www.proofpoint.com Open in urlscan Pro
2a02:e980:d::87 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently...
Submission: On August 17 via api (August 17th 2019, 5:35:16 am UTC) from US

Summary HTTP 85 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 24 IPs in 7 countries across 26 domains to perform 85 HTTP transactions. The main IP is 2a02:e980:d::87, located in United States and belongs to INCAPSULA - Incapsula Inc, US. The main domain is www.proofpoint.com.
TLS certificate: Issued by Thawte RSA CA 2018 on January 11th 2019. Valid for: a year.

This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	2a02:e980:d::87 2a02:e980:d::87	19551 (INCAPSULA) (INCAPSULA - Incapsula Inc)
1	2606:4700::68... 2606:4700::6810:262f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	216.58.210.2 216.58.210.2	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	23.38.51.49 23.38.51.49	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2a02:26f0:6c0... 2a02:26f0:6c00:293::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	147.75.102.227 147.75.102.227	54825 (PACKET) (PACKET - Packet Host)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2 4	52.214.122.164 52.214.122.164	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	159.122.87.153 159.122.87.153	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
5	2606:4700::68... 2606:4700::6812:efe5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:809::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	216.200.122.11 216.200.122.11	6461 (ZAYO-6461) (ZAYO-6461 - Zayo Bandwidth)
2 2	172.217.23.166 172.217.23.166	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	2a00:1450:400... 2a00:1450:4001:816::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	147.75.84.99 147.75.84.99	54825 (PACKET) (PACKET - Packet Host)
1	2a00:1450:400... 2a00:1450:4001:80b::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
85	24

38 2a02:e980:d::87 (United States)

ASN19551 (INCAPSULA - Incapsula Inc, US)

www.proofpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:262f (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.38.51.49 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-51-49.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:293::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.227 (Central, Hong Kong)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-7

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.214.122.164 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-214-122-164.eu-west-1.compute.amazonaws.com

ads.avocet.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.122.87.153 (Frankfurt am Main, Germany)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 99.57.7a9f.ip4.static.sl-reverse.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:efe5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

visitor.reactful.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.122.11 (Everett, United States) 1 redirects

ASN6461 (ZAYO-6461 - Zayo Bandwidth, US)
PTR: 216.200.122.11.IPYX-141870-ZYO.zip.zayo.com

gwmtracking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.166 (United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f166.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:816::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.99 (Parsippany, United States)

ASN54825 (PACKET - Packet Host, Inc., US)

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

tracking.reactful.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	proofpoint.com www.proofpoint.com	2 MB
5	doubleclick.net 3 redirects ad.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	4 KB
5	g2crowd.com tracking.g2crowd.com
4	google.com 1 redirects adservice.google.com www.google.com	1 KB
4	avocet.io 2 redirects ads.avocet.io	2 KB
3	reactful.com visitor.reactful.com tracking.reactful.com	104 KB
3	facebook.net connect.facebook.net	97 KB
3	google-analytics.com 1 redirects www.google-analytics.com	44 KB
2	facebook.com www.facebook.com	546 B
2	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com	905 B
2	hotjar.com static.hotjar.com script.hotjar.com	73 KB
2	bing.com bat.bing.com	8 KB
2	gstatic.com fonts.gstatic.com	22 KB
2	googleapis.com fonts.googleapis.com	2 KB
2	googleadservices.com www.googleadservices.com	18 KB
1	google.de www.google.de	374 B
1	gwmtracking.com 1 redirects gwmtracking.com	375 B
1	bizographics.com sjs.bizographics.com	5 KB
1	googletagmanager.com www.googletagmanager.com	35 KB
1	typography.com cloud.typography.com
1	maxmind.com js.maxmind.com	2 KB
0	ml-attr.com Failed s.ml-attr.com Failed
0	company-target.com Failed api.company-target.com Failed
0	ads-twitter.com Failed static.ads-twitter.com Failed
0	demandbase.com Failed scripts.demandbase.com Failed
0	marketo.net Failed munchkin.marketo.net Failed
85	26

	Domain	Requested by
38	www.proofpoint.com	www.proofpoint.com
5	tracking.g2crowd.com	www.proofpoint.com
4	ads.avocet.io	2 redirects www.proofpoint.com
3	www.google.com	1 redirects www.proofpoint.com
3	connect.facebook.net	www.proofpoint.com connect.facebook.net
3	www.google-analytics.com	1 redirects www.proofpoint.com www.google-analytics.com
2	googleads.g.doubleclick.net	www.googleadservices.com
2	www.facebook.com	www.proofpoint.com
2	ad.doubleclick.net	2 redirects
2	visitor.reactful.com	www.proofpoint.com visitor.reactful.com
2	dev.visualwebsiteoptimizer.com	www.proofpoint.com
2	bat.bing.com	www.googletagmanager.com www.proofpoint.com
2	fonts.gstatic.com	www.proofpoint.com
2	fonts.googleapis.com	www.proofpoint.com
2	www.googleadservices.com	www.proofpoint.com www.googletagmanager.com
1	tracking.reactful.com	visitor.reactful.com
1	script.hotjar.com	static.hotjar.com
1	www.google.de	www.proofpoint.com
1	stats.g.doubleclick.net	1 redirects
1	adservice.google.com	www.proofpoint.com
1	gwmtracking.com	1 redirects
1	static.hotjar.com	www.googletagmanager.com
1	sjs.bizographics.com	www.googletagmanager.com
1	www.googletagmanager.com	www.proofpoint.com
1	cloud.typography.com	www.proofpoint.com
1	js.maxmind.com	www.proofpoint.com
0	s.ml-attr.com Failed	www.proofpoint.com
0	api.company-target.com Failed	www.proofpoint.com
0	static.ads-twitter.com Failed	www.googletagmanager.com
0	scripts.demandbase.com Failed	www.proofpoint.com
0	munchkin.marketo.net Failed	www.proofpoint.com
85	31

This site contains links to these domains. Also see Links.

Domain
proofpointcommunities.force.com
suite.nexgate.com
emaildefense.proofpoint.com
threatintel.proofpoint.com
mobiledefense.proofpoint.com
us1.proofpointessentials.com
partners.proofpoint.com
investors.proofpoint.com
github.com
en.wikipedia.org
twitter.com
www.recordedfuture.com
www.flashpoint-intel.com
ipcheck.proofpoint.com
www.facebook.com
www.twitter.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
proofpoint.com Thawte RSA CA 2018	`2019-01-11` - `2020-02-06`	a year	crt.sh
*.maxmind.com COMODO RSA Organization Validation Secure Server CA	`2018-10-15` - `2020-11-06`	2 years	crt.sh
www.googleadservices.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.typography.com DigiCert SHA2 Secure Server CA	`2019-03-23` - `2020-06-21`	a year	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2019-08-07` - `2019-11-05`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-06-06` - `2019-09-04`	3 months	crt.sh
*.avocet.io Amazon	`2019-07-06` - `2020-08-06`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2017-06-30` - `2020-07-06`	3 years	crt.sh
*.g2crowd.com COMODO ECC Domain Validation Secure Server CA	`2018-09-05` - `2019-09-28`	a year	crt.sh
*.reactful.com Go Daddy Secure Certificate Authority - G2	`2019-03-10` - `2020-05-09`	a year	crt.sh
www.google.de Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2019-08-07` - `2019-11-05`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
www.google.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Frame ID: 45590905A80AFDE0EA3D1C29A9615D31
Requests: 95 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Drupal (CMS) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Drupal(?:\s([\d.]+))?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Drupal(?:\s([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /^\/\/static\.hotjar\.com\/c\/hotjar-/i

Page Statistics

85
Requests

91 %
HTTPS

69 %
IPv6

26
Domains

31
Subdomains

24
IPs

7
Countries

2622 kB
Transfer

4671 kB
Size

0
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://proofpointcommunities.force.com/community/s/
Title: Support Log-in

Search URL Search Domain Scan URL

URL: https://suite.nexgate.com/users/sign_in
Title: Digital Risk Portal

Search URL Search Domain Scan URL

URL: https://emaildefense.proofpoint.com/login.php
Title: Email Fraud Defense

Search URL Search Domain Scan URL

URL: https://threatintel.proofpoint.com/
Title: ET Intelligence

Search URL Search Domain Scan URL

URL: https://mobiledefense.proofpoint.com/
Title: Mobile Defense

Search URL Search Domain Scan URL

URL: https://us1.proofpointessentials.com/app/login.php
Title: Proofpoint Essentials

Search URL Search Domain Scan URL

URL: https://proofpointcommunities.force.com/community
Title: Sendmail Support Log-in

Search URL Search Domain Scan URL

URL: https://partners.proofpoint.com/?eid=partnerLocator
Title: Find a Channel Partner

Search URL Search Domain Scan URL

URL: https://partners.proofpoint.com/?eid=register
Title: Become a Channel Partner

Search URL Search Domain Scan URL

URL: https://partners.proofpoint.com/
Title: Channel Partner Portal

Search URL Search Domain Scan URL

URL: https://investors.proofpoint.com/
Title: Investor Center View Proofpoint investor relations information, including press releases, financial results and events.

