqjpdTnHbmN7l%2BmjVBa3lsWRw5o3Yd0BybqMTkXMwA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 64dc7f9edfc54aa3-FRA expires Sun, 01 May 2022 15:39:10 GMT
GET H2	200	header.min.js Show response labs.sentinelone.com/wp-content/themes/asiana-child/assets/js/	530 B 592 B	33ms 32ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana-child/assets/js/header.min.js?ver=1620740758 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 11233c4d27cad4d258971e55ab2cc2839ff8944145879100028c780f4a4f7f62 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana-child/assets/js/header.min.js?ver=1620740758 pragma no-cache cookie pvc_visits[0]=1620833948b27501 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60999404-212" age 6783 x-pantheon-styx-hostname styx-fe3-a-84464c49f8-xs49c x-cache HIT, HIT content-length 363 x-served-by cache-mdw17326-MDW, cache-fra19149-FRA last-modified Mon, 10 May 2021 20:13:56 GMT server nginx x-timer S1620747551.547394,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Thu, 12 May 2022 13:46:07 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 3c7b203e-b25f-11eb-8dd1-d657a49e6bf4 x-cache-hits 4, 1
GET H2	200	js Show response www.googletagmanager.com/gtag/	88 KB 35 KB	23ms 23ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-38175129-3 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash deb3c1550465356e3cbffe4feb55043b837a76b442841e12c2cef8c541bc0e96 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:10 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35809 x-xss-protection 0 last-modified Tue, 11 May 2021 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 11 May 2021 15:39:10 GMT
GET H2	200	SentinelLabs_Logo_RGB_WhitePurp.png labs.sentinelone.com/wp-content/uploads/2019/10/	5 KB 6 KB	13ms 13ms	Image image/png	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/10/SentinelLabs_Logo_RGB_WhitePurp.png Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 72fc1a57801612f9e297e1c1954410ff840c40e713a6b4b40b2596e80338c2ee Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/10/SentinelLabs_Logo_RGB_WhitePurp.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-15ff" age 3208962 x-cache HIT, HIT x-cache-hits 1, 1 content-length 5631 x-served-by cache-mdw17377-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747551.843972,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT content-type image/png x-styx-req-id 95a2f157-953f-11eb-8cc4-3241f098aabf expires Tue, 05 Apr 2022 12:16:29 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-7cd6446558-pxd4m
GET H2	200	Purple-Fox-EK-_-New-CVEs-Steganography-and-Virtualization-Added-to-Attack-Flow-7-1140x597.jpg labs.sentinelone.com/wp-content/uploads/2020/10/	42 KB 42 KB	15ms 15ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2020/10/Purple-Fox-EK-_-New-CVEs-Steganography-and-Virtualization-Added-to-Attack-Flow-7-1140x597.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f0132be65b6f717f29a85c22dde4473e5a5f224c15c2b6327bc4a52cddfc8fff Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2020/10/Purple-Fox-EK-_-New-CVEs-Steganography-and-Virtualization-Added-to-Attack-Flow-7-1140x597.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5f8db92a-a6a3" age 378536 x-cache HIT, HIT x-cache-hits 1, 1 content-length 42659 x-served-by cache-mdw17333-MDW, cache-fra19149-FRA last-modified Mon, 19 Oct 2020 16:04:58 GMT server nginx x-timer S1620747551.859805,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT content-type image/jpeg x-styx-req-id aea0cbe7-aefd-11eb-8a92-c6c9361fb80f expires Sun, 08 May 2022 06:30:14 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-6bc65477fd-wgrqv
GET H2	200	wp-emoji-release.min.js Show response labs.sentinelone.com/wp-includes/js/	14 KB 5 KB	15ms 14ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/wp-emoji-release.min.js?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/wp-emoji-release.min.js?ver=660a951873600c5f9b6f4e2588e1174b pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60923738-3795" age 494307 x-pantheon-styx-hostname styx-fe3-a-655dc95778-6l4g9 x-cache HIT, HIT content-length 5269 x-served-by cache-mdw17369-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 06:12:08 GMT server nginx x-timer S1620747551.876558,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Fri, 06 May 2022 22:20:43 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 21d02881-adf0-11eb-bd20-821926e29a3f x-cache-hits 1, 1
GET H2	200	scripts.js Show response labs.sentinelone.com/wp-content/plugins/contact-form-7/includes/js/	14 KB 5 KB	13ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.3.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 125ec330f66081e7dc9f2814e9ec18f4e2d0baa1936d497375eedfda7ac12e5c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.3.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6092ec8e-37c8" age 419938 x-pantheon-styx-hostname styx-fe3-b-6bc65477fd-lpzzk x-cache HIT, HIT content-length 4664 x-served-by cache-mdw17377-MDW, cache-fra19149-FRA last-modified Wed, 05 May 2021 19:05:50 GMT server nginx x-timer S1620747551.687779,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 19:00:12 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 48d6ad64-ae9d-11eb-ad39-8a9bf3b3884e x-cache-hits 1, 1
GET H2	200	main.js Show response labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/js/	7 KB 2 KB	14ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/plugins/meks-flexible-shortcodes/js/main.js?ver=1 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 02007cb9ea5401983a0a4a34d08c1a57c75484d0852194291e124c94b848d474 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/meks-flexible-shortcodes/js/main.js?ver=1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"605bd6d8-1d0b" age 4076575 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-t9x9n x-cache HIT, HIT content-length 1804 x-served-by cache-mdw17349-MDW, cache-fra19149-FRA last-modified Thu, 25 Mar 2021 00:18:32 GMT server nginx x-timer S1620747551.703549,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sat, 26 Mar 2022 11:16:15 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 83ebf629-8d5b-11eb-91f9-fe18c7d5de17 x-cache-hits 1, 1
