URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Submission: On August 19 via api from US

Summary

This website contacted 14 IPs in 5 countries across 18 domains to perform 100 HTTP transactions. The main IP is 35.188.168.180, located in United States and belongs to GOOGLE - Google LLC, US. The main domain is cofense.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 19th 2019. Valid for: 3 months.
This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
69 35.188.168.180 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:200... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 216.58.206.2 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a05:f500:10:... 14413 (LINKEDIN)
1 2a00:1450:400... 15169 (GOOGLE)
100 14
Domain Requested by
69 cofense.com cofense.com
6 fonts.googleapis.com cofense.com
5 fonts.gstatic.com cofense.com
2 www.google.de cofense.com
2 www.google.com 1 redirects cofense.com
2 bat.bing.com www.googletagmanager.com
cofense.com
2 www.google-analytics.com www.googletagmanager.com
cofense.com
2 www.googletagmanager.com cofense.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 px.ads.linkedin.com sjs.bizographics.com
1 stats.g.doubleclick.net 1 redirects
1 sjs.bizographics.com www.googletagmanager.com
1 www.googleadservices.com www.googletagmanager.com
1 dsms0mj1bbhn4.cloudfront.net cofense.com
0 a.optnmstr.com Failed cofense.com
0 t.sf14g.com Failed cofense.com
0 static.hotjar.com Failed www.googletagmanager.com
0 www.shareaholic.net Failed dsms0mj1bbhn4.cloudfront.net
0 k4z6w9b5.stackpathcdn.com Failed dsms0mj1bbhn4.cloudfront.net
100 19
Subject Issuer Validity Valid
cofense.com
Let's Encrypt Authority X3
2019-08-19 -
2019-11-17
3 months crt.sh
*.googleapis.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
*.cloudfront.net
DigiCert Global CA G2
2018-10-08 -
2019-10-09
a year crt.sh
*.google-analytics.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
*.google.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
www.googleadservices.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
www.bing.com
Microsoft IT TLS CA 2
2019-04-30 -
2021-04-30
2 years crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA
2018-04-13 -
2020-04-17
2 years crt.sh
www.google.de
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2019-05-29 -
2021-06-29
2 years crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
www.google.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh

This page contains 2 frames:

Primary Page: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Frame ID: 45A39B9D8E285F2E7C7ABDBCE1BE2AB6
Requests: 99 HTTP requests in this frame

Frame: https://k4z6w9b5.stackpathcdn.com/v2/544ec68d/shrMain.min.js
Frame ID: 71826393D3C7301CF646F2888E58F584
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i

Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i

Overall confidence: 100%
Detected patterns
  • script /\/wp-(?:content|includes)\//i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i

Overall confidence: 100%
Detected patterns
  • script /^\/\/static\.hotjar\.com\/c\/hotjar-/i

Page Statistics

100
Requests

94 %
HTTPS

86 %
IPv6

18
Domains

19
Subdomains

14
IPs

5
Countries

2055 kB
Transfer

4496 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 93
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j78&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&gjid=1890419669&_gid=82040650.1566241004&_u=YGBAgUAB~&z=712800910 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910&slf_rd=1&random=1385438934

100 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
112 KB
23 KB
Document
General
Full URL
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
64a9458dcbc3ef9e2e25864aecdf42fb0514f93f554597fee80797f55ca86ce0

Request headers

:method
GET
:authority
cofense.com
:scheme
https
:path
/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Mon, 19 Aug 2019 18:56:43 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
link
<https://cofense.com/?p=17169>; rel=shortlink
wpe-backend
apache
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 7
x-pass-why
x-cache-group
normal
content-encoding
gzip
cache.skin.css
cofense.com/wp-content/plugins/mega_main_menu/src/css/
213 B
412 B
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
last-modified
Mon, 19 Aug 2019 17:19:08 GMT
server
nginx
status
200
etag
"5d5ada0c-d5"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
213
style.min.css
cofense.com/wp-includes/css/dist/block-library/
29 KB
5 KB
Stylesheet
General
Full URL
https://cofense.com/wp-includes/css/dist/block-library/style.min.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-726f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
front.min.css
cofense.com/wp-content/plugins/cookie-notice/css/
3 KB
1 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-c04"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
font-awesome.min.css
cofense.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/
28 KB
7 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/font-awesome.min.css?ver=5.1.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
5abe21f898d69ccc30a452d02b70a828d111204b7c898709c4e74d0620e79451