Search URL Search Domain Scan URL

URL: https://github.com/EmergingThreats/threatresearch/blob/master/kpot_stealer/decrypt_str.py
Title: https://github.com/EmergingThreats/threatresearch/blob/master/kpot_stealer/decrypt_str.py

Search URL Search Domain Scan URL

URL: https://github.com/EmergingThreats/threatresearch/blob/master/kpot_stealer/plaintext_strings.txt
Title: https://github.com/EmergingThreats/threatresearch/blob/master/kpot_stealer/plaintext_strings.txt

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/MurmurHash
Title: https://en.wikipedia.org/wiki/MurmurHash

Search URL Search Domain Scan URL

URL: https://twitter.com/sysopfb/status/1035177455667957760
Title: https://twitter.com/sysopfb/status/1035177455667957760

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States
Title: https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States

Search URL Search Domain Scan URL

URL: https://www.recordedfuture.com/ar3s-prison-release/
Title: https://www.recordedfuture.com/ar3s-prison-release/

Search URL Search Domain Scan URL

URL: https://www.flashpoint-intel.com/blog/malware-campaign-targets-jaxx-cryptocurrency-wallet-users/
Title: https://www.flashpoint-intel.com/blog/malware-campaign-targets-jaxx-cryptocurrency-wallet-users/

Search URL Search Domain Scan URL

URL: http://investors.proofpoint.com/
Title: Investors Center

Search URL Search Domain Scan URL

URL: https://ipcheck.proofpoint.com/
Title: IP Address Blocked?

Search URL Search Domain Scan URL

URL: http://www.facebook.com/proofpoint
Title: Facebook

Search URL Search Domain Scan URL

URL: http://www.twitter.com/proofpoint
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/proofpoint
Title: linkedin

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCIvtJgsrUzFo90NKeiVozhQ
Title: Youtube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65

https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j HTTP 302
https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&bounce=true&ty=j

Request Chain 74

https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j HTTP 302
https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&bounce=true&ty=j

Request Chain 76

https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1473061973 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Request Chain 77

https://www.google-analytics.com/r/collect?v=1&_v=j78&aip=1&a=1576888473&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&ul=en-us&de=UTF-8&dt=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBAAEADQ~&jid=1394251657&gjid=1812591251&cid=985055634.1566020082&tid=UA-2257074-1&_gid=737185877.1566020082&_r=1&z=1505824092 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_gid=737185877.1566020082&gjid=1812591251&_v=j78&z=1505824092 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092&slf_rd=1&random=1431013127

85 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal Show response
www.proofpoint.com/us/threat-insight/post/ 67 KB
20 KB 357ms
345ms Document
text/html 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

3298743d65f0655b9f76d93e93cbc2f54ba68ecc3e6bb988179757c80231bcad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.proofpoint.com
:scheme: https
:path: /us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Sat, 17 Aug 2019 05:34:41 GMT
content-type: text/html; charset=utf-8
x-drupal-cache: MISS
x-content-type-options: nosniff
etag: "1566013628-0"
expires: Sun, 18 Aug 2019 03:47:08 GMT
x-frame-options: SAMEORIGIN
content-language: en
x-generator: Drupal 7 (http://drupal.org)
link: <https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal>; rel="canonical",<https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal>; rel="shortlink"
cache-control: public, max-age=86400
last-modified: Sat, 17 Aug 2019 03:47:08 GMT
vary: Cookie,Accept-Encoding
content-encoding: gzip
x-request-id: v-afff4946-c0a1-11e9-b0e5-ffac7da9f062
x-ah-environment: prod
age: 6452
via: varnish
x-cache: HIT
x-cache-hits: 4
accept-ranges: bytes
set-cookie: visid_incap_177663=qXIAlk7ISIeciQyM3kQUJvCRV10AAAAAQUIPAAAAAABnYHfmCxIN9Zjo5S+EKSCU; expires=Sat, 15 Aug 2020 08:39:56 GMT; path=/; Domain=.proofpoint.com incap_ses_246_177663=4gJJB67e5Tcdmu7r4PdpA/GRV10AAAAAXUWifBLxGTANcY5g+k7S/w==; path=/; Domain=.proofpoint.com
x-iinfo: 14-100727938-100724003 PNNN RT(1566020080872 0) q(0 0 0 0) r(2 4) U18
x-cdn: Incapsula

GET
H2 200 css_rEI_5cK_B9hB4So2yZUtr5weuEV3heuAllCDE6XsIkI.css
www.proofpoint.com/sites/default/files/css/ 4 KB
1 KB 7ms
5ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/css/css_rEI_5cK_B9hB4So2yZUtr5weuEV3heuAllCDE6XsIkI.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: ac423fe5c2bf07d841e12a36c9952daf9c1eb8457785eb8096508313a5ec2242

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 22 Jul 2019 21:17:20 GMT
x-cdn: Incapsula
etag: "a03afbf5"
content-type: text/css
status: 200
x-iinfo: 14-100728024-0 0CNN RT(1566020081222 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 1236
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 css_dflN4gznpSoqyE-fQqvdVodUm8IHE1_6p9W67RzHBgo.css
www.proofpoint.com/sites/default/files/css/ 21 KB
5 KB 8ms
6ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/css/css_dflN4gznpSoqyE-fQqvdVodUm8IHE1_6p9W67RzHBgo.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 75f94de20ce7a52a2ac84f9f42abdd5687549bc207135ffaa7d5baed1cc7060a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Thu, 18 Jul 2019 22:51:13 GMT
x-cdn: Incapsula
etag: "e1b80d0d"
content-type: text/css
status: 200
x-iinfo: 14-100728025-0 0CNN RT(1566020081224 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 4794
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 css_YvthmAHmOujLQtPnmuEtkfiby4EqNavjYNQ2dGZqvJg.css
www.proofpoint.com/sites/default/files/css/ 5 KB
2 KB 9ms
7ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/css/css_YvthmAHmOujLQtPnmuEtkfiby4EqNavjYNQ2dGZqvJg.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 62fb619801e63ae8cb42d3e79ae12d91f89bcb812a35abe360d43674666abc98

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 22 Jul 2019 21:17:21 GMT
x-cdn: Incapsula
etag: "f67e2f41"
content-type: text/css
status: 200
x-iinfo: 14-100728026-0 0CNN RT(1566020081225 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 1532
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 styles.css
www.proofpoint.com/sites/all/themes/proofpoint/css/ 341 KB
47 KB 10ms
8ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 40c2df11fbebad9e05c5dfc4f9aad292a399642492254bc628e234089ec4e89b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 02 Aug 2019 23:10:22 GMT
x-cdn: Incapsula
content-type: text/css
status: 200
x-iinfo: 14-100728027-0 0CNN RT(1566020081226 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 47890
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 proofpoint.css
www.proofpoint.com/sites/all/themes/proofpoint/css/ 1008 B
544 B 16ms
13ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/css/proofpoint.css?pwd29m
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: c6687d159fd14a00a4b187ecfa840c0e21d5a28f352003295d8508190fbdd826