GET H2	200	imagesloaded.min.js Show response labs.sentinelone.com/wp-includes/js/	5 KB 2 KB	13ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/imagesloaded.min.js?ver=4.1.4 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60934e0f-15fd" age 466475 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-p7kjx x-cache HIT, HIT content-length 2009 x-served-by cache-mdw17320-MDW, cache-fra19149-FRA last-modified Thu, 06 May 2021 02:01:51 GMT server nginx x-timer S1620747551.718063,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 06:04:35 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id ef2d7b22-ae30-11eb-b835-a6502054c70c x-cache-hits 1, 1
GET H2	200	masonry.min.js Show response labs.sentinelone.com/wp-includes/js/	24 KB 9 KB	13ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/masonry.min.js?ver=4.2.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/masonry.min.js?ver=4.2.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60939a5b-5e4a" age 453127 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-pxd4m x-cache HIT, HIT content-length 8545 x-served-by cache-mdw17370-MDW, cache-fra19149-FRA last-modified Thu, 06 May 2021 07:27:23 GMT server nginx x-timer S1620747551.732169,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sat, 07 May 2022 09:47:03 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 0338043a-ae50-11eb-8cc4-3241f098aabf x-cache-hits 1, 1
GET H2	200	asiana.plugins.js Show response labs.sentinelone.com/wp-content/themes/asiana/assets/js/	87 KB 29 KB	19ms 18ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana/assets/js/asiana.plugins.js?ver=1.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash cbebe3409c4b01d23203045bc734370a192e3aa978c4ca2670bcd39ae0b2f45b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana/assets/js/asiana.plugins.js?ver=1.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60773af2-15d86" age 2263999 x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm x-cache HIT, HIT content-length 29227 x-served-by cache-mdw17379-MDW, cache-fra19149-FRA last-modified Wed, 14 Apr 2021 18:56:50 GMT server nginx x-timer S1620747551.751887,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Sat, 16 Apr 2022 10:45:51 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id bee78853-9dd7-11eb-b2ab-da1a83e8ae90 x-cache-hits 1, 1
GET H2	200	asiana.main.min.js Show response labs.sentinelone.com/wp-content/themes/asiana/assets/js/	4 KB 2 KB	14ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana/assets/js/asiana.main.min.js?ver=1.2 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b69fc240082ae0bcb2a8b08627a084fbbdd50d56ebd72a6125d0d4730c0ee0e1 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana/assets/js/asiana.main.min.js?ver=1.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"607bee18-f1b" age 1947896 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-wbctq x-cache HIT, HIT content-length 1514 x-served-by cache-mdw17367-MDW, cache-fra19149-FRA last-modified Sun, 18 Apr 2021 08:30:16 GMT server nginx x-timer S1620747551.769346,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Wed, 20 Apr 2022 02:34:14 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id bb4b422d-a0b7-11eb-ba3b-3656de3c1f9f x-cache-hits 1, 1
GET H2	200	footer.min.js Show response labs.sentinelone.com/wp-content/themes/asiana-child/assets/js/	10 KB 4 KB	13ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana-child/assets/js/footer.min.js?ver=1620740758 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 56ed164d2e62d13088db37cb5c8f4d2850e1db160c985376216e7dab96ae9253 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana-child/assets/js/footer.min.js?ver=1620740758 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"609a8a96-298a" age 6784 x-pantheon-styx-hostname styx-fe3-b-6bc65477fd-lpzzk x-cache HIT, HIT content-length 4202 x-served-by cache-mdw17324-MDW, cache-fra19149-FRA last-modified Tue, 11 May 2021 13:45:58 GMT server nginx x-timer S1620747551.784230,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Thu, 12 May 2022 13:46:07 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 3c8e922c-b25f-11eb-ad39-8a9bf3b3884e x-cache-hits 1, 1
GET H2	200	wp-embed.min.js Show response labs.sentinelone.com/wp-includes/js/	1 KB 1005 B	13ms 13ms	Script application/x-javascript	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-includes/js/wp-embed.min.js?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-includes/js/wp-embed.min.js?ver=660a951873600c5f9b6f4e2588e1174b pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"60852a53-592" age 1347366 x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm x-cache HIT, HIT content-length 779 x-served-by cache-mdw17381-MDW, cache-fra19149-FRA last-modified Sun, 25 Apr 2021 08:37:39 GMT server nginx x-timer S1620747551.798941,VS0,VE1 date Tue, 11 May 2021 15:39:10 GMT vary Accept-Encoding content-type application/x-javascript via 1.1 varnish, 1.1 varnish expires Wed, 27 Apr 2022 01:23:04 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id f322fe47-a62d-11eb-b2ab-da1a83e8ae90 x-cache-hits 1, 1
GET H2	200	OneSignalSDK.js Show response cdn.onesignal.com/sdks/	9 KB 3 KB	34ms 18ms	Script application/javascript	2606:4700::6812:e234 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=660a951873600c5f9b6f4e2588e1174b Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1fdc83f40b6872fbf82ad027168954ccaa7eee12c7e6fcbe52e26c36bf915de Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:10 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 569 etag W/"5404400d01d5519bc4a10316e7ed5c9b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 64dc7fa12ee84e9e-FRA cf-request-id 09fdae18b500004e9e0b2c8000000001 expires Fri, 14 May 2021 15:39:10 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 844 B	14ms 14ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400,400i,700,700i Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-content/themes/asiana-child/assets/css/style.min.css?ver=1620740758 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2451677a05bbf4d9e7cacfc8f3c272f82efec286c39d88c690a3598051dba2e5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 11 May 2021 13:45:37 GMT server ESF date Tue, 11 May 2021 15:39:10 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 11 May 2021 15:39:10 GMT
