urlscan.io logo urlscan.io
SecurityTrails logo

www.proofpoint.com Open in urlscan Pro
2a02:e980:107::cf  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Submission: On March 16 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 50 IPs in 8 countries across 49 domains to perform 105 HTTP transactions. The main IP is 2a02:e980:107::cf, located in United States and belongs to INCAPSULA, US. The main domain is www.proofpoint.com.
TLS certificate: Issued by Thawte RSA CA 2018 on August 27th 2019. Valid for: a year.
This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
20 2a02:e980:107... 19551 (INCAPSULA)
2 216.58.210.2 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 52.222.150.36 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 4 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
1 151.101.12.157 54113 (FASTLY)
2 147.75.33.229 54825 (PACKET)
1 91.228.74.218 27281 (QUANTCAST)
2 4 52.16.182.42 16509 (AMAZON-02)
2 34.96.102.137 15169 (GOOGLE)
5 2606:4700::68... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
2 52.222.150.177 16509 (AMAZON-02)
3 4 216.58.207.38 15169 (GOOGLE)
2 52.222.150.153 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 2 185.33.223.215 29990 (ASN-APPNEX)
1 52.222.150.39 16509 (AMAZON-02)
1 1 216.200.122.11 6461 (ZAYO-6461)
1 2a00:1450:400... 15169 (GOOGLE)
1 6 95.100.196.159 16625 (AKAMAI-AS)
1 2 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.133 13414 (TWITTER)
1 147.75.102.13 54825 (PACKET)
1 2600:9000:204... 16509 (AMAZON-02)
15 18 3.248.28.111 16509 (AMAZON-02)
2 2 52.213.172.136 16509 (AMAZON-02)
1 2 13.225.73.44 16509 (AMAZON-02)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 2 52.57.106.47 16509 (AMAZON-02)
1 18.156.0.31 16509 (AMAZON-02)
1 2 95.100.197.53 16625 (AKAMAI-AS)
1 69.173.144.139 26667 (RUBICONPR...)
1 2 64.202.112.95 22075 (AS-OUTBRAIN)
1 185.64.189.110 62713 (AS-PUBMATIC)
1 1 2a00:1288:f03... 10310 (YAHOO-1)
1 151.101.113.44 54113 (FASTLY)
1 2 52.57.98.188 16509 (AMAZON-02)
1 2 52.59.155.31 16509 (AMAZON-02)
1 37.252.173.27 29990 (ASN-APPNEX)
1 35.190.72.21 15169 (GOOGLE)
1 2 34.95.120.147 15169 (GOOGLE)
1 1 172.217.23.162 15169 (GOOGLE)
1 91.228.74.200 27281 (QUANTCAST)
1 2a03:2880:f12... 32934 (FACEBOOK)
1 151.101.114.110 54113 (FASTLY)
1 104.244.42.195 13414 (TWITTER)
2 162.247.242.18 23467 (NEWRELIC-...)
105 50
20    2a02:e980:107::cf (United States)

ASN19551 (INCAPSULA, US)
www.proofpoint.com
2    216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s07-in-f2.1e100.net
www.googleadservices.com
2    2606:4700::6810:262f (United States)

ASN13335 (CLOUDFLARENET, US)
js.maxmind.com
geoip-js.maxmind.com
3    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:814::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    52.222.150.36 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-150-36.fra53.r.cloudfront.net
scripts.demandbase.com
2    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
3    2a00:1450:4001:824::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
4    2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
1    2a02:26f0:10c:39e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
snap.licdn.com
1    151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    147.75.33.229 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress11
static.hotjar.com
vars.hotjar.com
1    91.228.74.218 (United Kingdom)

ASN27281 (QUANTCAST, US)
secure.quantserve.com
4    52.16.182.42 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-182-42.eu-west-1.compute.amazonaws.com
ads.avocet.io
2    34.96.102.137 (United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com
dev.visualwebsiteoptimizer.com
5    2606:4700::6812:1bbe (United States)

ASN13335 (CLOUDFLARENET, US)
tracking.g2crowd.com
5    2a00:1450:4001:814::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
visitor.reactful.com
tracking.reactful.com
2    52.222.150.177 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-150-177.fra53.r.cloudfront.net
api.company-target.com
4    216.58.207.38 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s24-in-f6.1e100.net
4788165.fls.doubleclick.net
ad.doubleclick.net
2    52.222.150.153 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-150-153.fra53.r.cloudfront.net
js.driftt.com
1    68.67.153.60 (United States)

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net
s.ml-attr.com
2    185.33.223.215 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
1    52.222.150.39 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-150-39.fra53.r.cloudfront.net
attr.ml-api.io
1    216.200.122.11 (United States)

ASN6461 (ZAYO-6461, US)
PTR: 216.200.122.11.IPYX-141870-ZYO.zip.zayo.com
gwmtracking.com
1    2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
6    95.100.196.159 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-196-159.deploy.static.akamaitechnologies.com
s.adroll.com
2    2a05:f500:10:101::b93f:9105 (Ireland)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    2a05:f500:10:101::b93f:9101 (Ireland)

ASN14413 (LINKEDIN, US)
www.linkedin.com
1    2a00:1450:400c:c06::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    147.75.102.13 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress1
script.hotjar.com
1    2600:9000:2047:2800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
18    3.248.28.111 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-28-111.eu-west-1.compute.amazonaws.com
d.adroll.mgr.consensu.org
d.adroll.com
2    52.213.172.136 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-172-136.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    13.225.73.44 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-44.fra2.r.cloudfront.net
segments.company-target.com
2    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    52.57.106.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-106-47.eu-central-1.compute.amazonaws.com
pixel.advertising.com
1    18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
2    95.100.197.53 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-197-53.deploy.static.akamaitechnologies.com
dsum-sec.casalemedia.com
1    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    64.202.112.95 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
1    2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)
ads.yahoo.com
1    151.101.113.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
trc.taboola.com
2    52.57.98.188 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-98-188.eu-central-1.compute.amazonaws.com
eb2.3lift.com
2    52.59.155.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-155-31.eu-central-1.compute.amazonaws.com
x.bidswitch.net
1    37.252.173.27 (Ascension Island)

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
1    35.190.72.21 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 21.72.190.35.bc.googleusercontent.com
idsync.rlcdn.com
2    34.95.120.147 (United States)

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com
us-u.openx.net
1    172.217.23.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s22-in-f2.1e100.net
cm.g.doubleclick.net
1    91.228.74.200 (United Kingdom)