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 07 Dec 2018 08:47:10 GMT
x-cdn: Incapsula
content-type: text/css
status: 200
x-iinfo: 14-100728028-0 0CNN RT(1566020081227 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 439
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 css_BrVgfOKhtkZMh1aQSbCs0fpt2AudRCY30O33nWe_hig.css
www.proofpoint.com/sites/default/files/css/ 197 KB
76 KB 16ms
14ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/css/css_BrVgfOKhtkZMh1aQSbCs0fpt2AudRCY30O33nWe_hig.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 06b5607ce2a1b6464c87569049b0acd1fa6dd80b9d442637d0edf79d67bf8628

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 16 Aug 2019 22:50:44 GMT
x-cdn: Incapsula
etag: "35d9f265"
content-type: text/css
status: 200
x-iinfo: 14-100728029-0 0CNN RT(1566020081229 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 77298
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 css_nQwtytNsztHNRD8oGYQyyja_LgjxLi44qLISIPyImuw.css
www.proofpoint.com/sites/default/files/css/ 113 B
228 B 24ms
22ms Stylesheet
text/css 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/css/css_nQwtytNsztHNRD8oGYQyyja_LgjxLi44qLISIPyImuw.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 9d0c2dcad36cced1cd443f28198432ca36bf2e08f12e2e38a8b21220fc889aec

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 12 Aug 2019 19:21:25 GMT
x-cdn: Incapsula
etag: "3c611d61"
content-type: text/css
status: 200
x-iinfo: 14-100728030-0 0CNN RT(1566020081230 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 113
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 js_jATlw3iucl8O1KM88pfP_buAg5xbrWmEgBVT94k-xFs.js Show response
www.proofpoint.com/sites/default/files/js/ 3 KB
2 KB 24ms
22ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_jATlw3iucl8O1KM88pfP_buAg5xbrWmEgBVT94k-xFs.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 8c04e5c378ae725f0ed4a33cf297cffdbb80839c5bad6984801553f7893ec45b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 22 Jul 2019 21:17:24 GMT
x-cdn: Incapsula
etag: "d70c6bae"
content-type: text/javascript
status: 200
x-iinfo: 14-100728031-0 0CNN RT(1566020081230 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 1583
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 js_Sd3E1-ubI8_oPJ3epUeNgAhdPIZsHFWzDl_t8nL-a0k.js Show response
www.proofpoint.com/sites/default/files/js/ 286 KB
86 KB 24ms
22ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_Sd3E1-ubI8_oPJ3epUeNgAhdPIZsHFWzDl_t8nL-a0k.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 49ddc4d7eb9b23cfe83c9ddea5478d80085d3c866c1c55b30e5fedf272fe6b49

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Jul 2019 00:13:20 GMT
x-cdn: Incapsula
etag: "8d8cec88"
content-type: text/javascript
status: 200
x-iinfo: 14-100728032-0 0CNN RT(1566020081231 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201199, public
content-length: 87383
expires: Sat, 31 Aug 2019 03:14:40 GMT

GET
H2 200 js_5vQZfnw555SB_O3f6hT7WgFdY4KMR-8z4yzVohnQouU.js Show response
www.proofpoint.com/sites/default/files/js/ 32 KB
11 KB 33ms
32ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_5vQZfnw555SB_O3f6hT7WgFdY4KMR-8z4yzVohnQouU.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: e6f4197e7c39e79481fceddfea14fb5a015d63828c47ef33e32cd5a219d0a2e5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Jul 2019 00:13:20 GMT
x-cdn: Incapsula
etag: "04b95502"
content-type: text/javascript
status: 200
x-iinfo: 14-100728033-0 0CNN RT(1566020081232 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 10968
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 js_oYQw43wAjKdM3p6nU1hLDI3mDgL3UfCyqPsngNU6GnY.js Show response
www.proofpoint.com/sites/default/files/js/ 2 KB
716 B 34ms
32ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_oYQw43wAjKdM3p6nU1hLDI3mDgL3UfCyqPsngNU6GnY.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: a18430e37c008ca74cde9ea753584b0c8de60e02f751f0b2a8fb2780d53a1a76

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 12 Aug 2019 19:21:26 GMT
x-cdn: Incapsula
etag: "f5226ed5"
content-type: text/javascript
status: 200
x-iinfo: 14-100728034-0 0CNN RT(1566020081232 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 600
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 js_zDz6OD0aee_SzC8Md9FNnnSFgxJWG22Pihtjt166tQA.js Show response
www.proofpoint.com/sites/default/files/js/ 78 KB
28 KB 34ms
32ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_zDz6OD0aee_SzC8Md9FNnnSFgxJWG22Pihtjt166tQA.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: cc3cfa383d1a79efd2cc2f0c77d14d9e74858312561b6d8f8a1b63b75ebab500

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Jul 2019 00:14:34 GMT
x-cdn: Incapsula
etag: "3f7241c5"
content-type: text/javascript
status: 200
x-iinfo: 14-100728035-0 0CNN RT(1566020081233 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201464, public
content-length: 28482
expires: Sat, 31 Aug 2019 03:19:05 GMT

GET
H2 200 js_V59Lq7kRtaAiYM_YS8pC0OFMBYJk_jt8nNK4UA1wlGk.js Show response
www.proofpoint.com/sites/default/files/js/ 8 KB
2 KB 37ms
36ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_V59Lq7kRtaAiYM_YS8pC0OFMBYJk_jt8nNK4UA1wlGk.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 579f4babb911b5a02260cfd84bca42d0e14c058264fe3b7c9cd2b8500d709469

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 02 Aug 2019 23:10:38 GMT
x-cdn: Incapsula
etag: "240d3ade"
content-type: text/javascript
status: 200
x-iinfo: 14-100728036-0 0CNN RT(1566020081234 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 1934
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 geoip2.js Show response
js.maxmind.com/js/apis/geoip2/v2.1/ 4 KB
2 KB 35ms
19ms Script
application/javascript 2606:4700::6810:262f
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/js/apis/geoip2/v2.1/geoip2.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69666124ea4313cf5b2da94871c86acd68bcbc4d50b360fdebc4dc3b977dde21

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 15 Aug 2019 18:06:10 GMT
server: cloudflare
age: 1517
etag: W/"5d559f12-f39"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=43200
cf-ray: 507947c6f9bac286-FRA
expires: Sat, 17 Aug 2019 17:34:41 GMT

GET
H2 200 js_W5fEOeIW0TWunhDVrtJI2tfSDJsF5U0-qYgg5VUhN50.js Show response
www.proofpoint.com/sites/default/files/js/ 13 KB
4 KB 37ms
36ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_W5fEOeIW0TWunhDVrtJI2tfSDJsF5U0-qYgg5VUhN50.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 5b97c439e216d135ae9e10d5aed248dad7d20c9b05e54d3ea98820e55521379d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Mon, 12 Aug 2019 19:21:26 GMT
x-cdn: Incapsula
etag: "d82693c3"
content-type: text/javascript
status: 200
x-iinfo: 14-100728037-0 0CNN RT(1566020081234 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201198, public
content-length: 3712
expires: Sat, 31 Aug 2019 03:14:39 GMT

GET
H2 200 js_QYIwceR_SVGaqvz86mmMZdtTBRKXyXKeCBDanqK3AoM.js Show response
www.proofpoint.com/sites/default/files/js/ 146 KB
43 KB 38ms
37ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_QYIwceR_SVGaqvz86mmMZdtTBRKXyXKeCBDanqK3AoM.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 41823071e47f49519aaafcfcea698c65db53051297c9729e0810da9ea2b70283

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 16 Aug 2019 22:50:44 GMT
x-cdn: Incapsula
etag: "3ecef68e"
content-type: text/javascript
status: 200
x-iinfo: 14-100728038-0 0CNN RT(1566020081235 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201199, public
content-length: 43727
expires: Sat, 31 Aug 2019 03:14:40 GMT

GET
H2 200 logo-reg.svg
www.proofpoint.com/sites/all/themes/proofpoint/ 3 KB
1 KB 41ms
41ms Image
image/svg+xml 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/logo-reg.svg
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 07 Dec 2018 08:47:10 GMT
x-cdn: Incapsula
etag: "13fdd2ef"
content-type: image/svg+xml
status: 200
x-iinfo: 14-100728039-0 0CNN RT(1566020081235 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209585, public
content-length: 1124
expires: Sat, 31 Aug 2019 05:34:26 GMT