GET H2	200	zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2 fonts.gstatic.com/s/ibmplexsans/v8/	17 KB 17 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ibmplexsans/v8/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400,400i,700,700i Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2ac23279590f18f4577084e3b030600ff80e7d4eaea2a52a9237579f3842f985 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://labs.sentinelone.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 06 May 2021 22:23:40 GMT x-content-type-options nosniff last-modified Thu, 10 Sep 2020 17:07:20 GMT server sffe age 407731 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17784 x-xss-protection 0 expires Fri, 06 May 2022 22:23:40 GMT
GET H3-29	200	gtm.js Show response www.googletagmanager.com/	113 KB 42 KB	29ms 27ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-M5BKP2C Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 97fe0ae1a217370b5bbec33a1e45070ed99890d288dbfd839f29143799832ba5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:11 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42557 x-xss-protection 0 last-modified Tue, 11 May 2021 15:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 11 May 2021 15:39:11 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	15 KB 7 KB	71ms 23ms	Script application/javascript	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 7f072dbb779b20cea6866f3f8d398af9cafe418e7e038aa0702feddf741f040c Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 11 May 2021 15:39:11 GMT Content-Encoding gzip Last-Modified Tue, 02 Feb 2021 06:46:48 GMT Server nginx/1.14.0 (Ubuntu) ETag "6018f558-3ab9" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Access-Control-Max-Age 86400 Access-Control-Allow-Credentials true Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 6144
GET H2	200	BackgroundLines-Copy-4.png labs.sentinelone.com/wp-content/uploads/2019/10/	75 KB 76 KB	15ms 14ms	Image image/png	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/10/BackgroundLines-Copy-4.png Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9bcdb94ad74931ea092ec31ed6aa7b1d7addd5cf819e8d374cd57883db25204a Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/10/BackgroundLines-Copy-4.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-12db8" age 752788 x-cache HIT, HIT x-cache-hits 1, 1 content-length 77240 x-served-by cache-mdw17367-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747552.691360,VS0,VE2 date Tue, 11 May 2021 15:39:11 GMT content-type image/png x-styx-req-id 4f82818c-ab96-11eb-b05e-fe18c7d5de17 expires Tue, 03 May 2022 22:32:43 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-7cd6446558-t9x9n
GET H2	200	fontawesome-webfont.woff2 labs.sentinelone.com/wp-content/themes/asiana/assets/fonts/	75 KB 76 KB	16ms 16ms	Font font/woff2	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-content/themes/asiana/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 pragma no-cache origin https://labs.sentinelone.com accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority labs.sentinelone.com referer https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 :scheme https sec-fetch-site same-origin :method GET Origin https://labs.sentinelone.com Referer https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "60903cba-12d68" age 631061 x-pantheon-styx-hostname styx-fe3-a-655dc95778-w8j4l x-cache HIT, HIT content-length 77160 x-served-by cache-mdw17331-MDW, cache-fra19149-FRA last-modified Mon, 03 May 2021 18:11:06 GMT server nginx x-timer S1620747552.694772,VS0,VE2 date Tue, 11 May 2021 15:39:11 GMT content-type font/woff2 access-control-allow-origin * expires Thu, 05 May 2022 08:21:30 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id ba76a251-acb1-11eb-814b-2e53d52f95a9 x-cache-hits 1, 1
GET DATA	200 OK	truncated /	11 KB 11 KB		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393 Request headers Origin https://labs.sentinelone.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/x-font-woff2
GET H3-29	200	zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2 fonts.gstatic.com/s/ibmplexsans/v8/	18 KB 18 KB	15ms 13ms	Font font/woff2	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ibmplexsans/v8/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400,400i,700,700i Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1a60331c6fb3a2eef23e7c1e44f7ee6bf41f4f2f96b99757d8bc845b3a807b7d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://labs.sentinelone.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 09 May 2021 06:05:08 GMT x-content-type-options nosniff last-modified Thu, 10 Sep 2020 17:07:33 GMT server sffe age 207243 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17976 x-xss-protection 0 expires Mon, 09 May 2022 06:05:08 GMT
GET H2	200	SentinelLabs_purple_fox_diagram_Opt1-1.jpg labs.sentinelone.com/wp-content/uploads/2020/10/	351 KB 352 KB	21ms 19ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2020/10/SentinelLabs_purple_fox_diagram_Opt1-1.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 14a5a9a19340877e5985fc62ed937f868c04a3a3e5622e1dde981bd4829a5ff2 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2020/10/SentinelLabs_purple_fox_diagram_Opt1-1.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5f8db7b7-57c56" age 571249 x-cache HIT, HIT x-cache-hits 1, 1 content-length 359510 x-served-by cache-mdw17321-MDW, cache-fra19149-FRA last-modified Mon, 19 Oct 2020 15:58:47 GMT server nginx x-timer S1620747552.761929,VS0,VE3 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id fd93f2f5-ad3c-11eb-9981-6a95877c33eb expires Fri, 06 May 2022 00:58:22 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-7cd6446558-7l75w
GET H2	200	1-s1-agent.png labs.sentinelone.com/wp-content/uploads/2020/10/	53 KB 53 KB	15ms 14ms	Image image/png	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2020/10/1-s1-agent.png Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash be89ba4e11928a78e529b478b0d0600768b6d9bd3fe75dfc26fac125b3a6ed5f Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2020/10/1-s1-agent.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5f8d75f2-d353" age 450981 x-cache MISS, HIT x-cache-hits 0, 1 content-length 54099 x-served-by cache-mdw17324-MDW, cache-fra19149-FRA last-modified Mon, 19 Oct 2020 11:18:10 GMT server nginx x-timer S1620747552.762424,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/png x-styx-req-id 027b3054-ae55-11eb-b2ab-da1a83e8ae90 expires Sat, 07 May 2022 10:22:50 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-jx4vm