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-713a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
bootstrap.css
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/
149 KB
20 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
77565a00d3b86cbbd914224f423cdb01b2d5db3c3057c2b69209153cc769c8c1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-255bc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
front.css
cofense.com/wp-content/plugins/download-manager/assets/css/
118 KB
34 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ff09631078dd4af25f0cd2647d53311bbab55dc2c0a5045f8a38baf1a9506b41

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-1d8e5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
ihover.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/
428 KB
76 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-6ae1e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
style.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/
1 KB
812 B
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:08 GMT
server
nginx
status
200
etag
W/"5d5ada0c-568"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
font-awesome.css
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/
37 KB
8 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:08 GMT
server
nginx
status
200
etag
W/"5d5ada0c-9226"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
page-list.css
cofense.com/wp-content/plugins/page-list/css/
2 KB
777 B
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:08 GMT
server
nginx
status
200
etag
W/"5d5ada0c-60c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
buttons.css
cofense.com/wp-content/plugins/wpdm-button-templates/
20 KB
7 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/wpdm-button-templates/buttons.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
1febea0d811318da1ca5f4b52b9e406df837c27e79bf633315f5acf33fb54c9c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:05 GMT
server
nginx
status
200
etag
W/"5d5ada09-4e77"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
pagenavi-css.css
cofense.com/wp-content/plugins/wp-pagenavi/
374 B
467 B
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:05 GMT
server
nginx
status
200
etag
W/"5d5ada09-176"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
chosen.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/
10 KB
2 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:06 GMT
server
nginx
status
200
etag
W/"5d5ada0a-29ff"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
search-filter.min.css
cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/
24 KB
5 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:06 GMT
server
nginx
status
200
etag
W/"5d5ada0a-61cc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
magnific-popup.min.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/
6 KB
2 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-1802"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
animate.css
cofense.com/wp-content/plugins/elite-addons-vc/assets/
67 KB
4 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-10cbc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
css
fonts.googleapis.com/
9 KB
748 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C300%2C700&ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
373a0505368dab061278aa0b7243dc58fc165a25f8b0286d57f8835d06ab6e27
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
css
fonts.googleapis.com/
4 KB
626 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Montserrat%3A400%2C700&ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
4c940a58b40018214ca32665ff4cf755522b32a027b309cccb950ccd22e27637
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
css
fonts.googleapis.com/
2 KB
467 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
16ad30dc7c52842f580962e62e29bd0474f9d3d99c93c81b8d384bdb52553719
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
css
fonts.googleapis.com/
2 KB
458 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700&ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
font-awesome.min.css
cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/
21 KB
5 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/font-awesome.min.css?ver=4.1.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-55e0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
elegant-icons.min.css
cofense.com/wp-content/themes/copro/css/libs/elegant-icons/
4 KB
1 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-103d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
owl.carousel.css
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/
22 KB
3 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-577a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
theme-styles.css
cofense.com/wp-content/themes/copro/css/
608 KB
72 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:07 GMT
server
nginx
status
200
etag
W/"5d5ada0b-980d1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
theme-shortcodes.css
cofense.com/wp-content/themes/copro/css/
28 KB
5 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-6f98"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
custom-styles.css
cofense.com/wp-content/themes/copro/css/
109 KB
18 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1566235145
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
02b5728af616b0e28cc34dec506dc3ed5c94c4963cfd27056a5bebcdea0a8487