GET
H2 200 cybersecurity-guide.png
www.proofpoint.com/sites/all/themes/proofpoint/images/ 120 KB
120 KB 41ms
41ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/images/cybersecurity-guide.png
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 3140e03d8dd88ddfc2a9eefc88a3ae4b233c3f6182423775f83e22e16d072cd5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
last-modified: Wed, 24 Apr 2019 16:02:59 GMT
x-cdn: Incapsula
etag: "a3bc78f0"
content-type: image/png
status: 200
x-iinfo: 14-100728040-0 0CNN RT(1566020081237 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201199, public
content-length: 123158
expires: Sat, 31 Aug 2019 03:14:40 GMT

GET
H2 200 home.svg
www.proofpoint.com/sites/all/themes/proofpoint/images/ 784 B
634 B 9ms
6ms Image
image/svg+xml 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/images/home.svg
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Tue, 18 Jun 2019 16:19:41 GMT
x-cdn: Incapsula
etag: "4c25cdee"
content-type: image/svg+xml
status: 200
x-iinfo: 14-100728123-0 0CNN RT(1566020081601 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209586, public
content-length: 477
expires: Sat, 31 Aug 2019 05:34:27 GMT

GET
H2 200 potsmall.jpg
www.proofpoint.com/sites/default/files/styles/image_1920_x_400/public/images/Blog/ 193 KB
194 KB 366ms
363ms Image
image/jpeg 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/styles/image_1920_x_400/public/images/Blog/potsmall.jpg?itok=2xFS58Kx&timestamp=1557417410

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

84e2984a7564e795341d3738457b47eb414940549fed7b8053ece1c207689904

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728124-100721537 2NNN RT(1566020081602 0) q(0 0 0 -1) r(3 3) U18
x-ah-environment: prod
content-length: 197161
x-request-id: v-b69d0cde-c0b0-11e9-bee3-ff495579a37f
last-modified: Thu, 09 May 2019 16:09:04 GMT
server: nginx
content-type: image/jpeg
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf1.png
www.proofpoint.com/sites/default/files/ 192 KB
193 KB 415ms
412ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf1.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

5bc7470012f87caff6788f0ebf60682f952c7a0964ad3b2cca2a61bbce18f6ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728125-100710229 2NNN RT(1566020081603 0) q(0 0 0 -1) r(4 4) U18
x-ah-environment: prod
content-length: 196550
x-request-id: v-b69d3434-c0b0-11e9-a584-dfc6e0517b67
last-modified: Thu, 09 May 2019 16:01:12 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf2.png
www.proofpoint.com/sites/default/files/ 175 KB
176 KB 360ms
358ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf2.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

5ac2e3c736481deec2191dd546e7cdda5882014a98bd17a2d04472e70e33b196

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728127-100721572 2NNN RT(1566020081605 0) q(0 0 0 -1) r(3 3) U18
x-ah-environment: prod
content-length: 179180
x-request-id: v-b69d3ad8-c0b0-11e9-832c-fb825b6c727b
last-modified: Thu, 09 May 2019 16:01:36 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf3.png
www.proofpoint.com/sites/default/files/ 167 KB
169 KB 363ms
361ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf3.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

aa83a25b734f0cb82f0dd65c7cfaa5cfc535eb74aedfede313c0e8f9675f9cc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728128-100721524 2NNN RT(1566020081606 0) q(0 0 0 -1) r(3 3) U18
x-ah-environment: prod
content-length: 171370
x-request-id: v-b69d8b64-c0b0-11e9-8b99-27b5ea4b1677
last-modified: Thu, 09 May 2019 16:02:08 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf4.png
www.proofpoint.com/sites/default/files/ 82 KB
83 KB 345ms
343ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf4.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

0392ee492efd6bc95e9cb5f2c006712e3d9882722f9baa6f0d3cc94f31c2a436

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728129-100703335 2NNN RT(1566020081606 0) q(0 0 0 -1) r(3 3) U18
x-ah-environment: prod
content-length: 83854
x-request-id: v-b69da3f6-c0b0-11e9-93e4-6382bb9aad6e
last-modified: Thu, 09 May 2019 16:02:58 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf5.png
www.proofpoint.com/sites/default/files/ 85 KB
86 KB 404ms
402ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf5.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

fcc7b3aab1606a93ae54fda2d71fb87e43c50279cc5f28ed5b725abe64a821a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728130-100724166 2NNN RT(1566020081607 0) q(0 0 0 -1) r(3 3) U18
x-ah-environment: prod
content-length: 87253
x-request-id: v-b69eec7a-c0b0-11e9-8f5a-cbbd94d7d141
last-modified: Thu, 09 May 2019 16:04:45 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf6.png
www.proofpoint.com/sites/default/files/ 38 KB
38 KB 842ms
840ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf6.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

a259cd28565f7f3ea729a5add643412dd3ecd8616cfd4bf7f9b836cce9811147

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728131-100728250 2NNN RT(1566020081608 0) q(0 4 4 -1) r(4 8) U18
x-ah-environment: prod
content-length: 38938
x-request-id: v-b6e85536-c0b0-11e9-8c5e-13ca80935953
last-modified: Thu, 09 May 2019 16:05:13 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf7.png
www.proofpoint.com/sites/default/files/ 164 KB
165 KB 910ms
908ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf7.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

2052dd77390bdc41acf8fad615d0ccbbd8abda68a79b48ea3e46233d16df6ec6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728132-100728266 2NNN RT(1566020081608 0) q(0 5 5 -1) r(5 9) U18
x-ah-environment: prod
content-length: 167500
x-request-id: v-b6f32a4c-c0b0-11e9-8e20-cbddd256cf67
last-modified: Thu, 09 May 2019 16:05:53 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf8.png
www.proofpoint.com/sites/default/files/ 272 KB
274 KB 875ms
873ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf8.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

1c7ed120c789a83c1d7124bca5e2b01aa37cdff317a54af549bf288b536a263f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728133-100721572 2NNN RT(1566020081609 0) q(0 6 6 -1) r(8 8) U18
x-ah-environment: prod
content-length: 278896
x-request-id: v-b70326d6-c0b0-11e9-b1ac-4f4300dd9632
last-modified: Thu, 09 May 2019 16:06:35 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf9.png
www.proofpoint.com/sites/default/files/ 172 KB
173 KB 885ms
884ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf9.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

d8685b85520677383b178f46734ec8e55d6a3050700bd5478c92fb34970f38d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728134-100724166 2NNN RT(1566020081609 0) q(0 6 6 -1) r(8 8) U18
x-ah-environment: prod
content-length: 176138
x-request-id: v-b705c88c-c0b0-11e9-847a-2b5497a4ced4
last-modified: Thu, 09 May 2019 16:07:01 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 kpf10.png
www.proofpoint.com/sites/default/files/ 72 KB
72 KB 903ms
902ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.proofpoint.com/sites/default/files/kpf10.png

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

87cbc1a35e62d41af5719f380e3a7bc8129427bd982c1e696bd74453f7c5471a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
via: varnish
x-content-type-options: nosniff
x-cdn: Incapsula
age: 0
x-cache: MISS
status: 200
x-iinfo: 14-100728135-100703335 2NNN RT(1566020081610 0) q(0 7 7 -1) r(8 8) U18
x-ah-environment: prod
content-length: 73570
x-request-id: v-b70b9456-c0b0-11e9-b6d1-b7a9ddd6e8ee
last-modified: Thu, 09 May 2019 16:07:27 GMT
server: nginx
content-type: image/png
cache-control: max-age=1209600
accept-ranges: bytes
expires: Sat, 31 Aug 2019 05:34:42 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 24 KB
9 KB 7225ms
79ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

94880f4d8b391421ea1a5447903697dbc761d879cf9ec89faa637d0bf2f331c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 9355
x-xss-protection: 0
server: cafe
etag: 4252369854121413696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 17 Aug 2019 05:34:48 GMT

GET
H2 200 js_VGWVxZzZSi3YQD4B3uHe9fBD5c_2NSz4TEx3cL9dx1Q.js Show response
www.proofpoint.com/sites/default/files/js/ 78 KB
19 KB 6ms
6ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_VGWVxZzZSi3YQD4B3uHe9fBD5c_2NSz4TEx3cL9dx1Q.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 546595c59cd94a2dd8403e01dee1def5f043e5cff6352cf84c4c7770bf5dc754