GET H2	200	2-stego.png labs.sentinelone.com/wp-content/uploads/2020/10/	2 MB 2 MB	32ms 31ms	Image image/png	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2020/10/2-stego.png Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5600089bfc0d10f67c32974057fc63ea2a8e413e1379a6932412b850c41f64a2 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2020/10/2-stego.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5f8d75f6-1be99c" age 194772 x-cache HIT, HIT x-cache-hits 1, 1 content-length 1829276 x-served-by cache-mdw17355-MDW, cache-fra19149-FRA last-modified Mon, 19 Oct 2020 11:18:14 GMT server nginx x-timer S1620747552.762405,VS0,VE6 date Tue, 11 May 2021 15:39:11 GMT content-type image/png x-styx-req-id 8b520f3e-b0a9-11eb-9f67-5e8b017d2150 expires Tue, 10 May 2022 09:32:59 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-84464c49f8-qbnsq
GET H2	200	getForm Show response go.sentinelone.com/index.php/form/	6 KB 2 KB	58ms 57ms	Script application/javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&callback=jQuery1124017117518403320187_1620747551657&_=1620747551658 Requested by Host: go.sentinelone.com URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 37786efaf84ee657f28c63a9100dcb8e685458d60274c1f617676a8f80ef2c0e Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers cf-request-id 09fdae1c3c0000fa3ce2148000000001 content-encoding gzip server cloudflare date Tue, 11 May 2021 15:39:11 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 cf-ray 64dc7fa6ceb6fa3c-AMS cached true
GET H3-29	200	zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2 fonts.gstatic.com/s/ibmplexsans/v8/	19 KB 19 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ibmplexsans/v8/zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:400,400i,700,700i Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b17fbf66d95264b84a6c435de7ac98e5082f48e5ed65e6191314e19e7fadc62e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://labs.sentinelone.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 00:44:57 GMT x-content-type-options nosniff last-modified Thu, 10 Sep 2020 17:10:22 GMT server sffe age 53654 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19364 x-xss-protection 0 expires Wed, 11 May 2022 00:44:57 GMT
GET DATA	200 OK	truncated /	4 KB 4 KB		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c Request headers Origin https://labs.sentinelone.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/x-font-woff2
GET H2	200	Detecting-macOS.GMERA-Malware-Through-Behavioral-Inspection-1-96x50.jpg labs.sentinelone.com/wp-content/uploads/2019/09/	5 KB 5 KB	34ms 32ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/09/Detecting-macOS.GMERA-Malware-Through-Behavioral-Inspection-1-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c9626e50b48c7eac583e1d08119dc8f9e2f050239af0a86e01ce45ce9bb13215 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/09/Detecting-macOS.GMERA-Malware-Through-Behavioral-Inspection-1-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-1489" age 1100764 x-cache HIT, HIT x-cache-hits 1, 1 content-length 5257 x-served-by cache-mdw17382-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747552.836361,VS0,VE2 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 1db412e4-a86c-11eb-bd20-821926e29a3f expires Fri, 29 Apr 2022 21:53:07 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-6l4g9
GET H2	200	Cybercrime_-_Banload_-Banking-Malware-Implements-New-Techniques-for-Fraud-1-96x50.jpg labs.sentinelone.com/wp-content/uploads/2019/05/	5 KB 5 KB	33ms 31ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/05/Cybercrime_-_Banload_-Banking-Malware-Implements-New-Techniques-for-Fraud-1-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c76efd7801d5912d1d05862a3c3d093b13302dfafc600dc2f83acc7c2283efac Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/05/Cybercrime_-_Banload_-Banking-Malware-Implements-New-Techniques-for-Fraud-1-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-13ce" age 397741 x-cache MISS, HIT x-cache-hits 0, 1 content-length 5070 x-served-by cache-mdw17362-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747552.836666,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id f8463d08-aed0-11eb-8dd1-d657a49e6bf4 expires Sun, 08 May 2022 01:10:10 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-84464c49f8-xs49c
GET H2	200	Trickbot-Update_-Brief-Analysis-of-a-Recent-Trickbot-Payload-1-96x50.jpg labs.sentinelone.com/wp-content/uploads/2019/09/	5 KB 5 KB	33ms 31ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/09/Trickbot-Update_-Brief-Analysis-of-a-Recent-Trickbot-Payload-1-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3caf2b5e54f582c661fbaccd69ce7987fe09acdd91ff88d3cc1798a2af0e04d4 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/09/Trickbot-Update_-Brief-Analysis-of-a-Recent-Trickbot-Payload-1-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-127c" age 3475055 x-cache HIT, HIT x-cache-hits 1, 1 content-length 4732 x-served-by cache-mdw17325-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747552.836652,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 0a273a52-92d4-11eb-99d0-2e53d52f95a9 expires Sat, 02 Apr 2022 10:21:36 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-w8j4l
GET H2	200	Gootkit-Banking-Trojan-_-Part-3_-Retrieving-the-Final-Payload-1-96x50.jpg labs.sentinelone.com/wp-content/uploads/2019/08/	5 KB 5 KB	33ms 31ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2019/08/Gootkit-Banking-Trojan-_-Part-3_-Retrieving-the-Final-Payload-1-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 394ffdb54bf2167a706991ef924133ba9fec4aeb05e15596c7d1a234a785f4fb Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2019/08/Gootkit-Banking-Trojan-_-Part-3_-Retrieving-the-Final-Payload-1-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "5e0a48d4-147a" age 1851559 x-cache HIT, HIT x-cache-hits 1, 1 content-length 5242 x-served-by cache-mdw17366-MDW, cache-fra19149-FRA last-modified Mon, 30 Dec 2019 18:58:28 GMT server nginx x-timer S1620747552.836640,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 0915d07c-a198-11eb-8cc4-3241f098aabf expires Thu, 21 Apr 2022 05:19:52 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-7cd6446558-pxd4m