ASN27281 (QUANTCAST, US)
pixel.quantserve.com
1    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    151.101.114.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    162.247.242.18 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1, US)
PTR: bam-6.nr-data.net
bam.nr-data.net
Apex Domain
Subdomains		 Transfer
23 adroll.com
s.adroll.com
d.adroll.com
27 KB
20 proofpoint.com
www.proofpoint.com
4 MB
8 doubleclick.net
googleads.g.doubleclick.net
4788165.fls.doubleclick.net
ad.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
4 KB
5 reactful.com
visitor.reactful.com
tracking.reactful.com
110 KB
5 g2crowd.com
tracking.g2crowd.com
4 company-target.com
api.company-target.com
segments.company-target.com
3 KB
4 avocet.io
ads.avocet.io
2 KB
4 google-analytics.com
www.google-analytics.com
18 KB
4 google.com
www.google.com
adservice.google.com
707 B
4 gstatic.com
fonts.gstatic.com
40 KB
3 linkedin.com
px.ads.linkedin.com
www.linkedin.com
1 KB
3 adnxs.com
secure.adnxs.com
ib.adnxs.com
3 KB
3 hotjar.com
static.hotjar.com
script.hotjar.com
vars.hotjar.com
76 KB
3 google.de
www.google.de
329 B
3 googleapis.com
fonts.googleapis.com
3 KB
2 nr-data.net
bam.nr-data.net
331 B
2 openx.net
us-u.openx.net
499 B
2 bidswitch.net
x.bidswitch.net
912 B
2 3lift.com
eb2.3lift.com
739 B
2 outbrain.com
sync.outbrain.com
807 B
2 casalemedia.com
dsum-sec.casalemedia.com
2 KB
2 yahoo.com
ups.analytics.yahoo.com
ads.yahoo.com
1 KB
2 advertising.com
pixel.advertising.com
818 B
2 facebook.net
connect.facebook.net
142 KB
2 bidr.io
match.prod.bidr.io
1019 B
2 driftt.com
js.driftt.com
45 KB
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com
1 KB
2 quantserve.com
secure.quantserve.com
pixel.quantserve.com
7 KB
2 bing.com
bat.bing.com
8 KB
2 maxmind.com
js.maxmind.com
geoip-js.maxmind.com
3 KB
2 googleadservices.com
www.googleadservices.com
20 KB
1 twitter.com
analytics.twitter.com
284 B
1 newrelic.com
js-agent.newrelic.com
10 KB
1 facebook.com
www.facebook.com
257 B
1 rlcdn.com
idsync.rlcdn.com
62 B
1 taboola.com
trc.taboola.com
282 B
1 pubmatic.com
simage2.pubmatic.com
886 B
1 rubiconproject.com
pixel.rubiconproject.com
239 B
1 consensu.org
d.adroll.mgr.consensu.org
136 B
1 quantcount.com
rules.quantcount.com
354 B
1 t.co
t.co
170 B
1 gwmtracking.com
gwmtracking.com
389 B
1 ml-api.io
attr.ml-api.io
482 B
1 ml-attr.com
s.ml-attr.com
280 B
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 licdn.com
snap.licdn.com
2 KB
1 demandbase.com
scripts.demandbase.com
19 KB
1 googletagmanager.com
www.googletagmanager.com
39 KB
0 addthis.com Failed
s7.addthis.com Failed
105 49
Domain Requested by
20 www.proofpoint.com www.proofpoint.com
17 d.adroll.com 14 redirects www.proofpoint.com
6 s.adroll.com 1 redirects www.googletagmanager.com
www.proofpoint.com
s.adroll.com
5 tracking.g2crowd.com www.proofpoint.com
4 ads.avocet.io 2 redirects www.proofpoint.com
4 www.google-analytics.com 1 redirects www.googletagmanager.com
www.proofpoint.com
4 fonts.gstatic.com www.proofpoint.com
3 visitor.reactful.com www.proofpoint.com
visitor.reactful.com
3 www.google.de www.proofpoint.com
3 www.google.com 1 redirects www.proofpoint.com
3 fonts.googleapis.com www.proofpoint.com
visitor.reactful.com
2 tracking.reactful.com visitor.reactful.com
2 bam.nr-data.net js-agent.newrelic.com
2 us-u.openx.net 1 redirects www.proofpoint.com
2 x.bidswitch.net 1 redirects www.proofpoint.com
2 eb2.3lift.com 1 redirects www.proofpoint.com
2 sync.outbrain.com 1 redirects www.proofpoint.com
2 dsum-sec.casalemedia.com 1 redirects www.proofpoint.com
2 pixel.advertising.com 2 redirects
2 connect.facebook.net s.adroll.com
connect.facebook.net
2 segments.company-target.com 1 redirects www.proofpoint.com
2 match.prod.bidr.io 2 redirects
2 px.ads.linkedin.com 1 redirects www.proofpoint.com
2 ad.doubleclick.net 2 redirects
2 secure.adnxs.com 2 redirects
2 js.driftt.com www.proofpoint.com
js.driftt.com
2 4788165.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 api.company-target.com www.proofpoint.com
scripts.demandbase.com
2 dev.visualwebsiteoptimizer.com www.proofpoint.com
2 bat.bing.com www.googletagmanager.com
www.proofpoint.com
2 googleads.g.doubleclick.net www.googleadservices.com
2 www.googleadservices.com www.proofpoint.com
www.googletagmanager.com
1 analytics.twitter.com static.ads-twitter.com
1 js-agent.newrelic.com www.proofpoint.com
1 www.facebook.com www.proofpoint.com
1 pixel.quantserve.com www.proofpoint.com
1 cm.g.doubleclick.net 1 redirects
1 idsync.rlcdn.com www.proofpoint.com
1 ib.adnxs.com www.proofpoint.com
1 trc.taboola.com www.proofpoint.com
1 ads.yahoo.com 1 redirects
1 simage2.pubmatic.com www.proofpoint.com
1 pixel.rubiconproject.com www.proofpoint.com
1 ups.analytics.yahoo.com www.proofpoint.com
1 d.adroll.mgr.consensu.org 1 redirects
1 vars.hotjar.com static.hotjar.com
1 rules.quantcount.com secure.quantserve.com
1 script.hotjar.com static.hotjar.com
1 t.co www.proofpoint.com
1 stats.g.doubleclick.net 1 redirects
1 www.linkedin.com 1 redirects
1 adservice.google.com www.proofpoint.com
1 gwmtracking.com 1 redirects
1 attr.ml-api.io www.proofpoint.com
1 s.ml-attr.com 1 redirects
1 secure.quantserve.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 geoip-js.maxmind.com js.maxmind.com
1 scripts.demandbase.com www.proofpoint.com
1 www.googletagmanager.com www.proofpoint.com
1 js.maxmind.com www.proofpoint.com
0 s7.addthis.com Failed www.proofpoint.com
105 64
Subject Issuer Validity Valid
proofpoint.com
Thawte RSA CA 2018		 2019-08-27 -
2020-08-26		 a year crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
*.maxmind.com
COMODO RSA Organization Validation Secure Server CA		 2018-10-15 -
2020-11-06		 2 years crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
*.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2018-09-20 -
2020-11-19		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
www.google.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2		 2019-04-30 -
2021-04-30		 2 years crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2019-04-01 -
2021-05-07		 2 years crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-08-14 -
2020-08-18		 a year crt.sh
static.hotjar.com
Let's Encrypt Authority X3		 2020-02-03 -
2020-05-03		 3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA		 2019-10-04 -
2020-10-07		 a year crt.sh
*.avocet.io
Amazon		 2020-02-18 -
2021-03-18		 a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2017-06-30 -
2020-07-06		 3 years crt.sh
*.g2crowd.com
Sectigo ECC Domain Validation Secure Server CA		 2019-08-06 -
2020-09-28		 a year crt.sh
*.reactful.com
Go Daddy Secure Certificate Authority - G2		 2019-03-10 -
2020-05-09		 a year crt.sh
*.company-target.com
Go Daddy Secure Certificate Authority - G2		 2019-06-19 -
2021-08-18		 2 years crt.sh
*.doubleclick.net
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
drift.com
Amazon		 2019-10-03 -
2020-11-03		 a year crt.sh
*.ml-api.io
Amazon		 2020-02-06 -
2021-03-06		 a year crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2020-01-29 -
2021-04-29		 a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-05-29 -
2021-06-29		 2 years crt.sh
t.co
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
script.hotjar.com
Let's Encrypt Authority X3		 2020-02-03 -
2020-05-03		 3 months crt.sh
vars.hotjar.com
Let's Encrypt Authority X3		 2020-02-03 -
2020-05-03		 3 months crt.sh
adroll.mgr.consensu.org
Amazon		 2019-11-06 -
2020-12-06		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-03-01 -
2020-05-30		 3 months crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2020-02-13 -
2020-08-11		 6 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2020-03-02 -
2021-04-01		 a year crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2019-01-10 -
2021-01-14		 2 years crt.sh
*.outbrain.com
Thawte RSA CA 2018		 2019-10-29 -
2021-11-23		 2 years crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA		 2019-02-22 -
2021-02-21		 2 years crt.sh
*.taboola.com
DigiCert SHA2 Secure Server CA		 2020-02-19 -
2020-09-10		 7 months crt.sh
*.3lift.com
Amazon		 2019-07-17 -
2020-08-17		 a year crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2019-04-17 -
2020-05-04		 a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-04-24 -
2020-04-23		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2018-01-04 -
2020-07-09		 3 years crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-04-10 -
2020-03-21		 a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.nr-data.net
DigiCert SHA2 Secure Server CA		 2020-02-05 -
2022-02-08		 2 years crt.sh

This page contains 4 frames:

Primary Page: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Frame ID: FE707F68E2118D7957D298F4C2763876
Requests: 118 HTTP requests in this frame

Frame: https://4788165.fls.doubleclick.net/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945
Frame ID: A4D81479B4D8B3BB4488F57C22A9FE4C
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: E0B8A09FC830376EB8ED31D3BAF44E82
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: 06239426415D0B495584372069FEFF99
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /^\/\/static\.hotjar\.com\/c\/hotjar-/i
Overall confidence: 100%
Detected patterns
  • script /\.quantserve\.com\/quant\.js/i

Page Statistics

105
Requests

98 %
HTTPS

36 %
IPv6

49
Domains

64
Subdomains

50
IPs

8
Countries

4796 kB
Transfer

8001 kB
Size

15
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j HTTP 302
  • https://ads.avocet.io/s?bounce=true&add=5aba5f53ab79f7f51390a95a&ty=j
Request Chain 64
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j HTTP 302
  • https://ads.avocet.io/s?bounce=true&add=5d1dcad3b00320110090d553&ty=j
Request Chain 65
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945 HTTP 302
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945
Request Chain 67
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=5089696874775331693
Request Chain 68
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1382653062 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 70
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&time=1584363884750 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fcorporate-blog%252Fpost%252Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories%26time%3D1584363884750%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&time=1584363884750&liSync=true
Request Chain 71
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1023188722&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&ul=en-us&de=UTF-8&dt=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=486052692&gjid=733568023&cid=1290649664.1584363885&tid=UA-2257074-1&_gid=157786602.1584363885&_r=1&gtm=2wg340MGR7P8X&z=1934920583 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_gid=157786602.1584363885&gjid=733568023&_v=j81&z=1934920583 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583&slf_rd=1&random=3505886921
Request Chain 81
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 83
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/7YJ7XZCLMRHSVCXIHB5HIT?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2 HTTP 302
  • https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT/?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2
Request Chain 87
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A&verifyHash=466ebc8e88da5a1e51ec39950a8a92eb0c450d1a
Request Chain 90
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&pv=80669905457.02022&cookie=&adroll_s_ref=&keyw=&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories HTTP 302
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Request Chain 93
  • https://d.adroll.com/cm/aol/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPb549c254-6786-11ea-b061-066448848130
Request Chain 94
  • https://d.adroll.com/cm/index/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885&C=1
Request Chain 95
  • https://d.adroll.com/cm/n/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expires=365
Request Chain 96
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&rdrctExp=true
Request Chain 97
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 98
  • https://d.adroll.com/cm/r/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
  • https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 99
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Request Chain 100
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Request Chain 101
  • https://d.adroll.com/cm/b/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Request Chain 102
  • https://d.adroll.com/cm/x/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Request Chain 103
  • https://d.adroll.com/cm/l/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://idsync.rlcdn.com/377928.gif?partner_uid=ab57e749866cbb27acfc17b2931e0796
Request Chain 104
  • https://d.adroll.com/cm/o/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=ab57e749866cbb27acfc17b2931e0796 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=ab57e749866cbb27acfc17b2931e0796
Request Chain 105
  • https://d.adroll.com/cm/g/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=q1fnSYZsuyes_Beykx4Hlg HTTP 302
  • https://d.adroll.com/cm/g/in