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Jul 2019 00:13:20 GMT
x-cdn: Incapsula
etag: "e5a57fbc"
content-type: text/javascript
status: 200
x-iinfo: 14-100728054-0 0CNN RT(1566020081279 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201199, public
content-length: 19613
expires: Sat, 31 Aug 2019 03:14:40 GMT

GET
H2 200 js_pLyroj8w56o5oEuhy9M3_UPhli8Yg1Zq5LxhrROPoWs.js Show response
www.proofpoint.com/sites/default/files/js/ 11 KB
4 KB 6ms
6ms Script
text/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/default/files/js/js_pLyroj8w56o5oEuhy9M3_UPhli8Yg1Zq5LxhrROPoWs.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: a4bcaba23f30e7aa39a04ba1cbd337fd43e1962f1883566ae4bc61ad138fa16b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Jul 2019 00:13:44 GMT
x-cdn: Incapsula
etag: "7b7608a9"
content-type: text/javascript
status: 200
x-iinfo: 14-100728057-0 0CNN RT(1566020081286 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201464, public
content-length: 4376
expires: Sat, 31 Aug 2019 03:19:05 GMT

GET munchkin.js
munchkin.marketo.net/ 0
0

GET
H2 200 script.js Show response
www.proofpoint.com/sites/all/themes/proofpoint/js/ 23 KB
6 KB 7ms
4ms Script
application/javascript 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/js/script.js?pwd29m
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: c42a41f50ddc0d98adce6ed747e7a4ccef6278990d7f7413ecde1284ecb9d530

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Wed, 14 Aug 2019 00:14:19 GMT
x-cdn: Incapsula
content-type: application/javascript
status: 200
x-iinfo: 14-100728121-0 0CNN RT(1566020081598 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201199, public
content-length: 5890
expires: Sat, 31 Aug 2019 03:14:40 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
987 B 29ms
17ms Stylesheet
text/css 2a00:1450:4001:806::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

7772e3d0bc6fba46755057c1ca0154dfda1100214439321c2702fa8ad468158b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 17 Aug 2019 05:34:41 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Sat, 17 Aug 2019 05:34:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Sat, 17 Aug 2019 05:34:41 GMT

GET
H/1.1 404
Not Found fonts.css
cloud.typography.com/7639856/7486392/css/ 0
0 320ms
269ms Stylesheet
text/html 23.38.51.49
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.typography.com/7639856/7486392/css/fonts.css
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.38.51.49 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-38-51-49.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 17 Aug 2019 05:34:42 GMT
Cache-Control: must-revalidate, private
Server: Apache
Connection: keep-alive
Content-Length: 16
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 css
fonts.googleapis.com/ 3 KB
630 B 29ms
17ms Stylesheet
text/css 2a00:1450:4001:806::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

74166c3ce466a4afbab3fee3dc53106c377de2217ddb142774eb4b59fe65c6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sat, 17 Aug 2019 05:34:41 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Sat, 17 Aug 2019 05:34:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Sat, 17 Aug 2019 05:34:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 17ms
5ms Script
text/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Jul 2019 21:35:27 GMT
server: Golfe2
age: 7092
date: Sat, 17 Aug 2019 03:36:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17724
expires: Sat, 17 Aug 2019 05:36:30 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 149 KB
35 KB 27ms
15ms Script
application/javascript 2a00:1450:4001:80b::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d3296d651831055b3b820704b0ea74a23c6a782299f92b42ea53f28925460ce8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
content-encoding: br
last-modified: Sat, 17 Aug 2019 03:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 35860
x-xss-protection: 0
expires: Sat, 17 Aug 2019 05:34:42 GMT

GET MP9Jyqtx.min.js
scripts.demandbase.com/ 0
0

GET
DATA 200
OK truncated
/ 251 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 46454a26b3142dec4540c21c9c156f2b3e570488667f1bbcf81854e27925f2a4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 263 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 479f333c6cdf10724e19b33079cab821bb37b0a463170ea9943dcbc0c6d9dc67

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91221ebe7decdf80fc3cfddffa7595ff915be4af1a9a5620fc9c138bf6cc0363

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 562 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8bac03a9bf9bff1a50a992ffe70257f2c6a24e0cc79ba4c268baf19c9ca2880

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 588 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 047ef44b759411ac70b47ffb1c29a2814d34ec9aa7cf12a927340128500bc9fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7e6695bf782bd4b52cc817b8adba3d03973c348cea7622ecb06ab94165c4d0f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1006 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df7b034e11f350b02f383677a2c37d598922ad494d0e0241ad5740313332a5c8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e675880ebe2bfb0c3364d32f0ea5569eb1d50d4b18fd15c644cf67ce098e04ed

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3886459ca89f9ca7588cc412ddb3b279947acec2258c42c065bc044ce67276c0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6015b6cdafa09835ca9f65f2d9e211f3e120f8da2760401c7ba5e9520a260c37

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Proofpoint-logo-reg-Reversed.png
www.proofpoint.com/sites/all/themes/proofpoint/images/ 45 KB
45 KB 6ms
6ms Image
image/png 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/images/Proofpoint-logo-reg-Reversed.png
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
last-modified: Fri, 07 Dec 2018 08:47:10 GMT
x-cdn: Incapsula
etag: "c8a80c4c"
content-type: image/png
status: 200
x-iinfo: 14-100728136-0 0CNN RT(1566020081614 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1201200, public
content-length: 46089
expires: Sat, 31 Aug 2019 03:14:41 GMT

GET
H2 200 earth.svg
www.proofpoint.com/sites/all/themes/proofpoint/images/ 3 KB
1 KB 6ms
6ms Image
image/svg+xml 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/images/earth.svg
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: b7eab4c7c851a155bd46eb51790debc67d6f4b076d8b7070da3bb77abab18448

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Wed, 24 Apr 2019 16:02:59 GMT
x-cdn: Incapsula
etag: "6222cb97"
content-type: image/svg+xml
status: 200
x-iinfo: 14-100728137-0 0CNN RT(1566020081615 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209589, public
content-length: 1355
expires: Sat, 31 Aug 2019 05:34:30 GMT

GET
H2 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2
fonts.gstatic.com/s/robotocondensed/v18/ 11 KB
11 KB 17ms
5ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v18/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed
Origin: https://www.proofpoint.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 16:06:32 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:22 GMT
server: sffe
age: 394090
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 10968
x-xss-protection: 0
expires: Tue, 11 Aug 2020 16:06:32 GMT

GET
H2 200 BebasNeue-Bold.woff2
www.proofpoint.com/sites/all/themes/proofpoint/fonts/ 13 KB
13 KB 9ms
9ms Font
application/octet-stream 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/BebasNeue-Bold.woff2
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: e2eb28c4292664b548ad2c8ecf855b1f425a08966c5b413a4a0184b6ff52a509

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
Origin: https://www.proofpoint.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
last-modified: Fri, 07 Dec 2018 08:47:10 GMT
x-cdn: Incapsula
etag: "c0148429"
status: 200
x-iinfo: 14-100728138-0 0CNN RT(1566020081615 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209589, public
content-length: 13140
expires: Sat, 31 Aug 2019 05:34:30 GMT

GET
H2 200 Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2
fonts.gstatic.com/s/fjallaone/v7/ 11 KB
12 KB 17ms
7ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/fjallaone/v7/Yq6R-LCAWCX3-6Ky7FAFrOF6kjouQb4.woff2

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

529e77ee17cf48e9ccbb5a64a0e59a1bbda0d9c011ee061f40b1aa189e8fabb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Fjalla+One|Roboto+Condensed
Origin: https://www.proofpoint.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 12 Aug 2019 21:52:00 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jul 2019 23:50:02 GMT
server: sffe
age: 373362
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 11668
x-xss-protection: 0
expires: Tue, 11 Aug 2020 21:52:00 GMT

GET
H2 200 proofpoint.woff2
www.proofpoint.com/sites/all/themes/proofpoint/fonts/ 18 KB
18 KB 7ms
7ms Font
application/octet-stream 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/proofpoint.woff2
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
Origin: https://www.proofpoint.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
last-modified: Fri, 07 Dec 2018 08:45:31 GMT
x-cdn: Incapsula
etag: "01c16c31"
status: 200
x-iinfo: 14-100728142-0 0CNN RT(1566020081618 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209589, public
content-length: 18296
expires: Sat, 31 Aug 2019 05:34:30 GMT