GET H2	200	Hundreds-Of-Millions-Of-Dell-Computers-At-Risk-Due-to-Multiple-BIOS-Driver-Privilege-Escalation-Flaws-11-96x50.jpg labs.sentinelone.com/wp-content/uploads/2021/05/	2 KB 2 KB	34ms 32ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2021/05/Hundreds-Of-Millions-Of-Dell-Computers-At-Risk-Due-to-Multiple-BIOS-Driver-Privilege-Escalation-Flaws-11-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash af1490246e2e0847771d7ca4ca68e8caf965405863d85f2ff9dc9b85615a3b81 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2021/05/Hundreds-Of-Millions-Of-Dell-Computers-At-Risk-Due-to-Multiple-BIOS-Driver-Privilege-Escalation-Flaws-11-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "60912200-790" age 614591 x-cache HIT, HIT x-cache-hits 1, 1 content-length 1936 x-served-by cache-mdw17341-MDW, cache-fra19149-FRA last-modified Tue, 04 May 2021 10:29:20 GMT server nginx x-timer S1620747552.836817,VS0,VE3 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 137c6d77-acd8-11eb-bd20-821926e29a3f expires Thu, 05 May 2022 12:56:00 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-6l4g9
GET H2	200	Copy-of-Relaying-Potatoes_-DCE_RPC-NTLM-Relay-EOP-7-96x50.jpg labs.sentinelone.com/wp-content/uploads/2021/04/	3 KB 3 KB	25ms 25ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2021/04/Copy-of-Relaying-Potatoes_-DCE_RPC-NTLM-Relay-EOP-7-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 231dfe9107a05921c44ab13ea8664316b6f6262caad3c95d24d782b8d393e7c4 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2021/04/Copy-of-Relaying-Potatoes_-DCE_RPC-NTLM-Relay-EOP-7-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "6086e0c2-a65" age 614412 x-cache HIT, HIT x-cache-hits 1, 1 content-length 2661 x-served-by cache-mdw17370-MDW, cache-fra19149-FRA last-modified Mon, 26 Apr 2021 15:48:18 GMT server nginx x-timer S1620747552.875540,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 7e1928bc-acd8-11eb-9981-6a95877c33eb expires Thu, 05 May 2022 12:58:59 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-b-7cd6446558-7l75w
GET H2	200	A-Deep-Dive-into-Zebrocys-Dropper-Docs-4-96x50.jpg labs.sentinelone.com/wp-content/uploads/2021/04/	2 KB 2 KB	15ms 13ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2021/04/A-Deep-Dive-into-Zebrocys-Dropper-Docs-4-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e0b505a2ba1e8458ed8e874d361a6b258c13d21a6b7b23165d1686829e6c28a8 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2021/04/A-Deep-Dive-into-Zebrocys-Dropper-Docs-4-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "607dabe7-63f" age 741632 x-cache HIT, HIT x-cache-hits 1, 1 content-length 1599 x-served-by cache-mdw17346-MDW, cache-fra19149-FRA last-modified Mon, 19 Apr 2021 16:12:23 GMT server nginx x-timer S1620747552.897899,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 493c238a-abb0-11eb-b05c-1624f26066b1 expires Wed, 04 May 2022 01:38:39 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-nrjtz
GET H2	200	Adventures-From-UEFI-Land_-the-Hunt-For-the-S3-Boot-Script-1-96x50.jpg labs.sentinelone.com/wp-content/uploads/2021/04/	2 KB 2 KB	15ms 13ms	Image image/jpeg	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/uploads/2021/04/Adventures-From-UEFI-Land_-the-Hunt-For-the-S3-Boot-Script-1-96x50.jpg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 35f8433336e4cc833d95d760fcdbbdb6c759123239fac85ff104838bfc2a99bb Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/uploads/2021/04/Adventures-From-UEFI-Land_-the-Hunt-For-the-S3-Boot-Script-1-96x50.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "606f2265-760" age 976479 x-cache HIT, HIT x-cache-hits 1, 1 content-length 1888 x-served-by cache-mdw17356-MDW, cache-fra19149-FRA last-modified Thu, 08 Apr 2021 15:33:57 GMT server nginx x-timer S1620747552.898457,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/jpeg x-styx-req-id 7da50dd4-a98d-11eb-bd20-821926e29a3f expires Sun, 01 May 2022 08:24:32 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-6l4g9
OPTIONS H2	200	links api.rebrandly.com/v1/ Frame	0 0	327ms 101ms	Preflight	35.171.55.1 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.rebrandly.com/v1/links Protocol H2 Server 35.171.55.1 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-171-55-1.compute-1.amazonaws.com Software / Express Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers apikey,content-type Origin https://labs.sentinelone.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers date Tue, 11 May 2021 15:39:12 GMT x-powered-by Express access-control-allow-origin * access-control-allow-methods GET,PUT,POST,DELETE,OPTIONS access-control-allow-headers Content-Type,Accept,X-Access-Token,X-Key,apikey,Authorization,Workspace,x-http-verb,x-rebrandly-internal access-control-max-age 3600
POST H2	403	links Show response api.rebrandly.com/v1/	152 B 629 B	167ms 167ms	XHR application/json	35.171.55.1 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.rebrandly.com/v1/links Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.171.55.1 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-171-55-1.compute-1.amazonaws.com Software / Express Resource Hash 03f94ea8844e57c376e7fa137ca45fedfd4282be27aaa3d3ce25afe79dd7e375 Request headers Accept */* Referer https://labs.sentinelone.com/ apikey 499c8e7548a643f090e8263994728de3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers date Tue, 11 May 2021 15:39:12 GMT x-rate-limit-reset-peak 1620747553224 x-rate-limit-reset-peak-ip 1620747553213 x-powered-by Express x-rate-limit-first-expire-peak 1620747552369 vary Accept-Encoding access-control-allow-methods GET,PUT,POST,DELETE,OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin * x-rate-limit-remaining-peak 23 content-length 152 access-control-allow-headers Content-Type,Accept,X-Access-Token,X-Key,apikey,Authorization,Workspace,x-http-verb,x-rebrandly-internal x-rate-limit-first-expire-peak-ip 1620747553213 x-rate-limit-remaining-peak-ip 99