105 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
www.proofpoint.com/us/corporate-blog/post/ 		50 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
f522e640b4b821b068441a3c2deae8fed8263a3473339977167952f7fb88ecad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
www.proofpoint.com
:scheme
https
:path
/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
server
nginx
date
Mon, 16 Mar 2020 13:04:43 GMT
content-type
text/html; charset=UTF-8
cache-control
max-age=86400, public
x-drupal-dynamic-cache
MISS
link
<https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories>; rel="shortlink", <https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories>; rel="canonical" <https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories>; rel="alternate"; hreflang="en-us"
x-ua-compatible
IE=edge
content-language
en
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
expires
Mon, 16 Mar 2020 01:11:27 GMT
last-modified
Sun, 15 Mar 2020 01:11:26 GMT
etag
"1584234686"
vary
Cookie,Accept-Encoding
x-generator
Drupal 8 (https://www.drupal.org)
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
origin-when-cross-origin
feature-policy
geolocation 'self'
x-drupal-cache
HIT
content-encoding
gzip
x-request-id
v-285c56ea-66d8-11ea-b663-8b343f890f56
x-ah-environment
prod
age
74967
via
varnish
x-cache
HIT
x-cache-hits
474
accept-ranges
bytes
set-cookie
visid_incap_177663=3XVNhd90SRSuoQrOLDDDCGp5b14AAAAAQUIPAAAAAAAwohJXPiQ9GayqoAgD8BH9; expires=Tue, 16 Mar 2021 09:33:01 GMT; HttpOnly; path=/; Domain=.proofpoint.com incap_ses_246_177663=5c7EI/qBAnx2mjYmFPhpA2t5b14AAAAAmMebIgzLAbmT/L44Y60xHg==; path=/; Domain=.proofpoint.com
x-cdn
Incapsula
x-iinfo
4-64561947-64561948 NNNY CT(0 0 0) RT(1584363882912 0) q(0 0 0 0) r(1 3) U2
css_QyXdX86i2zsUXNa6iWjGzVDLYjLulhyGvoua3uNg2iU.css
www.proofpoint.com/sites/default/files/css/ 		25 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/sites/default/files/css/css_QyXdX86i2zsUXNa6iWjGzVDLYjLulhyGvoua3uNg2iU.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4325dd5fcea2db3b145cd6ba8968c6cd50cb6232ee961c86be8b9adee360da25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 11 Feb 2020 08:03:21 GMT
x-cdn
Incapsula
etag
"2c35a39b"
content-type
text/css
status
200
x-iinfo
4-64561992-0 0CNN RT(1584363883264 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1185027, public
content-length
4415
expires
Mon, 30 Mar 2020 06:15:10 GMT
css_dwCg3Uod1OyWqTW-XUQ5Fpjl57VZLR4af9izYdjVOiw.css
www.proofpoint.com/sites/default/files/css/ 		746 KB
188 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/sites/default/files/css/css_dwCg3Uod1OyWqTW-XUQ5Fpjl57VZLR4af9izYdjVOiw.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
7700a0dd4a1dd4ec96a935be5d44391698e5e7b5592d1e1a7fd8b361d8d53a2c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 06 Mar 2020 23:52:11 GMT
x-cdn
Incapsula
etag
"4d202429"
content-type
text/css
status
200
x-iinfo
4-64561993-0 0CNN RT(1584363883266 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1184327, public
content-length
192320
expires
Mon, 30 Mar 2020 06:03:30 GMT
modernizr.min.js
www.proofpoint.com/core/assets/vendor/modernizr/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/core/assets/vendor/modernizr/modernizr.min.js?v=3.3.1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
1e06b3b8ed8d91022c8192923eb0d0a913596d088312b8bdc0c3b6dd2361627a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:18:15 GMT
x-cdn
Incapsula
content-type
application/javascript
status
200
x-iinfo
4-64561994-0 0CNN RT(1584363883268 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1184326, public
content-length
2110
expires
Mon, 30 Mar 2020 06:03:29 GMT
logo-reg.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/logo-reg.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:18:17 GMT
x-cdn
Incapsula
etag
"13fdd2ef"
content-type
image/svg+xml
status
200
x-iinfo
4-64561995-0 0CNN RT(1584363883269 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1186642, public
content-length
1124
expires
Mon, 30 Mar 2020 06:42:05 GMT
psat-training-modules.png
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/ 		913 KB
913 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/psat-training-modules.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
2cfe7c393d823154ee86def4c4eeeff7520b903871d93073ef7ad566a07ea92d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:18:17 GMT
x-cdn
Incapsula
etag
"cdd6b9a9"
content-type
image/png
status
200
x-iinfo
4-64561996-0 0CNN RT(1584363883269 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1184153, public
content-length
934755
expires
Mon, 30 Mar 2020 06:00:36 GMT
home.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/ 		784 B
612 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/home.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:18:17 GMT
x-cdn
Incapsula
etag
"4c25cdee"
content-type
image/svg+xml
status
200
x-iinfo
4-64562007-0 0CNN RT(1584363883364 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1186658, public
content-length
477
expires
Mon, 30 Mar 2020 06:42:21 GMT
50-50-red-blue-cyber-computer_fr.png
www.proofpoint.com/sites/default/files/styles/image_1920_400/public/ 		463 KB
465 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/styles/image_1920_400/public/50-50-red-blue-cyber-computer_fr.png?itok=9DE4XTUf
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
63b2d3413527e6be879b07c75966031aa44f6cb5bde51bbd0637caf6a70b2148
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
last-modified
Fri, 28 Feb 2020 22:50:18 GMT
x-cdn
Incapsula
content-type
image/png
status
200
x-iinfo
4-64562008-64549155 2CNN RT(1584363883366 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185040, public
content-length
473668
expires
Mon, 30 Mar 2020 06:15:24 GMT
1_3.png
www.proofpoint.com/sites/default/files/ 		376 KB
378 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/1_3.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9a5fe71bab88e2f80f11da48bb0304cddd2cf86598664ae7f6d151db763ed205
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Sat, 07 Mar 2020 01:09:04 GMT
x-cdn
Incapsula
etag
"b17ad3e1"
content-type
image/png
status
200
x-iinfo
4-64562009-64553301 2CNN RT(1584363883367 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185020, public
content-length
384889
expires
Mon, 30 Mar 2020 06:15:03 GMT
2_2.png
www.proofpoint.com/sites/default/files/ 		308 KB
310 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/2_2.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e201c6599f6d1390d709f2dcc4d1d56641706870f6df0157bbe39624266732b7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Sat, 07 Mar 2020 01:09:04 GMT
x-cdn
Incapsula
etag
"99041d0f"
content-type
image/png
status
200
x-iinfo
4-64562010-64557488 2CNN RT(1584363883368 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185024, public
content-length
315727
expires
Mon, 30 Mar 2020 06:15:07 GMT
3_1.png
www.proofpoint.com/sites/default/files/ 		203 KB
205 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/3_1.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
f747df1f12b00cd24c460d53310903ad8130526b7ae5d0e1ff03eda3119851d3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Sat, 07 Mar 2020 01:09:04 GMT
x-cdn
Incapsula
etag
"aa3bcbad"
content-type
image/png
status
200
x-iinfo
4-64562011-64562012 2CNN RT(1584363883370 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185038, public
content-length
208003
expires
Mon, 30 Mar 2020 06:15:21 GMT
4_1.png
www.proofpoint.com/sites/default/files/ 		147 KB
148 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/4_1.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
17f5c975a699235ec4d13ff0316d5858cc90558ce13a0da2c4b161f831a3d45c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Sat, 07 Mar 2020 01:09:04 GMT
x-cdn
Incapsula
etag
"cf3abe7d"
content-type
image/png
status
200
x-iinfo
4-64562013-64562014 2CNN RT(1584363883372 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185025, public
content-length
150671
expires
Mon, 30 Mar 2020 06:15:08 GMT
5_1.png
www.proofpoint.com/sites/default/files/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/sites/default/files/5_1.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
b11e658fe407997ed2da169fe2264f87ef51b2da547ad6dba4edcd56dc6ce973
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
last-modified
Sat, 07 Mar 2020 01:09:04 GMT
x-cdn
Incapsula
etag
"ee32384f"
content-type
image/png
status
200
x-iinfo
4-64562016-64546955 2CNN RT(1584363883375 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185031, public
content-length
1082137
expires
Mon, 30 Mar 2020 06:15:15 GMT
conversion.js
www.googleadservices.com/pagead/ 		25 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
3313553da3835e8d600ef79759e28e82a993b452d256ac2d54122ba47c1c4a19
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9884
x-xss-protection
0
server
cafe
etag
10415477757488446564
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 16 Mar 2020 13:04:44 GMT
js_j39C49hhqlcyF5oMCzWPaO9L7wbx9u48u2gVN9aH5Rw.js
www.proofpoint.com/sites/default/files/js/ 		149 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/sites/default/files/js/js_j39C49hhqlcyF5oMCzWPaO9L7wbx9u48u2gVN9aH5Rw.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8f7f42e3d861aa5732179a0c0b358f68ef4bef06f1f6ee3cbb681537d687e51c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 28 Feb 2020 20:58:22 GMT
x-cdn
Incapsula
etag
"d0eb3a4a"
content-type
text/javascript
status
200
x-iinfo
4-64562001-0 0CNN RT(1584363883309 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1184432, public
content-length
52166
expires
Mon, 30 Mar 2020 06:05:15 GMT
geoip2.js
js.maxmind.com/js/apis/geoip2/v2.1/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.maxmind.com/js/apis/geoip2/v2.1/geoip2.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69666124ea4313cf5b2da94871c86acd68bcbc4d50b360fdebc4dc3b977dde21

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 12 Mar 2020 14:05:07 GMT
server
cloudflare
age
595
etag
W/"5e6a4193-f39"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
574eae845f7dd6d9-FRA
expires
Mon, 16 Mar 2020 17:04:44 GMT
js__bUnO36F-t-G1k5YxciIM4JKUwTXQUbaAYAmPlZGwhw.js
www.proofpoint.com/sites/default/files/js/ 		1 MB
411 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/sites/default/files/js/js__bUnO36F-t-G1k5YxciIM4JKUwTXQUbaAYAmPlZGwhw.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fdb5273b7e85fadf86d64e58c5c88833824a5304d74146da0180263e5646c21c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 13 Mar 2020 19:44:14 GMT
x-cdn
Incapsula
etag
"4d634cfe"
content-type
text/javascript
status
200
x-iinfo
4-64562006-0 0CNN RT(1584363883362 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1185027, public
content-length
420720
expires
Mon, 30 Mar 2020 06:15:10 GMT
_Incapsula_Resource
www.proofpoint.com/ 		120 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=841421962
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0c5835740961407ec9efd3ac269bce8cd314b5f7e07891bcec1920ed81f9599b