GET
H2 200 BebasNeue-Regular.woff2
www.proofpoint.com/sites/all/themes/proofpoint/fonts/ 27 KB
27 KB 6ms
6ms Font
application/octet-stream 2a02:e980:d::87
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://www.proofpoint.com/sites/all/themes/proofpoint/fonts/BebasNeue-Regular.woff2
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:e980:d::87 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software: /
Resource Hash: 94761f99487dcae4d91af9d25f37227af94965157adee62bd2f503645ded4fc7

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.proofpoint.com/sites/all/themes/proofpoint/css/styles.css?pwd29m
Origin: https://www.proofpoint.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
last-modified: Fri, 07 Dec 2018 08:47:10 GMT
x-cdn: Incapsula
etag: "f80c5766"
status: 200
x-iinfo: 14-100728146-0 0CNN RT(1566020081623 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=1209589, public
content-length: 27220
expires: Sat, 31 Aug 2019 05:34:30 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 82 KB
26 KB 35ms
24ms Script
application/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-KKGL4NZ&cid=985055634.1566020082&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f6054c365c0a55bd44e5f02d12a024305a9cf0340127fde586032f95fd2dbb37

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 26724
x-xss-protection: 0
expires: Sat, 17 Aug 2019 05:34:42 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 23 KB
9 KB 6796ms
76ms Script
text/javascript 216.58.210.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

481f13ab1dfe784d7b9b778dd53b342c34434da9bc8680b1ce6dea0da8c1d95f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 8968
x-xss-protection: 0
server: cafe
etag: 9750442966221409587
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 17 Aug 2019 05:34:48 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 75ms
48ms Script
application/javascript 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: 6b4c72b8214beaceed57a85c54eed2c61cfc4911b3d677db9a6e00849ef6be05

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:41 GMT
content-encoding: gzip
last-modified: Fri, 02 Aug 2019 18:53:49 GMT
x-msedge-ref: Ref A: F9E2694DA5354444BB5CCE9EDD2B3A67 Ref B: VIEEDGE1121 Ref C: 2019-08-17T05:34:42Z
status: 200
etag: "809cac9e6349d51:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7133

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 15 KB
5 KB 16ms
6ms Script
application/x-javascript 2a02:26f0:6c00:293::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:293::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 17 Aug 2019 05:34:42 GMT
Content-Encoding: gzip
Last-Modified: Mon, 03 Dec 2018 23:03:30 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=65567
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4571

GET uwt.js
static.ads-twitter.com/ 0
0

GET
H2 200 hotjar-933369.js Show response
static.hotjar.com/c/ 3 KB
2 KB 246ms
19ms Script
application/javascript 147.75.102.227
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-933369.js?sv=5

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.227 Central, Hong Kong, ASN54825 (PACKET - Packet Host, Inc., US),

Reverse DNS

pkt-ams-k1-7

Software

openresty /

Resource Hash

053bfbbe32abed8a0e5a957202af9999c139aac5d58f1315d54365936183a433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
section-io-tag: hotjar
age: 67
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 1588
server: openresty
cache-control: max-age=60
x-frame-options: SAMEORIGIN
etag: W/34a691ae41c5f9dcbf00690a04ac9055
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.068
section-io-id: 417c6932eebacbcea850b2128ebaaf9e
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 85 KB
23 KB 46ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

c7ffb5c7a2fcc93bf5553df1f27de7c5b2dbd4affcb74fd0bef82371e4e22caa

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 22680
x-xss-protection: 0
pragma: public
x-fb-debug: Ct2mnkfL/08fWJli50kOg39YZmwoE2/AUVnX89kv0BWZzO0oEPOIhib7ta8jQ2fLhN4g10PJyn+O2HL1PQFQKA==
x-fb-trip-id: 365799557
x-frame-options: DENY
date: Sat, 17 Aug 2019 05:34:42 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

s Show response
ads.avocet.io/
Redirect Chain

https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j
https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&bounce=true&ty=j

0
417 B

158ms
38ms

Script
application/javascript

52.214.122.164
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&bounce=true&ty=j
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.122.164 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-122-164.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 17 Aug 2019 05:34:49 GMT
Connection: keep-alive
P3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 0
Content-Type: application/javascript

Redirect headers

Location: /s?add=5aba5f53ab79f7f51390a95a&bounce=true&ty=j
Date: Sat, 17 Aug 2019 05:34:49 GMT
Connection: keep-alive
P3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 79
Content-Type: text/html; charset=utf-8

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 899 B
669 B 7266ms
54ms Script
application/javascript 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=359897&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&r=0.8300388280021385
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 159.122.87.153 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: 99.57.7a9f.ip4.static.sl-reverse.com
Software: dacdn2 /
Resource Hash: 33dbc1f1d18e0a4c88f868df97c968f0364aa57d7bb311291732c1239b2aa4d7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sat, 17 Aug 2019 05:34:49 GMT
content-encoding: gzip
server: dacdn2
content-type: application/javascript; charset=UTF-8

GET
H2 403 1594.js
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 260ms
13ms Script
text/html 2606:4700::6812:efe5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&e=
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:efe5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 403 1644.js
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 234ms
19ms Script
text/html 2606:4700::6812:efe5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&e=
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:efe5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 403 1645.js
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 216ms
28ms Script
text/html 2606:4700::6812:efe5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&e=
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:efe5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 403 1646.js
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 44ms
27ms Script
text/html 2606:4700::6812:efe5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&e=
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:efe5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 403 1647.js
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 17ms
17ms Script
text/html 2606:4700::6812:efe5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&e=
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:efe5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 main.rtfl.js Show response
visitor.reactful.com/dist/ 256 KB
99 KB 52ms
22ms Script
application/javascript 2a00:1450:4001:809::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor.reactful.com/dist/main.rtfl.js
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:809::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 483c7cd4f6f04ce1b1e2bb6469073b0b9b48a428927f5e3df5c422f76835c891

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:31:50 GMT
content-encoding: gzip
server: Google Frontend
age: 172
etag: "0eoOrA"
content-type: application/javascript; charset=UTF-8
status: 200
x-cloud-trace-context: 2e0fafa9ecc3e0fd3c81788b748559bc
cache-control: public, max-age=600
content-length: 101028
expires: Sat, 17 Aug 2019 05:41:50 GMT

GET ip.json
api.company-target.com/api/v2/ 0
0

GET
H/1.1

200
OK

s Show response
ads.avocet.io/
Redirect Chain

https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j
https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&bounce=true&ty=j

0
417 B

157ms
38ms

Script
application/javascript

52.214.122.164
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&bounce=true&ty=j
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.122.164 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-122-164.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 17 Aug 2019 05:34:50 GMT
Connection: keep-alive
P3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 0
Content-Type: application/javascript

Redirect headers

Location: /s?add=5d1dcad3b00320110090d553&bounce=true&ty=j
Date: Sat, 17 Aug 2019 05:34:49 GMT
Connection: keep-alive
P3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 79
Content-Type: text/html; charset=utf-8

GET getuid
s.ml-attr.com/ 0
0

GET
H2

200

src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain

https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=1473061973
https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

42 B
417 B

31ms
17ms

Image
image/gif

2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:35:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:35:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKjTqcGXieQCFQS53god52kGyw;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j78&aip=1&a=1576888473&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persiste...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_gid=737185877.1566020082&gjid=1812591251&_v=j78&z=1505824092
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092&slf_rd=1&random=1431013127

42 B
374 B

799ms
19ms

Image
image/gif

2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092&slf_rd=1&random=1431013127