GET H2	200	2694.svg s.w.org/images/core/emoji/13.0.1/svg/	3 KB 1 KB	48ms 15ms	Image image/svg+xml	192.0.77.48 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://s.w.org/images/core/emoji/13.0.1/svg/2694.svg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.48 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS s.w.org Software nginx / Resource Hash 55c9b517b633cd0b36e42a5de39f96b9ae899c6379474ded7a5d6cf3b671509f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-nc HIT ams 2 date Tue, 11 May 2021 15:39:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 20 Oct 2020 16:13:32 GMT server nginx x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	icon.svg labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/	2 KB 1 KB	31ms 30ms	Image image/svg+xml	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/icon.svg Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/style.css?ver=660a951873600c5f9b6f4e2588e1174b Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 69170775a33ffd93addb6aa04c4272f3f7468992aa817693214225f5a03979a6 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/icon.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/style.css?ver=660a951873600c5f9b6f4e2588e1174b :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/assets/style.css?ver=660a951873600c5f9b6f4e2588e1174b User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 content-encoding gzip etag W/"6084df47-741" age 1349866 x-pantheon-styx-hostname styx-fe3-b-7cd6446558-7l75w x-cache HIT, HIT content-length 908 x-served-by cache-mdw17337-MDW, cache-fra19149-FRA access-control-allow-origin * last-modified Sun, 25 Apr 2021 03:17:27 GMT server nginx x-timer S1620747552.863875,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT vary Accept-Encoding content-type image/svg+xml via 1.1 varnish, 1.1 varnish expires Wed, 27 Apr 2022 00:41:26 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 21d917b8-a628-11eb-9981-6a95877c33eb x-cache-hits 1, 1
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-38175129-3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 09 Apr 2021 23:59:54 GMT server Golfe2 age 4339 date Tue, 11 May 2021 14:26:52 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19569 expires Tue, 11 May 2021 16:26:52 GMT
GET H2	200	team.stats Show response labs.sentinelone.com/wp-json/invitations-for-slack/v1/	24 B 528 B	13ms 13ms	XHR application/json	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://labs.sentinelone.com/wp-json/invitations-for-slack/v1/team.stats Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-content/plugins/invitations-for-slack/invitations-for-slack/scripts/script.js?ver=1.0.2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a445cb092f2d90aa10af328721903d2949b07488d6aa6df0033ac31aa294ff23 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers :path /wp-json/invitations-for-slack/v1/team.stats pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest empty :authority labs.sentinelone.com referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers cf-edge-cache cache,platform=wordpress date Tue, 11 May 2021 15:39:11 GMT content-encoding gzip x-content-type-options nosniff x-styx-req-id 925fa9f3-b26d-11eb-a11f-5eabd668333e age 627 x-pantheon-styx-hostname styx-fe3-a-84464c49f8-bbmcq x-cache HIT, HIT vary Accept-Encoding, Origin content-length 44 x-served-by cache-mdw17333-MDW, cache-fra19149-FRA access-control-allow-headers Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type allow GET server nginx x-timer S1620747552.968593,VS0,VE1 strict-transport-security max-age=300 content-type application/json; charset=UTF-8 via 1.1 varnish, 1.1 varnish access-control-expose-headers X-WP-Total, X-WP-TotalPages, Link cache-control public, max-age=600 accept-ranges bytes x-robots-tag noindex link <https://labs.sentinelone.com/wp-json/>; rel="https://api.w.org/" x-cache-hits 1, 1
GET H2	200	ajax-loader.gif labs.sentinelone.com/wp-content/themes/asiana/assets/css/	4 KB 4 KB	13ms 12ms	Image image/gif	2620:12a:8001::3 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/ajax-loader.gif Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8001::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b Security Headers Name Value Strict-Transport-Security max-age=300 Request headers :path /wp-content/themes/asiana/assets/css/ajax-loader.gif pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority labs.sentinelone.com referer https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 :scheme https sec-fetch-site same-origin :method GET Referer https://labs.sentinelone.com/wp-content/themes/asiana/assets/css/asiana.plugins.css?ver=1.2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=300 via 1.1 varnish, 1.1 varnish etag "608882c3-1052" age 1132936 x-cache HIT, HIT x-cache-hits 1, 41 content-length 4178 x-served-by cache-mdw17382-MDW, cache-fra19149-FRA last-modified Tue, 27 Apr 2021 21:31:47 GMT server nginx x-timer S1620747552.978657,VS0,VE1 date Tue, 11 May 2021 15:39:11 GMT content-type image/gif x-styx-req-id 36645e72-a821-11eb-814b-2e53d52f95a9 expires Fri, 29 Apr 2022 12:56:56 GMT cache-control max-age=31622400 accept-ranges bytes x-pantheon-styx-hostname styx-fe3-a-655dc95778-w8j4l
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 376 B	70ms 22ms	XHR text/plain	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software / Resource Hash 5885f4817bb32dfd454bb9409682f8b83fc14eb0dcb563126d73ebdd2b649590 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 11 May 2021 15:39:12 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://labs.sentinelone.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 714 B	51ms 17ms	XHR application/json	185.33.221.13 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Tue, 11 May 2021 15:39:12 GMT X-Proxy-Origin 185.212.171.67; 185.212.171.67; 729.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.50:80 AN-X-Request-Uuid c77d18b3-ee80-4538-b4e1-f5269bebfd57 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://labs.sentinelone.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	7ms 7ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-M5BKP2C Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28c::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 11 May 2021 15:39:12 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=21020 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	36 KB 14 KB	91ms 35ms	Script text/javascript	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-M5BKP2C Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash 5c64e98b7d26b27f3235a6b049f4da5a8b1ed471ee0f2d4508e342bcb216eb2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13939 x-xss-protection 0 server cafe etag 16751590114636182394 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 11 May 2021 15:39:12 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	92 KB 24 KB	19ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23959 x-fb-rlafr 0 pragma public x-fb-debug 4e6WetS3diDzi+DqqYU/fJpVn+yEIRTBeTLpArGFcgCWzWzgKieydIkhuBY55C0c2wswjZPmo+higYT79pXJ1g== x-fb-trip-id 686109401 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Tue, 11 May 2021 15:39:12 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	hotjar-1857842.js Show response static.hotjar.com/c/	3 KB 2 KB	174ms 84ms	Script application/javascript	65.9.97.70 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1857842.js?sv=6 Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.97.70 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 5fbfc9a4b0d54bde68215f97558d0a15de63fe2641040e9c8d5df802534bcc5c Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT content-encoding br x-content-type-options nosniff cache-control max-age=60 x-amz-cf-pop PRG50-C1 etag W/918511dac81332a7712cdf8fe97aea1d vary Accept-Encoding x-cache RefreshHit from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 content-length 1511 via 1.1 3da92f19744e3229b09a019ec66be172.cloudfront.net (CloudFront) x-amz-cf-id VRC8TQkpbw-r2iJqa9RQWhszDqSok481RRa1zK5u3QlWKweZjU45gg==