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
content-encoding
gzip
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
17620
content-type
application/javascript
css
fonts.googleapis.com/ 		12 KB
909 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0796293ec526d0aa2afcd3a403c1c8b5707863314cf4db4d1bac426ead264416
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 16 Mar 2020 13:04:44 GMT
server
ESF
date
Mon, 16 Mar 2020 13:04:44 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 16 Mar 2020 13:04:44 GMT
css
fonts.googleapis.com/ 		3 KB
774 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d2744f552cf0c5f39cffe1c8952c2b62424e7d9a110c01447c8947deda1290f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 16 Mar 2020 13:04:44 GMT
server
ESF
date
Mon, 16 Mar 2020 13:04:44 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 16 Mar 2020 13:04:44 GMT
truncated
/ 		209 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		221 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		204 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		221 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		720 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		444 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		606 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		685 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		460 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		465 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
blue-bg.png
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/blue-bg.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
5451119aa5fd566ad1bc22ab81193be0154f0e80c69a1b5d9c99d217f5737e3a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:17:55 GMT
x-cdn
Incapsula
etag
"8b9597e3"
content-type
image/png
status
200
x-iinfo
4-64562018-0 0CNN RT(1584363883383 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1184327, public
content-length
25228
expires
Mon, 30 Mar 2020 06:03:30 GMT
truncated
/ 		45 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2
fonts.gstatic.com/s/robotocondensed/v18/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/robotocondensed/v18/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 27 Feb 2020 08:46:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:22 GMT
server
sffe
age
1570698
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
10968
x-xss-protection
0
expires
Fri, 26 Feb 2021 08:46:26 GMT
Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2
fonts.gstatic.com/s/fjallaone/v7/ 		11 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/fjallaone/v7/Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
529e77ee17cf48e9ccbb5a64a0e59a1bbda0d9c011ee061f40b1aa189e8fabb8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 25 Feb 2020 02:44:46 GMT
x-content-type-options
nosniff
last-modified
Tue, 16 Jul 2019 23:50:02 GMT
server
sffe
age
1765198
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11668
x-xss-protection
0
expires
Wed, 24 Feb 2021 02:44:46 GMT
proofpoint.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/sites/default/files/css/css_dwCg3Uod1OyWqTW-XUQ5Fpjl57VZLR4af9izYdjVOiw.css
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:43 GMT
x-content-type-options
nosniff
last-modified
Fri, 07 Feb 2020 20:18:17 GMT
x-cdn
Incapsula
etag
"01c16c31"
status
200
x-iinfo
4-64562019-0 0CNN RT(1584363883385 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=1186053, public
content-length
18296
expires
Mon, 30 Mar 2020 06:32:16 GMT
gtm.js
www.googletagmanager.com/ 		177 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2a6fafaa67709d2e7763be06efa5347881a7c4f9a765038eec516780555241fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
39650
x-xss-protection
0
last-modified
Mon, 16 Mar 2020 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 16 Mar 2020 13:04:44 GMT
MP9Jyqtx.min.js
scripts.demandbase.com/ 		79 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/MP9Jyqtx.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.36 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-36.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f9c40d7a987e1aa7e7ec71e1abc90c88db8b0f048e114b8283864424f9f9b783

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
gzip
last-modified
Thu, 16 Jan 2020 17:44:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA53
vary
Accept-Encoding
x-cache
Miss from cloudfront
x-amz-version-id
YfD.E.jwlpl4EPs7BcU6tqtJwZJfwMt.
status
200
cache-control
public, max-age=3600
content-type
application/javascript; charset=utf-8
x-amz-cf-id
dtVwQqY2-0XAnbq_IDNbwmMJ0IhsjDOHv5ACqY0bzog2srp3ocnLTQ==
via
1.1 bae3e24625567f5728a5caa96d6b7669.cloudfront.net (CloudFront)
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1584363884290&cv=9&fst=1584363884290&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
231b1df001f6ce4dc3b6c76c566f01ee8c1573714788a7563f2a27267490b69b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1076
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
me
geoip-js.maxmind.com/geoip/v2.1/country/ 		771 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://geoip-js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Requested by
Host: js.maxmind.com
URL: https://js.maxmind.com/js/apis/geoip2/v2.1/geoip2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20b74eb15e776136d7dd5156b03e26c78e19453f26eb8b27cf9bda41fc878e5d

Request headers

Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
574eae86695f1e47-FRA
content-length
771
truncated
/ 		207 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
addthis_widget.js
s7.addthis.com/js/300/ 		0
0
_Incapsula_Resource
www.proofpoint.com/ 		1 B
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/_Incapsula_Resource?SWKMTFSR=1&e=0.2438800950214517
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain
/
www.google.com/pagead/1p-user-list/950296937/ 		42 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1584363884290&cv=9&fst=1584363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=1914259298&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1584363884290&cv=9&fst=1584363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=1914259298&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
DE.png
www.proofpoint.com/modules/custom/pp_i18n/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.proofpoint.com/modules/custom/pp_i18n/images/DE.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
last-modified
Mon, 20 Jan 2020 17:41:50 GMT
x-cdn
Incapsula
etag
"cc0c264c"
content-type
image/png
status
200
x-iinfo
4-64562063-64561730 2CNN RT(1584363883890 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=1185991, public
content-length
3329
expires
Mon, 30 Mar 2020 06:31:15 GMT
truncated
/ 		129 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca76057cd670f588df991cb00fb1f230de6cde0d7f19f21743981f12c69ab50a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		234 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87ca6b47a6b9474223f530e7b8ea424392eb664d0dd417d61c31da449a5f5c4f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
1872
date
Mon, 16 Mar 2020 12:33:32 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
18174
expires
Mon, 16 Mar 2020 14:33:32 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s07-in-f2.1e100.net
Software
cafe /
Resource Hash
332458d8d7043c9237ea48c995f93f4d47988640c7eea5f50d8c28e80323e77b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9953
x-xss-protection
0
server
cafe
etag
242256469415106277
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 16 Mar 2020 13:04:44 GMT
bat.js
bat.bing.com/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
60dee30fbb522239142324aeb60131e28d3d8e4890cf5eabe7213df0506f98c2

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
last-modified
Fri, 13 Mar 2020 04:51:11 GMT
x-msedge-ref
Ref A: 90763EE9085D497EBA419A3B24D340AC Ref B: FRAEDGE1110 Ref C: 2020-03-16T13:04:44Z
access-control-allow-origin
*
etag
"8094a4f3f8d51:0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7446
insight.min.js
snap.licdn.com/li.lms-analytics/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10c:39e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 16 Mar 2020 13:04:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 16:41:31 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=74041
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
uwt.js
static.ads-twitter.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
age
17419
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-fra19183-FRA
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1584363885.735864,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
hotjar-1456002.js
static.hotjar.com/c/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-1456002.js?sv=5
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.33.229 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
pkt-ams-k2-shared-ingress11
Software
/
Resource Hash
f63e0a5d9a688f5503536af5b1b48e14afbd8cde488dd82a8cfaf60d3ed90807
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript
section-io-tag
hotjar
age
0
status
200
access-control-max-age
600
section-io-cache
Miss
x-cache-hit
1
x-frame-options
SAMEORIGIN
etag
W/f43c195129aee58012c0e873a266dee5
vary
Accept-Encoding
section-io-origin-status
200
access-control-allow-origin
*
cache-control
max-age=60
section-io-origin-time-seconds
0.021
accept-ranges
bytes
section-io-id
6f6f111d7c28e7062a9f71324fc6d44a
section-origin-responded
true
quant.js
secure.quantserve.com/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.218 , United Kingdom, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
QS /
Resource Hash
e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Mon, 16 Mar 2020 13:04:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16-Mar-2020 13:04:44 GMT
Server
QS
Etag
M0-56c8c653
Vary
Accept-Encoding
Strict-Transport-Security
max-age=86400
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=604800
Connection
keep-alive
Content-Length
5651
Expires
Mon, 23 Mar 2020 13:04:44 GMT
s
ads.avocet.io/
Redirect Chain
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j
  • https://ads.avocet.io/s?bounce=true&add=5aba5f53ab79f7f51390a95a&ty=j
0
417 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.avocet.io/s?bounce=true&add=5aba5f53ab79f7f51390a95a&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.182.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-182-42.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Type
application/javascript
Content-Length
0
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Location
/s?bounce=true&add=5aba5f53ab79f7f51390a95a&ty=j
Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
79
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
j.php
dev.visualwebsiteoptimizer.com/ 		1 KB
991 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=359897&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&r=0.7243314888888821
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gbel1 /
Resource Hash
d2b5f4993988438dff2f3caa81d20e55434131ce55d81f88b59dab0c2c747a9c

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Mon, 16 Mar 2020 13:04:43 GMT
content-encoding
gzip
server
gbel1
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
via
1.1 google
content-type
application/javascript; charset=UTF-8
1594.js
tracking.g2crowd.com/attribution_tracking/conversions/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers
1644.js
tracking.g2crowd.com/attribution_tracking/conversions/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers
1645.js
tracking.g2crowd.com/attribution_tracking/conversions/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers
1646.js
tracking.g2crowd.com/attribution_tracking/conversions/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers
1647.js
tracking.g2crowd.com/attribution_tracking/conversions/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers
main.rtfl.js
visitor.reactful.com/dist/ 		270 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://visitor.reactful.com/dist/main.rtfl.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
c4a220432424eb8109e2cc0bf6855e684148e606337f706ba226873fdc003a66

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 12:55:52 GMT
content-encoding
gzip
server
Google Frontend
age
532
etag
"oGmJdw"
content-type
application/javascript; charset=UTF-8
status
200
x-cloud-trace-context
4da7ffff37666555c8832769f7c9fcba
cache-control
public, max-age=600
content-length
106718
expires
Mon, 16 Mar 2020 13:05:52 GMT
ip.json
api.company-target.com/api/v2/ 		436 B
933 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?key=8d20076343394d24eb8250e933d1560c
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.177 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-177.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5e8894443d301d20cb216b8dd9dc21d2fb6927ade05e56ea3a59eb6c64f67624

Request headers

Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA53
x-cache
Miss from cloudfront
status
200
request-id
e5c1a717-03f9-4556-bc79-dc0e6f4d6349
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LC7-iJlJQW9EAhHP-q1TjZ9lFVuSVu1mcC4fx3-EodeMohfGuemABA==
expires
Sun, 15 Mar 2020 13:04:44 GMT
s
ads.avocet.io/
Redirect Chain
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j
  • https://ads.avocet.io/s?bounce=true&add=5d1dcad3b00320110090d553&ty=j
0
417 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.avocet.io/s?bounce=true&add=5d1dcad3b00320110090d553&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.182.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-182-42.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Type
application/javascript
Content-Length
0
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