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:42 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2257074-1&cid=985055634.1566020082&jid=1394251657&_v=j78&z=1505824092&slf_rd=1&random=1431013127
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 143852102935619 Show response
connect.facebook.net/signals/config/ 301 KB
73 KB 37ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/143852102935619?v=2.9.2&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

c36385fddfc942bb807e1ab245c921dc35ef4814df29556cf0b5bac8e6201971

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 73363
x-xss-protection: 0
pragma: public
x-fb-debug: QLo39KqXKA5QjHa5hYcRJ8bpNw+2CEbuvyBfeWI+lMPRcKb9+5Ybue9GJa+dj/X2KwC7aG0SeEHaL9Z07gBxzg==
x-fb-trip-id: 365799557
x-frame-options: DENY
date: Sat, 17 Aug 2019 05:34:42 GMT
vary: Origin, Accept-Encoding
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
185 B 90ms
47ms Image
text/plain 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17087961&Ver=2&mid=d73cf44b-82db-76cb-a566-2498d86b9229&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&r=&evt=pageLoad&msclkid=N&rn=382549
Requested by: Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Sat, 17 Aug 2019 05:34:42 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 04701951344C4643AC663B869E6B7D96 Ref B: VIEEDGE1112 Ref C: 2019-08-17T05:34:42Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 inferredEvents.js Show response
connect.facebook.net/signals/plugins/ 1 KB
1 KB 74ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.9.2

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 772
x-xss-protection: 0
pragma: public
x-fb-debug: IiuvFtG1UIKCxaEV7wV7N38zD3tG1wJWEhcfXGs3YFPZ/M4lNvQ+lenCcEFelNZloj16W9qLlrkIqz/X14DFTw==
x-fb-trip-id: 365799557
x-frame-options: DENY
date: Sat, 17 Aug 2019 05:34:42 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
324 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&rl=&if=false&ts=1566020082396&sw=1600&sh=1200&v=2.9.2&r=stable&ec=0&o=30&fbp=fb.1.1566020082395.1229280212&it=1566020082261&coo=false&rqm=GET

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Sat, 17 Aug 2019 05:34:42 GMT

GET
H2 200 modules.2f1fcc01387c3107e40b.js Show response
script.hotjar.com/ 425 KB
71 KB 3132ms
39ms Script
application/javascript 147.75.84.99
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.2f1fcc01387c3107e40b.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-933369.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.84.99 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
Software: /
Resource Hash: 12b61cf4061a8cf7abd6e6cf344d276dd687ed00a3eba3d6190b5f478eb611e7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:45 GMT
content-encoding: br
last-modified: Fri, 16 Aug 2019 13:33:01 GMT
status: 200
etag: "8145b5329a08b42574bbdac6e488e13a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.027
section-io-origin-status: 200
accept-ranges: bytes
section-io-id: 3143ad500cc17c9c6c291e8a6b86cdd9
content-length: 72384

GET
H2 200 / Show response
visitor.reactful.com/config/879986/ 12 KB
4 KB 736ms
706ms XHR
text/html 2a00:1450:4001:809::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor.reactful.com/config/879986/?page=%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&hash=&referer=&user_id=&hshkgid=895ca21d-3ffe-497d-b721-961ac7d9a2a1&cb_rtfl=_rtfl_jsonp_0
Requested by: Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:809::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 07636952643df1d7e429458532720a2fe62ffe338ba3dfa9d8c358f9130fd11d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:43 GMT
content-encoding: gzip
server: Google Frontend
status: 200
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: https://www.proofpoint.com
x-cloud-trace-context: 3781e2e1067b13f782f6bc78013b7c52
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Six-Sense-Data,Custom-Vars-Data
content-length: 3855
expires: Sat, 17 Aug 2019 05:34:43 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
222 B 426ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=143852102935619&ev=Microdata&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&rl=&if=false&ts=1566020082905&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint%22%2C%22meta%3Adescription%22%3A%22Proofpoint%20researchers%20detail%20the%20latest%20iteration%20of%20KPOT%20Stealer%22%7D&cd[OpenGraph]=%7B%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal%22%2C%22og%3Atitle%22%3A%22New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint%20US%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.proofpoint.com%2Fsites%2Fdefault%2Ffiles%2Fimages%2FBlog%2Fpotsmall.jpg%22%2C%22article%3Apublished_time%22%3A%222019-05-09T09%3A08%3A13-07%3A00%22%2C%22article%3Amodified_time%22%3A%222019-06-05T22%3A12%3A42-07%3A00%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.2&r=stable&ec=1&o=30&fbp=fb.1.1566020082395.1229280212&it=1566020082261&coo=false&es=automatic&rqm=GET

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 17 Aug 2019 05:34:43 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Sat, 17 Aug 2019 05:34:43 GMT

GET
BLOB 200
OK bee46c6b-bc99-4677-8289-e68d7e6541dd Show response
https://www.proofpoint.com/ 12 KB
0 Script
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.proofpoint.com/bee46c6b-bc99-4677-8289-e68d7e6541dd
Requested by: Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol: BLOB
Security: , ,
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07636952643df1d7e429458532720a2fe62ffe338ba3dfa9d8c358f9130fd11d

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 11965
Content-Type: text/html

POST
H2 200 / Show response
tracking.reactful.com/tracking/879986/ 6 B
192 B 183ms
145ms XHR
text/html 2a00:1450:4001:80b::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.reactful.com/tracking/879986/
Requested by: Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:1450:4001:80b::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56

Request headers

Accept: */*
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Sat, 17 Aug 2019 05:34:43 GMT
content-encoding: gzip
server: Google Frontend
status: 200
vary: Accept-Encoding
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 3ca0842538d4ed784128af20a24aff1d
cache-control: no-cache
content-length: 26

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/ 2 KB
2 KB 4132ms
17ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1566020089020&cv=9&fst=1566020089020&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg874&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

35f1a818c2a4a883873d3224827cc6337ac5fd80d3906a385c6bc6bde27afc3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 1058
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/ 2 KB
1 KB 4124ms
19ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1566020089030&cv=9&fst=1566020089030&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

90d4f45ba339a5fb64654198d125f67b435890ca212b751072e019ba02d77e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length: 1048
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
236 B 4741ms
29ms Image
image/gif 159.122.87.153
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?a=359897&d=proofpoint.com&u=D38272811B0979A3A2D824F41B0B21BF4&h=9117295be5844e705b0cb9f894f5d375&t=true&r=0.1484735166631619

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.122.87.153 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),

Reverse DNS

99.57.7a9f.ip4.static.sl-reverse.com

Software

dacdn2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:54 GMT
x-content-type-options: nosniff
server: dacdn2
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/950296937/ 42 B
421 B 34ms
22ms Image
image/gif 2a00:1450:4001:816::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/950296937/?random=1566020089020&cv=9&fst=1566018000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg874&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&async=1&fmt=3&cdct=2&is_vtc=1&random=1348971111&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
www.google.de/pagead/1p-user-list/950296937/ 0
0

GET
H2 200 /
www.google.com/pagead/1p-user-list/950296937/ 42 B
110 B 41ms
31ms Image
image/gif 2a00:1450:4001:816::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/950296937/?random=1566020089030&cv=9&fst=1566018000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&fmt=3&cdct=2&is_vtc=1&random=3923163444&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2019 05:34:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
www.google.de/pagead/1p-user-list/950296937/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js

Domain: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js

Domain: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Domain: api.company-target.com
URL: https://api.company-target.com/api/v2/ip.json?key=8d20076343394d24eb8250e933d1560c

Domain: s.ml-attr.com
URL: https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID

Domain: www.google.de
URL: https://www.google.de/pagead/1p-user-list/950296937/?random=1566020089020&cv=9&fst=1566018000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg874&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&async=1&fmt=3&cdct=2&is_vtc=1&random=1348971111&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Domain: www.google.de
URL: https://www.google.de/pagead/1p-user-list/950296937/?random=1566020089030&cv=9&fst=1566018000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fnew-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal&tiba=New%20KPOT%20v2.0%20stealer%20brings%20zero%20persistence%20and%20in-memory%20features%20to%20silently%20steal%20credentials%20%7C%20Proofpoint&fmt=3&cdct=2&is_vtc=1&random=3923163444&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Verdicts & Comments Add Verdict or Comment