GET H2	200	forms2.css go.sentinelone.com/js/forms2/css/	13 KB 3 KB	31ms 31ms	Stylesheet text/css	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/js/forms2/css/forms2.css Requested by Host: go.sentinelone.com URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 5149 content-length 2623 cf-request-id 09fdae1d190000fa3c09951000000001 last-modified Wed, 28 Apr 2021 17:50:01 GMT server cloudflare etag "19e05b6-3437-5c10c0201e440" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 64dc7fa828defa3c-AMS expires Tue, 11 May 2021 19:39:12 GMT
GET H2	200	forms2-theme-plain.css go.sentinelone.com/js/forms2/css/	828 B 432 B	26ms 25ms	Stylesheet text/css	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css Requested by Host: go.sentinelone.com URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value Strict-Transport-Security max-age=63113904 X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 5149 vary Accept-Encoding content-length 246 cf-request-id 09fdae1d190000fa3cfb8ca000000001 last-modified Wed, 28 Apr 2021 17:50:01 GMT server cloudflare etag "c20a81-33c-5c10c0201e440" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=63113904 content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 64dc7fa828e0fa3c-AMS expires Tue, 11 May 2021 19:39:12 GMT
POST H3-29	200	collect Show response www.google-analytics.com/j/	1 B 21 B	14ms 13ms	XHR text/plain	2a00:1450:4001:829::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1928606874&t=pageview&_s=1&dl=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&ul=en-us&de=UTF-8&dt=Purple%20Fox%20EK%20%7C%20New%20CVEs%2C%20Steganography%2C%20and%20Virtualization%20Added%20to%20Attack%20Flow%20-%20SentinelLabs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=706294437&gjid=1294539307&cid=968026969.1620747552&tid=UA-38175129-3&_gid=103542657.1620747552&_r=1&gtm=2ou4s0&z=1449126518 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 11 May 2021 15:39:12 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://labs.sentinelone.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1620747552044%26url%3Dhttps%253A%252F%252Flabs.sentinelone.com%25... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2...	0 371 B	384ms 191ms	Image application/javascript	108.174.10.14 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&liSync=true&e_ipv6=AQIHiIQOqxHqmAAAAXlcFQm14NKfBxVrWeINJgiQf8guG2OfPg9yHGH7VXrFvqLHYxEBV4FW Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.174.10.14 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-10-14.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:13 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} server Play linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-lva1 content-type application/javascript content-length 0 x-li-uuid UoMFF1ANfhbwxdG46ioAAA== Redirect headers date Tue, 11 May 2021 15:39:13 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} server Play linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1620747552044&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&liSync=true&e_ipv6=AQIHiIQOqxHqmAAAAXlcFQm14NKfBxVrWeINJgiQf8guG2OfPg9yHGH7VXrFvqLHYxEBV4FW x-li-proto http/2 x-li-pop prod-esv5 content-length 0 x-li-uuid VyZiAlANfhYAB4rzDSsAAA==
GET H3-29	200	300800713594069 Show response connect.facebook.net/signals/config/	254 KB 72 KB	50ms 50ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/300800713594069?v=2.9.39&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e979a905ca6b1745a60acd42dc1875144fa40c481b6cb349179b1f5b8f313f9b Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-fb-rlafr 0 pragma public x-fb-debug WIMGij9uiAildoYG519k4F29U5rS7i3aK0JhXXY1/x0H95zCF5CKSY0noiLLMs6lHi2qqkuWTJ+WibOeXfpY1A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Tue, 11 May 2021 15:39:12 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	247ms 197ms	Image image/gif	104.111.233.140 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=&visitor=03f1bfdf-d663-43a4-8f91-afacf76a155b&session=381d397d-0a1f-47fe-8b17-057edc583e95&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22New%20research%20shows%20that%20the%20Purple%20Fox%20exploit%20kit%20has%20added%20new%20tricks%20to%20its%20attack%20flow%20and%20continues%20to%20target%20vulnerable%20versions%20of%20Internet%20Explorer.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Purple%20Fox%20EK%20%7C%20New%20CVEs%2C%20Steganography%2C%20and%20Virtualization%20Added%20to%20Attack%20Flow%20-%20SentinelLabs%22%7D&cb=47552057&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-233-140.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 11 May 2021 15:39:12 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	XDFrame Show response go.sentinelone.com/index.php/form/ Frame BE35	2 KB 888 B	354ms 354ms	Document text/html	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/index.php/form/XDFrame Requested by Host: go.sentinelone.com URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2 Security Headers Name Value X-Content-Type-Options nosniff Request headers :method GET :authority go.sentinelone.com :scheme https :path /index.php/form/XDFrame pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://labs.sentinelone.com/ accept-encoding gzip, deflate, br accept-language en-US cookie __cf_bm=3b46fd75271282d7df7780e12950930ff6000790-1620747550-1800-AdT2efgOz+MSBSP52jp7/4YchdDsmhSaAnHlGlx+Qqz+ZT8MaNXWstfmvBZUyyL2Eug6dTmMbu/3tvp5cmR4evA=; _ga=GA1.2.968026969.1620747552; _gid=GA1.2.103542657.1620747552; _gat_gtag_UA_38175129_3=1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://labs.sentinelone.com/ Response headers date Tue, 11 May 2021 15:39:12 GMT content-type text/html; charset=utf-8 cache-control max-age=3600 x-content-type-options nosniff vary Accept-Encoding set-cookie BIGipServerab14web-nginx-app_https=!gTS+1uJq/T6KSqjaIvODocHezid2PSti26zd0iQslPOZNvX3HnsbICIsnqw8FZQyy6lXVeMn5LjKhCM=;Path=/;Version=1;Secure;Httponly cf-cache-status DYNAMIC cf-request-id 09fdae1d710000fa3c392fb000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 64dc7fa8b9b7fa3c-AMS content-encoding gzip