Location
/s?bounce=true&add=5d1dcad3b00320110090d553&ty=j
Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
79
P3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945
4788165.fls.doubleclick.net/ Frame A4D8
Redirect Chain
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945?
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945?
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://4788165.fls.doubleclick.net/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s24-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
4788165.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.proofpoint.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUkfzOyBSwggY7HOYdNdgwoqTc8EdGSH1M-P29WHyV9AoMaPPS-xrDq0mx8h
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.proofpoint.com/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Mon, 16 Mar 2020 13:04:44 GMT
expires
Mon, 16 Mar 2020 13:04:44 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
423
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Mon, 16 Mar 2020 13:04:44 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://4788165.fls.doubleclick.net/activityi;dc_pre=CM3cr7SHn-gCFSfDuwgdzqcGHA;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9071983050104.945?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
set-cookie
IDE=AHWqTUkfzOyBSwggY7HOYdNdgwoqTc8EdGSH1M-P29WHyV9AoMaPPS-xrDq0mx8h; expires=Sat, 10-Apr-2021 13:04:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
5dfsgn7m2kst.js
js.driftt.com/include/1584363900000/ 		136 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.driftt.com/include/1584363900000/5dfsgn7m2kst.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.153 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-153.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2e15a72f58fd09726c5af078b4db781e4a17fafd361a61b8ecce888d5643d46d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:00:49 GMT
content-encoding
gzip
x-amz-cf-pop
FRA53
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
status
200
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
last-modified
Fri, 13 Mar 2020 14:13:43 GMT
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=10
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Wurs0c9O-OquuHfSjXwAgjF4TC39-j5osmWqYlgCd_o9gioaZdv-FA==
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=5089696874775331693
4 B
482 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://attr.ml-api.io/?domain=proofpoint.com&pId=5089696874775331693
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.39 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-39.fra53.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Mar 2020 13:04:45 GMT
Via
1.1 65715c6e447bfc4ebcfb81f088c7e3f3.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53
x-amzn-RequestId
37453be0-b182-4ed9-8f16-315d9524d02b
X-Cache
Miss from cloudfront
Content-Type
image/jpeg
X-Amzn-Trace-Id
Root=1-5e6f796d-3eaf9b3c6c12413a7ba91f16;Sampled=0
Connection
keep-alive
x-amz-apigw-id
Je_pHEdhoAMFRkw=
Content-Length
4
X-Amz-Cf-Id
dU7m_Qv15tEw8bB2aALtm-K7erAA_DUcjk5KBIH2HUZK6goNxBK5Sg==

Redirect headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:47 GMT
AN-X-Request-Uuid
a1a6b07f-ca6a-4260-bc54-17429f2768c7
Content-Type
text/html; charset=utf-8
Server
nginx/1.13.4
Location
https://attr.ml-api.io/?domain=proofpoint.com&pId=5089696874775331693
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
82.102.19.132; 82.102.19.132; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.19:80
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1382653062
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CLP53rSHn-gCFa3Duwgdhu0EtQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
roundtrip.js
s.adroll.com/j/ 		34 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.196.159 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-196-159.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
2e8482bdd64c06f5dad92fc1e1efa5815f58f5664578a65a9b9ec783dacc9726

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
zw3gDafwdfmkA1kq9nPAA6cid7KliPGC
Content-Encoding
gzip
x-amz-request-id
CE15E065D7E22EED
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Length
10763
x-amz-id-2
wOrGMeC33EoelqOJ7dwwlkTLg9kqPkFTKyRMu/cmUvDcvHHYWzg4iOMJp7KtdjxIG8VI85OWS40=
Last-Modified
Thu, 27 Feb 2020 16:21:23 GMT
Server
AmazonS3
ETag
"6cffbe2b1eafeaff85a7f1d4ea035464"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theorie...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fcorporate-blog%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theorie...
0
132 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&time=1584363884750&liSync=true
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
0
x-li-uuid
NmHKIo/K/BXg/w6RwSoAAA==

Redirect headers

date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
linkedin-action
1
status
302
strict-transport-security
max-age=2592000
content-length
0
x-li-uuid
3f1yG4/K/BXwwHdyACsAAA==
server
Play
pragma
no-cache
x-li-pop
prod-efr5
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&time=1584363884750&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1023188722&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_gid=157786602.1584363885&gjid=733568023&_v=j81&z=1934920583
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583&slf_rd=1&random=3505886921
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583&slf_rd=1&random=3505886921
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=1290649664.1584363885&jid=486052692&_v=j81&z=1934920583&slf_rd=1&random=3505886921
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=1023188722&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&ul=en-us&de=UTF-8&dt=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=undefined&ea=undefined&_u=YEDAAEAB~&jid=&gjid=&cid=1290649664.1584363885&tid=UA-2257074-1&_gid=157786602.1584363885&gtm=2wg340MGR7P8X&z=72587129
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Tue, 10 Mar 2020 16:07:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
507447
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
93 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=17087961&Ver=2&mid=5f416c29-dbbc-8d08-c5e0-b3569f561e96&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&r=&lt=992&evt=pageLoad&msclkid=N&rn=195985
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
204
pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 4CA70125B37E443BADF5B8A86E260BF3 Ref B: FRAEDGE1110 Ref C: 2020-03-16T13:04:44Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1584363884771&cv=9&fst=1584363884771&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg340&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
34f9e341a7c47ac75ecf9a58e31cad28c6cf82f46533050e32051394fbd91048
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1090
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/ 		43 B
170 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nyk4d&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=0
content-length
65
x-xss-protection
0
x-response-time
117
pragma
no-cache
last-modified
Mon, 16 Mar 2020 13:04:44 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
e6c21ea2a0d4d513e66e9e4e7c8e29f1
x-transaction
00fba6e200c03b97
expires
Tue, 31 Mar 1981 05:00:00 GMT
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
218 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=359897&d=proofpoint.com&u=D33153EF36ED53C1DAF80FD9B589EAB0C&h=7abf50c501e9fe9b1ad20e0368a893f1&t=false&r=0.27625611634443903
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.96.102.137 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv3-c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv3-c
content-type
image/gif
status
200
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
modules.4fb2c8f41d571985b5a1.js
script.hotjar.com/ 		405 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.4fb2c8f41d571985b5a1.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.102.13 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS
pkt-ams-k2-shared-ingress1
Software
/
Resource Hash
01af78bf1a2fe98efcb2c8a4cf8c318607867799c005468e654bd104013c354b

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
br
content-type
application/javascript
age
263037
status
200
section-io-cache
Hit
content-length
74844
last-modified
Fri, 13 Mar 2020 11:57:43 GMT
etag
"d94a3a6748d1d63f2aea4fb25536c3ea"
vary
Accept-Encoding
section-io-origin-status
200
access-control-allow-origin
*
cache-control
max-age=31536000
section-io-origin-time-seconds
0.026
accept-ranges
bytes
section-io-id
97ebba23b83b19d302daa9e7dcb65e80
section-origin-responded
true
/
visitor.reactful.com/config/879986/ 		0
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&hash=&referer=&user_id=&hshkgid=da0a79da-fdc6-4424-bf9a-d030e9fee486&cb_rtfl=_rtfl_jsonp_0
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Referer
https://www.proofpoint.com/
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
url-params-data

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
server
Google Frontend
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-methods
GET
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
status
200
x-cloud-trace-context
353ab384eb80ad7cb001f2ffb55d9e61
cache-control
no-cache
access-control-allow-credentials
true
content-type
text/javascript
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Six-Sense-Data, Custom-Vars-Data, Url-Params-Data
content-length
0
expires
Mon, 16 Mar 2020 13:04:45 GMT
rules-p-R3wfD8YvtmDvY.js
rules.quantcount.com/ 		3 B
354 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-R3wfD8YvtmDvY.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2047:2800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:01:33 GMT
via
1.1 ac27d939fa02703c4b28926f53f95083.cloudfront.net (CloudFront)
last-modified
Fri, 03 Mar 2017 23:52:35 GMT
server
AmazonS3
age
194
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Error from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=300
x-amz-cf-pop
FRA53
accept-ranges
bytes
content-length
3
x-amz-cf-id
ya0U0M_WxNwLN0WTGmHXi0BaauF_dZoG8sMV-s3IWh3kAgB6R7K4WA==
box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame E0B8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.75.33.229 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
pkt-ams-k2-shared-ingress11
Software
/
Resource Hash

Request headers

:method
GET
:authority
vars.hotjar.com
:scheme
https
:path
/box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.proofpoint.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.proofpoint.com/

Response headers

status
200
date
Mon, 16 Mar 2020 13:04:44 GMT
content-type
text/html
content-length
851
last-modified
Wed, 29 Jan 2020 12:33:12 GMT
etag
"d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control
max-age=31536000
content-encoding
br
section-io-origin-status
200
section-io-origin-time-seconds
0.030
section-origin-responded
true
age
4062693
vary
Accept-Encoding
section-io-cache
Hit
accept-ranges
bytes
section-io-id
94575948a49b54b7df1c63a84f15ab66
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.196.159 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-196-159.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
FbUbM5VxCagu4G457bpSoLKm7GZl56QU
Content-Encoding
gzip
x-amz-request-id
5149B5CDB5551563
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 16 Mar 2020 13:04:45 GMT
Connection
keep-alive
Content-Length
48
x-amz-id-2
F8JvyaJcb7vQ1+MlcfoGjK83lEbNAh3YuxwP6fdJxZ3govdYzHxZDTaM/KoM0GMoef9aj9MjFGY=
Last-Modified
Wed, 11 Mar 2020 21:21:51 GMT
Server
AmazonS3
ETag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*

Redirect headers

Date
Mon, 16 Mar 2020 13:04:45 GMT
Server
AkamaiGHost
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
0
index.js
s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/ 		0
773 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.196.159 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-196-159.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
_tn9D2PanQditKrHWDenk.Ho_X6Yng_g
Content-Encoding
gzip
x-amz-request-id
59D6352797E008EE
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 16 Mar 2020 13:04:44 GMT
Connection
keep-alive
Content-Length
20
x-amz-id-2
dAkI9AWgHBFDne7acGlr07rSirZJOL24xXB6r/r+pVihfNgiBCjkCrZTCfojpUDgHUHb8xHJrx0=
Last-Modified
Sun, 15 Mar 2020 23:48:24 GMT
Server
AmazonS3
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
/
d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT/
Redirect Chain
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/7YJ7XZCLMRHSVCXIHB5HIT?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2
  • https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT/?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2
115 B
584 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT/?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.28.111 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-28-111.eu-west-1.compute.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
88abc59fee4d6efb376d4f04f4c5d2461dccd063a11cf1ca399a907df6d62d0b