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ads.avocet.io
adservice.google.com
api.company-target.com
bat.bing.com
cloud.typography.com
connect.facebook.net
dev.visualwebsiteoptimizer.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
gwmtracking.com
js.maxmind.com
munchkin.marketo.net
s.ml-attr.com
script.hotjar.com
scripts.demandbase.com
sjs.bizographics.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
tracking.g2crowd.com
tracking.reactful.com
visitor.reactful.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.proofpoint.com
api.company-target.com
munchkin.marketo.net
s.ml-attr.com
scripts.demandbase.com
static.ads-twitter.com
www.google.de
147.75.102.227
147.75.84.99
159.122.87.153
172.217.23.166
216.200.122.11
216.58.210.2
23.38.51.49
2606:4700::6810:262f
2606:4700::6812:efe5
2620:1ec:c11::200
2a00:1450:4001:806::200a
2a00:1450:4001:809::2013
2a00:1450:4001:80b::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:80b::2013
2a00:1450:4001:815::2003
2a00:1450:4001:816::2003
2a00:1450:4001:816::2004
2a00:1450:4001:819::2002
2a00:1450:4001:81d::2002
2a00:1450:400c:c04::9d
2a02:26f0:6c00:293::3adf
2a02:e980:d::87
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
52.214.122.164
0392ee492efd6bc95e9cb5f2c006712e3d9882722f9baa6f0d3cc94f31c2a436
047ef44b759411ac70b47ffb1c29a2814d34ec9aa7cf12a927340128500bc9fe
053bfbbe32abed8a0e5a957202af9999c139aac5d58f1315d54365936183a433
06b5607ce2a1b6464c87569049b0acd1fa6dd80b9d442637d0edf79d67bf8628
07636952643df1d7e429458532720a2fe62ffe338ba3dfa9d8c358f9130fd11d
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12b61cf4061a8cf7abd6e6cf344d276dd687ed00a3eba3d6190b5f478eb611e7
1c7ed120c789a83c1d7124bca5e2b01aa37cdff317a54af549bf288b536a263f
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70
2052dd77390bdc41acf8fad615d0ccbbd8abda68a79b48ea3e46233d16df6ec6
3140e03d8dd88ddfc2a9eefc88a3ae4b233c3f6182423775f83e22e16d072cd5
3298743d65f0655b9f76d93e93cbc2f54ba68ecc3e6bb988179757c80231bcad
33dbc1f1d18e0a4c88f868df97c968f0364aa57d7bb311291732c1239b2aa4d7
35f1a818c2a4a883873d3224827cc6337ac5fd80d3906a385c6bc6bde27afc3f
3886459ca89f9ca7588cc412ddb3b279947acec2258c42c065bc044ce67276c0
40c2df11fbebad9e05c5dfc4f9aad292a399642492254bc628e234089ec4e89b
41823071e47f49519aaafcfcea698c65db53051297c9729e0810da9ea2b70283
46454a26b3142dec4540c21c9c156f2b3e570488667f1bbcf81854e27925f2a4
479f333c6cdf10724e19b33079cab821bb37b0a463170ea9943dcbc0c6d9dc67
481f13ab1dfe784d7b9b778dd53b342c34434da9bc8680b1ce6dea0da8c1d95f
483c7cd4f6f04ce1b1e2bb6469073b0b9b48a428927f5e3df5c422f76835c891
49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856
49ddc4d7eb9b23cfe83c9ddea5478d80085d3c866c1c55b30e5fedf272fe6b49
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
529e77ee17cf48e9ccbb5a64a0e59a1bbda0d9c011ee061f40b1aa189e8fabb8
546595c59cd94a2dd8403e01dee1def5f043e5cff6352cf84c4c7770bf5dc754
579f4babb911b5a02260cfd84bca42d0e14c058264fe3b7c9cd2b8500d709469
5ac2e3c736481deec2191dd546e7cdda5882014a98bd17a2d04472e70e33b196
5b97c439e216d135ae9e10d5aed248dad7d20c9b05e54d3ea98820e55521379d
5bc7470012f87caff6788f0ebf60682f952c7a0964ad3b2cca2a61bbce18f6ec
6015b6cdafa09835ca9f65f2d9e211f3e120f8da2760401c7ba5e9520a260c37
62fb619801e63ae8cb42d3e79ae12d91f89bcb812a35abe360d43674666abc98
69666124ea4313cf5b2da94871c86acd68bcbc4d50b360fdebc4dc3b977dde21
6b4c72b8214beaceed57a85c54eed2c61cfc4911b3d677db9a6e00849ef6be05
74166c3ce466a4afbab3fee3dc53106c377de2217ddb142774eb4b59fe65c6e8
75f94de20ce7a52a2ac84f9f42abdd5687549bc207135ffaa7d5baed1cc7060a
7772e3d0bc6fba46755057c1ca0154dfda1100214439321c2702fa8ad468158b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e2984a7564e795341d3738457b47eb414940549fed7b8053ece1c207689904
87cbc1a35e62d41af5719f380e3a7bc8129427bd982c1e696bd74453f7c5471a
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
8c04e5c378ae725f0ed4a33cf297cffdbb80839c5bad6984801553f7893ec45b
90d4f45ba339a5fb64654198d125f67b435890ca212b751072e019ba02d77e99
91221ebe7decdf80fc3cfddffa7595ff915be4af1a9a5620fc9c138bf6cc0363
94761f99487dcae4d91af9d25f37227af94965157adee62bd2f503645ded4fc7
94880f4d8b391421ea1a5447903697dbc761d879cf9ec89faa637d0bf2f331c4
9d0c2dcad36cced1cd443f28198432ca36bf2e08f12e2e38a8b21220fc889aec
a18430e37c008ca74cde9ea753584b0c8de60e02f751f0b2a8fb2780d53a1a76
a259cd28565f7f3ea729a5add643412dd3ecd8616cfd4bf7f9b836cce9811147
a4bcaba23f30e7aa39a04ba1cbd337fd43e1962f1883566ae4bc61ad138fa16b
a8bac03a9bf9bff1a50a992ffe70257f2c6a24e0cc79ba4c268baf19c9ca2880
aa83a25b734f0cb82f0dd65c7cfaa5cfc535eb74aedfede313c0e8f9675f9cc5
ac423fe5c2bf07d841e12a36c9952daf9c1eb8457785eb8096508313a5ec2242
b7eab4c7c851a155bd46eb51790debc67d6f4b076d8b7070da3bb77abab18448
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
c36385fddfc942bb807e1ab245c921dc35ef4814df29556cf0b5bac8e6201971
c42a41f50ddc0d98adce6ed747e7a4ccef6278990d7f7413ecde1284ecb9d530
c6687d159fd14a00a4b187ecfa840c0e21d5a28f352003295d8508190fbdd826
c7ffb5c7a2fcc93bf5553df1f27de7c5b2dbd4affcb74fd0bef82371e4e22caa
cc3cfa383d1a79efd2cc2f0c77d14d9e74858312561b6d8f8a1b63b75ebab500
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446
cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56
d3296d651831055b3b820704b0ea74a23c6a782299f92b42ea53f28925460ce8
d8685b85520677383b178f46734ec8e55d6a3050700bd5478c92fb34970f38d1
df7b034e11f350b02f383677a2c37d598922ad494d0e0241ad5740313332a5c8
e2eb28c4292664b548ad2c8ecf855b1f425a08966c5b413a4a0184b6ff52a509
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e675880ebe2bfb0c3364d32f0ea5569eb1d50d4b18fd15c644cf67ce098e04ed
e6f4197e7c39e79481fceddfea14fb5a015d63828c47ef33e32cd5a219d0a2e5
e7e6695bf782bd4b52cc817b8adba3d03973c348cea7622ecb06ab94165c4d0f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6054c365c0a55bd44e5f02d12a024305a9cf0340127fde586032f95fd2dbb37
fcc7b3aab1606a93ae54fda2d71fb87e43c50279cc5f28ed5b725abe64a821a0

www.proofpoint.com Open in urlscan Pro 2a02:e980:d::87 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

85 Requests

91 %HTTPS

69 %IPv6

26 Domains

31 Subdomains

24 IPs

7 Countries

2622 kBTransfer

4671 kBSize

0 Cookies

24 Outgoing links

Redirected requests

85 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.proofpoint.com Open in urlscan Pro
2a02:e980:d::87 Public Scan

Screenshot
Live screenshot

Full Image

85
Requests

91 %
HTTPS

69 %
IPv6

26
Domains

31
Subdomains

24
IPs

7
Countries

2622 kB
Transfer

4671 kB
Size

0
Cookies

85 HTTP transactions
10 data transactions