GET H2	200	/ www.facebook.com/tr/	44 B 409 B	19ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=300800713594069&ev=PageView&dl=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&rl=&if=false&ts=1620747552130&sw=1600&sh=1200&v=2.9.39&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1620747552127.2019405457&it=1620747552052&coo=false&exp=l1&rqm=GET Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Tue, 11 May 2021 15:39:12 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/	2 KB 1 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:812::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1620747552140&cv=9&fst=1620747552140&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg4s0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&tiba=Purple%20Fox%20EK%20%7C%20New%20CVEs%2C%20Steganography%2C%20and%20Virtualization%20Added%20to%20Attack%20Flow%20-%20SentinelLabs&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e625e82334d83216bf8eb5acb9c866adaeac6809f9c58278e7fcb58b664966c8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 11 May 2021 15:39:12 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1115 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	/ www.google.com/pagead/1p-user-list/970186784/	42 B 64 B	37ms 36ms	Image image/gif	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/970186784/?random=1620747552140&cv=9&fst=1620745200000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg4s0&sendb=1&frm=0&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&tiba=Purple%20Fox%20EK%20%7C%20New%20CVEs%2C%20Steganography%2C%20and%20Virtualization%20Added%20to%20Attack%20Flow%20-%20SentinelLabs&async=1&fmt=3&is_vtc=1&random=2698941762&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 11 May 2021 15:39:12 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/970186784/	42 B 108 B	22ms 21ms	Image image/gif	2a00:1450:4001:829::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/970186784/?random=1620747552140&cv=9&fst=1620745200000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg4s0&sendb=1&frm=0&url=https%3A%2F%2Flabs.sentinelone.com%2Fpurple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow%2F&tiba=Purple%20Fox%20EK%20%7C%20New%20CVEs%2C%20Steganography%2C%20and%20Virtualization%20Added%20to%20Attack%20Flow%20-%20SentinelLabs&async=1&fmt=3&is_vtc=1&random=2698941762&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: labs.sentinelone.com URL: https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 11 May 2021 15:39:12 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	modules.a7cb52be9b339377f5a3.js Show response script.hotjar.com/	220 KB 58 KB	142ms 54ms	Script application/javascript	65.9.97.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.a7cb52be9b339377f5a3.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1857842.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.97.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a131890941c3f6c4d8c82439a8aa28c97cfef692bd019b228f14373d788ee80c Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 14:57:08 GMT content-encoding br x-content-type-options nosniff age 88924 x-cache Hit from cloudfront content-length 59161 access-control-allow-origin * last-modified Mon, 10 May 2021 14:56:23 GMT etag "409ad317a25fe46b9ce380ffbe7d8756" vary Accept-Encoding content-type application/javascript via 1.1 5a9253ffd4a04a82b061e7ef23f713d4.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop PRG50-C1 accept-ranges bytes x-robots-tag none x-amz-cf-id _MwW-etRt7dO1ELYqKomMW2AFsP-9JQGiNvsiXIT5ASSRSppUWrBoQ==
GET H2	200	box-5e3cec51ed8e99df6977c199d27812d7.html Show response vars.hotjar.com/ Frame CB33	1 KB 1 KB	128ms 42ms	Document text/html	65.9.97.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1857842.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.97.111 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33 Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-5e3cec51ed8e99df6977c199d27812d7.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://labs.sentinelone.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://labs.sentinelone.com/ Response headers content-type text/html content-length 684 date Tue, 30 Mar 2021 16:10:32 GMT accept-ranges bytes cache-control max-age=31536000 content-encoding br etag "4e332edbbc3b46800c87f197cc7d3bb6" last-modified Tue, 30 Mar 2021 14:48:51 GMT x-robots-tag none vary Accept-Encoding x-cache Hit from cloudfront via 1.1 e3568b144ae2b93deb0c17907b662ac2.cloudfront.net (CloudFront) x-amz-cf-pop PRG50-C1 x-amz-cf-id 5IqI3LEcSC2M7xQAEpSO3l-m2ttYhvje5hyujmmnMzoS0C7tCSk7WA== age 3626920
GET H2	200	forms2.min.js Show response go.sentinelone.com/js/forms2/js/ Frame BE35	204 KB 68 KB	26ms 26ms	Script application/x-javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.sentinelone.com/js/forms2/js/forms2.min.js Requested by Host: go.sentinelone.com URL: https://go.sentinelone.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://go.sentinelone.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 11 May 2021 15:39:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Wed, 28 Apr 2021 17:50:01 GMT server cloudflare age 2934 etag "c20a88-33187-5c10c0201e440" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 64dc7faafd68fa3c-AMS cf-request-id 09fdae1edc0000fa3ce1968000000001 expires Tue, 11 May 2021 19:39:12 GMT
POST H3-29	200	/ www.facebook.com/tr/	0 15 B	13ms 6ms	Ping text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://labs.sentinelone.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryzMnAYJ31xTJsc1BW Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Tue, 11 May 2021 15:39:12 GMT content-type text/plain access-control-allow-origin https://labs.sentinelone.com access-control-allow-credentials true cross-origin-resource-policy cross-origin content-length 0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i