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
200
cache-control
no-store, no-cache, must-revalidate
content-type
application/javascript
content-length
115

Redirect headers

status
302
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
content-length
105
location
https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT/?_s=ce1a44a5e06125fe5defa575679a33e0&_b=2
/
www.google.com/pagead/1p-user-list/950296937/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1584363884771&cv=9&fst=1584363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg340&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=266545958&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/ 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1584363884771&cv=9&fst=1584363600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg340&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&tiba=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=266545958&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ip.json
api.company-target.com/api/v2/ 		436 B
933 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&page_title=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&key=2e81efc731d57cb3e458d08fae112991&src=tag
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.177 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-177.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5e8894443d301d20cb216b8dd9dc21d2fb6927ade05e56ea3a59eb6c64f67624

Request headers

Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA53
x-cache
Miss from cloudfront
status
200
request-id
9b22b190-4c04-47cb-9a3a-5c1e4cb0c8f1
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 23082ff4de65f70078e091bc7cd0cf24.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2CvZCMdUM8B5nPPMBP4rkeT26CWd__4NvtZTNeO2jurNQudplSg5IA==
expires
Sun, 15 Mar 2020 13:04:45 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A&verifyHash=466ebc8e88da5a1e51ec39950a8a92eb0c450d1a
26 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A&verifyHash=466ebc8e88da5a1e51ec39950a8a92eb0c450d1a
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.73.44 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-73-44.fra2.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Mar 2020 13:04:45 GMT
Via
1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
b2eec03cace6917a
X-Amz-Cf-Id
05LJcfX4GEkNh-sUYs6k65G1_aMvUASo4CMsfH00PsU1UPzxkoVlAA==

Redirect headers

Date
Mon, 16 Mar 2020 13:04:45 GMT
Via
1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAEvjE683vMAABBH_fUw4A&verifyHash=466ebc8e88da5a1e51ec39950a8a92eb0c450d1a
Connection
keep-alive
trace-id
a7fc7867c4e89fb7
Content-Length
0
X-Amz-Cf-Id
D0gbIy6nia6r7p-NyruJhrIItpJ6LN1AvZTRSQGR9x98QwPJ528-Bw==
collect
www.google-analytics.com/ 		35 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&a=1023188722&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&ul=en-us&de=UTF-8&dt=Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHDAAEAB~&jid=&gjid=&cid=1290649664.1584363885&tid=UA-2257074-1&_gid=157786602.1584363885&gtm=2wg340MGR7P8X&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=Bot&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=Brussels&cd11=BRU&cd12=Belgium&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=(Non-Company%20Visitor)&z=9029430
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Tue, 10 Mar 2020 16:07:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
507448
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
visitor.reactful.com/config/879986/ 		14 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&hash=&referer=&user_id=&hshkgid=da0a79da-fdc6-4424-bf9a-d030e9fee486&cb_rtfl=_rtfl_jsonp_0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
ef9a70acd430ae60c9f9470101942717cc485bf50e956144d2de06cbcf34de96

Request headers

Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
Url-Params-Data
e30=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
gzip
server
Google Frontend
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin
https://www.proofpoint.com
x-cloud-trace-context
1aa4ff154ee3df2e79e7ad4bbb0c4d72
cache-control
no-cache
access-control-allow-credentials
true
content-type
text/html; charset=utf-8
access-control-allow-headers
Six-Sense-Data,Custom-Vars-Data,Url-Params-Data
content-length
4242
expires
Mon, 16 Mar 2020 13:04:45 GMT
T47Y2VPPABDUBJXFROMZZM.js
s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/
Redirect Chain
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&pv=80669905457.02022&cookie=&adroll_s_ref=&keyw=&arrfrr=h...
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.196.159 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-196-159.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5845e8453fb8ad463202d8314428e13413d953b87a024ab6eedb0e988e620c19

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
CrWRB59eU2p2YdPLeobyAOUsIoRnUeyf
Content-Encoding
gzip
x-amz-request-id
150B3D9C9FEFF4EB
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 16 Mar 2020 13:04:45 GMT
Connection
keep-alive
Content-Length
1529
x-amz-id-2
IS35jQG8dYde5WkjaE34SNExDZR+G52/1dAHjKlXDRM/09JHq5QFEUv3iDyslWRfq5u0KU3EKd4=
Last-Modified
Tue, 04 Feb 2020 02:23:07 GMT
Server
AmazonS3
ETag
"fb5bf8932022bf0d652c73d5f80ec463"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*

Redirect headers

date
Mon, 16 Mar 2020 13:04:45 GMT
x-segment-display-name
Visitors to Unsegmented Pages
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.16.1
x-rule
*
x-segment-eid
T47Y2VPPABDUBJXFROMZZM
location
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
YV5KYXXEJZATZCT37YRTMK
x-segment-name
*
x-advertisable-eid
7YJ7XZCLMRHSVCXIHB5HIT
x-conversion-currency
fbevents.js
connect.facebook.net/en_US/ 		126 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-27=":443"; ma=3600
content-length
30466
x-xss-protection
0
pragma
public
x-fb-debug
wSgHVNYGWyC/38FC4DU7TRw90HT7FvcYcDwXiuvr29aicukfkmSpHh5/oIqdjoh609DoeG732CkbKD8SRJxtbA==
x-fb-trip-id
1850256238
date
Mon, 16 Mar 2020 13:04:45 GMT, Mon, 16 Mar 2020 13:04:45 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
sendrolling.js
s.adroll.com/j/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.196.159 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-196-159.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
NM.EHVfGEDu2TYFqb1osrv1zRII373EC
Content-Encoding
gzip
x-amz-request-id
13BF3989F87AC377
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 16 Mar 2020 13:04:45 GMT
Connection
keep-alive
Content-Length
2039
x-amz-id-2
yH7MNTAQZuiOfMyS08sfaqxl2TQ/Bs5LIZExv4VHWT/9253Rpfzn/wH9Nffg+Cg7FcxM2PnQYJ8=
Last-Modified
Mon, 03 Feb 2020 20:32:06 GMT
Server
AmazonS3
ETag
"15441b08d0c4f93b1dd5f533cd361cd8"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain
  • https://d.adroll.com/cm/aol/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://pixel.advertising.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
  • https://pixel.advertising.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
  • https://ups.analytics.yahoo.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPb549c254-6786-11ea-b061-06...
0
977 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPb549c254-6786-11ea-b061-066448848130
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.106 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 16 Mar 2020 13:04:45 GMT
Server
ATS/7.1.2.106
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status
302
date
Mon, 16 Mar 2020 13:04:45 GMT
strict-transport-security
max-age=31536000
content-length
0
location
https://ups.analytics.yahoo.com/ups/55980/sync?uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UPb549c254-6786-11ea-b061-066448848130
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://d.adroll.com/cm/index/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885&C=1
43 B
1001 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885&C=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.197.53 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-197-53.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:45 GMT
Server
Apache
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 16 Mar 2020 13:04:45 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:45 GMT
Server
Apache
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expiration=1615899885&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
333
Expires
Mon, 16 Mar 2020 13:04:45 GMT
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://d.adroll.com/cm/n/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expires=365
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expires=365
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
image/gif
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
37b22a0c36bd84993dd2cda4a5e04b1d
Expires
0

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
location
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&expires=365
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
cache-control
no-store, no-cache, must-revalidate
content-length
124
cookie-sync
sync.outbrain.com/
Redirect Chain
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&rdrctExp=true
0
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&rdrctExp=true
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.95 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-TraceId
a35b038305fdc91f11ba88bf71afcaae
Date
Mon, 16 Mar 2020 13:04:45 GMT
Content-Length
0

Redirect headers

Location
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&rdrctExp=true
Date
Mon, 16 Mar 2020 13:04:45 GMT
X-TraceId
8401013002ddae353a9c7482ccab3b1d
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/
Redirect Chain
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...
1 B
886 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:45 GMT
X-lat
Pug22059:0:332
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Cache-Control
no-store, no-cache, private
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
X-Cnection
close
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
cache-control
no-store, no-cache, must-revalidate
content-length
220
in
d.adroll.com/cm/r/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
  • https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.28.111 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-28-111.eu-west-1.compute.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
200
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42

Redirect headers

date
Mon, 16 Mar 2020 13:04:45 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
location
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status
302
x-content-type-options
nosniff
content-length
0
x-xss-protection
1; mode=block
/
trc.taboola.com/sg/adroll-network/1/rtb-h/
Redirect Chain
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
0
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-vcl-time-ms
9
date
Mon, 16 Mar 2020 13:04:45 GMT
via
1.1 varnish
server
nginx
x-timer
S1584363885.424399,VS0,VE9
x-served-by
cache-hhn4024-HHN
x-cache
MISS
status
204
accept-ranges
bytes
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
location
https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
cache-control
no-store, no-cache, must-revalidate
content-length
111
xuid
eb2.3lift.com/
Redirect Chain
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://eb2.3lift.com/xuid?mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.98.188 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-98-188.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 16 Mar 2020 13:04:45 GMT
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length
37
content-type
image/gif

Redirect headers

status
302
date
Mon, 16 Mar 2020 13:04:45 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
/xuid?ld=1&mid=4714&xuid=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
43 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.155.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-155-31.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 16 Mar 2020 13:04:45 GMT
cache-control
no-cache, no-store, must-revalidate
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
43
content-type
image/gif

Redirect headers

status
302
date
Mon, 16 Mar 2020 13:04:45 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
setuid
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://ib.adnxs.com/setuid?entity=172&code=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=172&code=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.27 , Ascension Island, ASN29990 (ASN-APPNEX, US),
Reverse DNS
539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:47 GMT
AN-X-Request-Uuid
da9fec6b-fb58-4f4d-b91e-94a5320eebe5
Content-Type
image/gif
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
82.102.19.132; 82.102.19.132; 539.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.26:80
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
location
https://ib.adnxs.com/setuid?entity=172&code=YWI1N2U3NDk4NjZjYmIyN2FjZmMxN2IyOTMxZTA3OTY
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
cache-control
no-store, no-cache, must-revalidate
content-length
93
377928.gif
idsync.rlcdn.com/
Redirect Chain
  • https://d.adroll.com/cm/l/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://idsync.rlcdn.com/377928.gif?partner_uid=ab57e749866cbb27acfc17b2931e0796
0
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/377928.gif?partner_uid=ab57e749866cbb27acfc17b2931e0796
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
21.72.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
date
Mon, 16 Mar 2020 13:04:45 GMT
via
1.1 google
alt-svc
clear

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
location
https://idsync.rlcdn.com/377928.gif?partner_uid=ab57e749866cbb27acfc17b2931e0796
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
302
cache-control
no-store, no-cache, must-revalidate
content-length
86
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=ab57e749866cbb27acfc17b2931e0796
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=ab57e749866cbb27acfc17b2931e0796
43 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=ab57e749866cbb27acfc17b2931e0796
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.95.34.bc.googleusercontent.com
Software
OXGW/16.179.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
via
1.1 google
server
OXGW/16.179.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
status
200
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Mon, 16 Mar 2020 13:04:45 GMT
via
1.1 google
server
OXGW/16.179.0
location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=ab57e749866cbb27acfc17b2931e0796
p3p
CP="CUR ADM OUR NOR STA NID"
status
302
alt-svc
clear
content-length
0
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=09fa0c94a1dd1012519bd257ec1a45ef-1584363885110&xid_ch=f&advertisable=7YJ7XZCLMRHSVCXIHB5HIT&google_nid=adroll5
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=q1fnSYZsuyes_Beykx4Hlg
  • https://d.adroll.com/cm/g/in
42 B
538 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/g/in
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.28.111 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-28-111.eu-west-1.compute.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
nginx/1.16.1
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status
200
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 13:04:45 GMT
server
HTTP server (unknown)
location
https://d.adroll.com/cm/g/in
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
389545881899618
connect.facebook.net/signals/config/ 		447 KB
112 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/389545881899618?v=2.9.15&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
de01cfa09868330494bbf2a8157156aee6f827675d3f050c4b2ddbcf758e0d41
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-27=":443"; ma=3600
content-length
114918
x-xss-protection
0
pragma
public
x-fb-debug
+puySHnD5H3HoDanhZ5tFcTqccMfb0ULWLhnW5ri1NZ43cI9Ck+HbKmjZKAjKzlEhE2hDhALu6SGefAbglxK5g==
x-fb-trip-id
1850256238
date
Mon, 16 Mar 2020 13:04:45 GMT, Mon, 16 Mar 2020 13:04:45 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires
Sat, 01 Jan 2000 00:00:00 GMT
pixel;r=364671486;source=gtm;rf=0;a=p-R3wfD8YvtmDvY;url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories;fpan...
pixel.quantserve.com/ 		35 B
658 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=364671486;source=gtm;rf=0;a=p-R3wfD8YvtmDvY;url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories;fpan=1;fpa=P0-1437428289-1584363885307;ns=0;ce=1;qjs=1;qv=0e9a7da-20191205140709;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=1;et=1584363885306;tzo=-60;ogl=url.https%3A%2F%2Fwww%252Eproofpoint%252Ecom%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-t%2Ctitle.Attackers%20Expand%20Coronavirus-Themed%20Attacks%20and%20Prey%20on%20Conspiracy%20Theories%20%7C%20Pr%2Cdescription.Proofpoint%20researchers%20continue%20to%20monitor%20the%20latest%20news%20and%20reports%20around%20th
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.200 , United Kingdom, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Mon, 16 Mar 2020 13:04:45 GMT
Server
QS
Strict-Transport-Security
max-age=86400
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
/
www.facebook.com/tr/ 		44 B
257 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=389545881899618&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&rl=&if=false&ts=1584363885339&cd[segment_eid]=T47Y2VPPABDUBJXFROMZZM&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=29&fbp=fb.1.1584363885338.474218863&it=1584363885224&coo=false&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT, Mon, 16 Mar 2020 13:04:45 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-27=":443"; ma=3600
content-length
44
expires
Mon, 16 Mar 2020 13:04:45 GMT
nr-1167.min.js
js-agent.newrelic.com/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1167.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
gzip
x-amz-request-id
9F168BA697B778D0
x-cache
HIT
status
200
content-length
10178
x-amz-id-2
yYgBioLjCplIhDxMZm/PKonf0xZGo/IH9CxBrQAf8lWo1+WyLnApygFOHARQZ+4eJQtQu20EMwQ=
x-served-by
cache-hhn4032-HHN
last-modified
Fri, 07 Feb 2020 23:39:55 GMT
server
AmazonS3
x-timer
S1584363886.769258,VS0,VE0
etag
"8155781ab74e51eee2ead2c1d5902e63"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
21958
adsct
analytics.twitter.com/i/ 		31 B
284 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nyk4d&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fcorporate-blog%2Fpost%2Fattackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
124
pragma
no-cache
last-modified
Mon, 16 Mar 2020 13:04:45 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
b11e33ae557008f5e56bfe93754d465a
x-transaction
00ab1ae000361fc1
expires
Tue, 31 Mar 1981 05:00:00 GMT
index.html
js.driftt.com/deploy/assets/ Frame 0623 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://js.driftt.com/deploy/assets/index.html
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1584363900000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.150.153 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-150-153.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
js.driftt.com
:scheme
https
:path
/deploy/assets/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.proofpoint.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.proofpoint.com/

Response headers

status
200
content-type
text/html; charset=utf-8
content-length
894
server
nginx
last-modified
Fri, 13 Mar 2020 14:13:43 GMT
x-amz-server-side-encryption
AES256
accept-ranges
bytes
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
date
Mon, 16 Mar 2020 13:04:45 GMT
etag
"85fb2f538e928503383f2265213e62f0"
cache-control
max-age=10
x-cache
Hit from cloudfront
via
1.1 c483a0db2609b3ac0bb94a739fe72cc7.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53
x-amz-cf-id
hXNeQJ2-AR-rg3XLdWqnU1JZsWwmYjhAQzrfikm3OUN5hRztbnex0A==
0ae22ad83e
bam.nr-data.net/1/ 		57 B
146 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/0ae22ad83e?a=431033880&v=1167.2a4546b&to=bgQBYERQXBBWVBFbDldOIldCWF0NGEcEVQRmAgJXXlQ%3D&rst=2238&ref=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories&ap=27&be=531&fe=2210&dc=970&perf=%7B%22timing%22:%7B%22of%22:1584363883552,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:163,%22c%22:163,%22s%22:169,%22ce%22:178,%22rq%22:178,%22rp%22:524,%22rpe%22:529,%22dl%22:526,%22di%22:970,%22ds%22:971,%22de%22:992,%22dc%22:2210,%22l%22:2210,%22le%22:2211%7D,%22navigation%22:%7B%7D%7D&fp=754&fcp=754&at=QkMCFgxKTx4%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1167.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.18 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-6.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1
28e30534-7b98-4893-afb7-7c6fcce7d21e
https://www.proofpoint.com/ 		14 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
blob:https://www.proofpoint.com/28e30534-7b98-4893-afb7-7c6fcce7d21e
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef9a70acd430ae60c9f9470101942717cc485bf50e956144d2de06cbcf34de96

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Content-Length
14237
Content-Type
text/html
/
tracking.reactful.com/tracking/879986/ 		6 B
120 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tracking.reactful.com/tracking/879986/
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56

Request headers

Accept
*/*
Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 16 Mar 2020 13:04:45 GMT
content-encoding
gzip
server
Google Frontend
status
200
vary
Accept-Encoding
content-type
text/html; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
f04260e1359977fad7c885e0125fe805
cache-control
no-cache
content-length
26
css
fonts.googleapis.com/ 		25 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d3fb385aad2757e720c0e49ca0b807172ff255ad2dc2bf4b1998e632297800a9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 16 Mar 2020 13:04:45 GMT
server
ESF
date
Mon, 16 Mar 2020 13:04:45 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 16 Mar 2020 13:04:45 GMT
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 10 Mar 2020 17:19:07 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:37 GMT
server
sffe
age
503138
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9016
x-xss-protection
0
expires
Wed, 10 Mar 2021 17:19:07 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 24 Feb 2020 20:33:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
1787447
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9132
x-xss-protection
0
expires
Tue, 23 Feb 2021 20:33:58 GMT
/
tracking.reactful.com/tracking/879986/ 		6 B
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tracking.reactful.com/tracking/879986/
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56

Request headers

Accept
*/*
Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Mon, 16 Mar 2020 13:04:46 GMT
content-encoding
gzip
server
Google Frontend
status
200
vary
Accept-Encoding
content-type
text/html; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
32a84036afc0183b893b41fa35290dfc
cache-control
no-cache
content-length
26
0ae22ad83e
bam.nr-data.net/events/1/ 		24 B
185 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/events/1/0ae22ad83e?a=431033880&v=1167.2a4546b&to=bgQBYERQXBBWVBFbDldOIldCWF0NGEcEVQRmAgJXXlQ%3D&rst=12238&ref=https://www.proofpoint.com/us/corporate-blog/post/attackers-expand-coronavirus-themed-attacks-and-prey-conspiracy-theories
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1167.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.18 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-6.nr-data.net
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://www.proofpoint.com/
Origin
https://www.proofpoint.com
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.proofpoint.com
Access-Control-Allow-Credentials
true
Content-Length
24
Content-Type
image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
http://s7.addthis.com/js/300/addthis_widget.js?_=1584363884387

Verdicts & Comments Add Verdict or Comment

145 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| NREUM object| newrelic function| __nr_require object| Modernizr object| dataLayer object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_evaluemrc object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_disable_merchant_reported_conversions object| google_additional_conversion_params object| google_transport_url function| _ function| jQuery undefined| $ object| Backbone object| drupalSettings object| Drupal object| picturefillCFG function| picturefill object| geoip2 function| _toConsumableArray function| BaseClass object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| FontAwesomeConfig object| ___FONT_AWESOME___ object| __algolia function| subscribeToMarketoFormEvent object| addthis_config object| addthis_share function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| uetq string| _linkedin_data_partner_id function| twq function| hj object| _hjSettings object| _qevents object| vimeoGAJS object| _vwo_code number| settings_timer number| _vwo_settings_timer object| _rctfl string| axel number| a function| drift function| driftt string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded function| lintrk boolean| _already_called_lintrk object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| twttr function| UET function| google_trackConversion object| GooglebQhCsO undefined| b string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled function| quantserve function| __qc object| ezt object| _qoptions string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks undefined| adroll_tpc_callback function| __extends object| Demandbase object| __db function| DBSegment object| platform boolean| __DRIFTT_WIDGET_INCLUDED__ string| __DRIFT_INSTANCE_ID__ boolean| __DRIFTT_SHOW_WIDGET_ON_BOOT__ boolean| __adroll_consent boolean| __adroll_consent_is_gdpr object| __adroll_consent_data string| __adroll_consent_user_country string| __adroll_consent_adv_country number| adroll_xavier_called number| __adroll_xid_ch object| adroll_currency object| adroll_conversion_value object| adroll_conversion_value_in_dollars object| adroll_exp_list function| fbq function| _fbq object| _rctfl_track

15 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUkfzOyBSwggY7HOYdNdgwoqTc8EdGSH1M-P29WHyV9AoMaPPS-xrDq0mx8h
.proofpoint.com/ Name: _fbp
Value: fb.1.1584363885338.474218863
.www.proofpoint.com/ Name: __ar_v4
Value: %7C7YJ7XZCLMRHSVCXIHB5HIT%3A20200315%3A1%7CYV5KYXXEJZATZCT37YRTMK%3A20200315%3A1%7CT47Y2VPPABDUBJXFROMZZM%3A20200315%3A1
.proofpoint.com/ Name: _ga
Value: GA1.2.1290649664.1584363885
.www.proofpoint.com/ Name: __adroll_fpc
Value: 09fa0c94a1dd1012519bd257ec1a45ef-1584363885110
www.proofpoint.com/ Name: driftt_aid
Value: 3f0188b2-d3e8-4f45-883d-a93893085228
.www.proofpoint.com/ Name: _rtfl_s_handshake_guid
Value: da0a79da-fdc6-4424-bf9a-d030e9fee486
.proofpoint.com/ Name: _gat_UA-2257074-1
Value: 1
.proofpoint.com/ Name: _vwo_uuid_v2
Value: D33153EF36ED53C1DAF80FD9B589EAB0C|7abf50c501e9fe9b1ad20e0368a893f1
.proofpoint.com/ Name: _hjid
Value: cbf14d85-19cd-4d7d-a9d2-032a1c09f884
.proofpoint.com/ Name: _gid
Value: GA1.2.157786602.1584363885
.proofpoint.com/ Name: __qca
Value: P0-1437428289-1584363885307
.proofpoint.com/ Name: incap_ses_246_177663
Value: 5c7EI/qBAnx2mjYmFPhpA2t5b14AAAAAmMebIgzLAbmT/L44Y60xHg==
.proofpoint.com/ Name: visid_incap_177663
Value: 3XVNhd90SRSuoQrOLDDDCGp5b14AAAAAQUIPAAAAAAAwohJXPiQ9GayqoAgD8BH9
www.proofpoint.com/us/corporate-blog/post Name: pp_user_country
Value: de

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4788165.fls.doubleclick.net
ad.doubleclick.net
ads.avocet.io
ads.yahoo.com
adservice.google.com
analytics.twitter.com
api.company-target.com
attr.ml-api.io
bam.nr-data.net
bat.bing.com
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dev.visualwebsiteoptimizer.com
dsum-sec.casalemedia.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
geoip-js.maxmind.com
googleads.g.doubleclick.net
gwmtracking.com
ib.adnxs.com
idsync.rlcdn.com
js-agent.newrelic.com
js.driftt.com
js.maxmind.com
match.prod.bidr.io
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
px.ads.linkedin.com
rules.quantcount.com
s.adroll.com
s.ml-attr.com
s7.addthis.com
script.hotjar.com
scripts.demandbase.com
secure.adnxs.com
secure.quantserve.com
segments.company-target.com
simage2.pubmatic.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
t.co
tracking.g2crowd.com
tracking.reactful.com
trc.taboola.com
ups.analytics.yahoo.com
us-u.openx.net
vars.hotjar.com
visitor.reactful.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.proofpoint.com
x.bidswitch.net
s7.addthis.com
104.244.42.133
104.244.42.195
13.225.73.44
147.75.102.13
147.75.33.229
151.101.113.44
151.101.114.110
151.101.12.157
162.247.242.18
172.217.23.162
18.156.0.31
185.33.223.215
185.64.189.110
216.200.122.11
216.58.207.38
216.58.210.2
2600:9000:2047:2800:6:44e3:f8c0:93a1
2606:4700::6810:262f
2606:4700::6812:1bbe
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:806::2002
2a00:1450:4001:808::200a
2a00:1450:4001:814::2008
2a00:1450:4001:814::2013
2a00:1450:4001:815::200e
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::2002
2a00:1450:4001:820::2003
2a00:1450:4001:824::2004
2a00:1450:400c:c06::9d
2a02:26f0:10c:39e::25ea
2a02:e980:107::cf
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:10:101::b93f:9101
2a05:f500:10:101::b93f:9105
3.248.28.111
34.95.120.147
34.96.102.137
35.190.72.21
37.252.173.27
52.16.182.42
52.213.172.136
52.222.150.153
52.222.150.177
52.222.150.36
52.222.150.39
52.57.106.47
52.57.98.188
52.59.155.31
64.202.112.95
68.67.153.60
69.173.144.139
91.228.74.200
91.228.74.218
95.100.196.159
95.100.197.53
013ebc8682bafe775a56f93904cff8456974906327dad3524e2ab2fe0c0df700
01af78bf1a2fe98efcb2c8a4cf8c318607867799c005468e654bd104013c354b
0796293ec526d0aa2afcd3a403c1c8b5707863314cf4db4d1bac426ead264416
0c5835740961407ec9efd3ac269bce8cd314b5f7e07891bcec1920ed81f9599b
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
17f5c975a699235ec4d13ff0316d5858cc90558ce13a0da2c4b161f831a3d45c
1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d
1e06b3b8ed8d91022c8192923eb0d0a913596d088312b8bdc0c3b6dd2361627a
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70
20b74eb15e776136d7dd5156b03e26c78e19453f26eb8b27cf9bda41fc878e5d
231b1df001f6ce4dc3b6c76c566f01ee8c1573714788a7563f2a27267490b69b
2a6fafaa67709d2e7763be06efa5347881a7c4f9a765038eec516780555241fd
2cfe7c393d823154ee86def4c4eeeff7520b903871d93073ef7ad566a07ea92d
2e15a72f58fd09726c5af078b4db781e4a17fafd361a61b8ecce888d5643d46d
2e8482bdd64c06f5dad92fc1e1efa5815f58f5664578a65a9b9ec783dacc9726
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3313553da3835e8d600ef79759e28e82a993b452d256ac2d54122ba47c1c4a19
332458d8d7043c9237ea48c995f93f4d47988640c7eea5f50d8c28e80323e77b
34f9e341a7c47ac75ecf9a58e31cad28c6cf82f46533050e32051394fbd91048
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
4325dd5fcea2db3b145cd6ba8968c6cd50cb6232ee961c86be8b9adee360da25
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4
49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8
529e77ee17cf48e9ccbb5a64a0e59a1bbda0d9c011ee061f40b1aa189e8fabb8
5451119aa5fd566ad1bc22ab81193be0154f0e80c69a1b5d9c99d217f5737e3a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5845e8453fb8ad463202d8314428e13413d953b87a024ab6eedb0e988e620c19
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
5e8894443d301d20cb216b8dd9dc21d2fb6927ade05e56ea3a59eb6c64f67624
60dee30fbb522239142324aeb60131e28d3d8e4890cf5eabe7213df0506f98c2
63b2d3413527e6be879b07c75966031aa44f6cb5bde51bbd0637caf6a70b2148
69666124ea4313cf5b2da94871c86acd68bcbc4d50b360fdebc4dc3b977dde21
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b
7700a0dd4a1dd4ec96a935be5d44391698e5e7b5592d1e1a7fd8b361d8d53a2c
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87ca6b47a6b9474223f530e7b8ea424392eb664d0dd417d61c31da449a5f5c4f
88abc59fee4d6efb376d4f04f4c5d2461dccd063a11cf1ca399a907df6d62d0b
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
8f7f42e3d861aa5732179a0c0b358f68ef4bef06f1f6ee3cbb681537d687e51c
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564
9a5fe71bab88e2f80f11da48bb0304cddd2cf86598664ae7f6d151db763ed205
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b11e658fe407997ed2da169fe2264f87ef51b2da547ad6dba4edcd56dc6ce973
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712
c4a220432424eb8109e2cc0bf6855e684148e606337f706ba226873fdc003a66
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca76057cd670f588df991cb00fb1f230de6cde0d7f19f21743981f12c69ab50a
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43
cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b
d2744f552cf0c5f39cffe1c8952c2b62424e7d9a110c01447c8947deda1290f8
d2b5f4993988438dff2f3caa81d20e55434131ce55d81f88b59dab0c2c747a9c
d3fb385aad2757e720c0e49ca0b807172ff255ad2dc2bf4b1998e632297800a9
de01cfa09868330494bbf2a8157156aee6f827675d3f050c4b2ddbcf758e0d41
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293
e201c6599f6d1390d709f2dcc4d1d56641706870f6df0157bbe39624266732b7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8d7c60749c1d62942a8e0a6f901800bd14ff3094251373626cd99a8875c6391
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef9a70acd430ae60c9f9470101942717cc485bf50e956144d2de06cbcf34de96
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb
f4ae8a2c83e0a851fd331bbf34d7a6f9184b3e31b6f2e681e8377fb8a8edc10f
f522e640b4b821b068441a3c2deae8fed8263a3473339977167952f7fb88ecad
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f63e0a5d9a688f5503536af5b1b48e14afbd8cde488dd82a8cfaf60d3ed90807
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f747df1f12b00cd24c460d53310903ad8130526b7ae5d0e1ff03eda3119851d3
f9c40d7a987e1aa7e7ec71e1abc90c88db8b0f048e114b8283864424f9f9b783
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04
fdb5273b7e85fadf86d64e58c5c88833824a5304d74146da0180263e5646c21c