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:05 GMT
server
nginx
status
200
etag
W/"5d5ada09-1b235"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
responsive.css
cofense.com/wp-content/themes/copro/css/
102 KB
12 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:05 GMT
server
nginx
status
200
etag
W/"5d5ada09-198c3"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
select2.min.css
cofense.com/wp-content/themes/copro/css/vendor/
15 KB
2 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-3aed"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
style.css
cofense.com/wp-content/themes/copro/
96 KB
16 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
2348b89c8b4ad214b3588b7a5c0f898f7366ffd81e21de46ecc29d16a1722aa8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-17fee"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
fancybox.min.css
cofense.com/wp-content/themes/copro/css/vendor/
12 KB
3 KB
Stylesheet
General
Full URL
https://cofense.com/wp-content/themes/copro/css/vendor/fancybox.min.css?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-31fb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2592000
css
fonts.googleapis.com/
28 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
jquery.js
cofense.com/wp-includes/js/jquery/
95 KB
34 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-17a69"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
jquery-migrate.min.js
cofense.com/wp-includes/js/jquery/
10 KB
4 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-2748"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
front.min.js
cofense.com/wp-content/plugins/cookie-notice/js/
5 KB
1 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=1.2.45
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-14f0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
bootstrap.min.js
cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/
35 KB
10 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.min.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
4b9329f540f2a0a583e6b0dff71f0f68d819ca3920c752fdb4e6bb1f88659cab

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-8c73"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
front.js
cofense.com/wp-content/plugins/download-manager/assets/js/
9 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/download-manager/assets/js/front.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0e72d4d7a1516d01d305645685a5c0d11b331e854283eb75fb44a45dfe50bdec

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-23c7"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
equal-height-columns-public.js
cofense.com/wp-content/plugins/equal-height-columns/public/js/
7 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/equal-height-columns/public/js/equal-height-columns-public.js?ver=1.1.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
40709d33f8087ff2d000f33d3be50a7241409eb411af7878dad1707f49cf1db5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-1d33"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
core.min.js
cofense.com/wp-includes/js/jquery/ui/
4 KB
2 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-fa0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
script.js
cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/
3 KB
1 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:08 GMT
server
nginx
status
200
etag
W/"5d5ada0c-c1c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
modernizr.js
cofense.com/wp-content/plugins/elite-addons-vc/assets/
10 KB
5 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-283b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
share-buttons.js
cofense.com/wp-content/themes/copro/js/
3 KB
1 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/share-buttons.js?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
faa4537366f405c58904225222e7f6f69af074f1e10a3a424cac9d78d6c4189f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-a24"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
fancybox.min.js
cofense.com/wp-content/themes/copro/js/vendor/
67 KB
22 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/vendor/fancybox.min.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-10a9d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
shareaholic.js
dsms0mj1bbhn4.cloudfront.net/assets/pub/
7 KB
3 KB
Script
General
Full URL
https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:1600:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
bd6dfa634b993ea250503f1ada1e7764d843fdf9ab1db00bd8fa7ce2b4d57fe8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:55:39 GMT
content-encoding
gzip
age
94
x-cache
Hit from cloudfront
status
200
x-hello-human
Join the fun! Apply at www.shareaholic.com/jobs
content-length
2971
access-control-allow-origin
*
last-modified
Thu, 15 Aug 2019 10:54:20 GMT
server
nginx
etag
"802a2d84172d2173394f43d5441dcfd5"
content-type
application/javascript
via
1.1 c1b77f069e81fd54b56ee92a790a3e9b.cloudfront.net (CloudFront)
cache-control
max-age=900, public
x-amz-cf-pop
FRA2
accept-ranges
bytes
x-amz-cf-id
kUXbYTGExktpzrIdw_ITdQKfjADhxKb4ynl7y0bRSXqHcuoVsgGKoA==
js
www.googletagmanager.com/gtag/
68 KB
26 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-1061448384
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8478633a8d54b7eb20212784040cc4de50aea5cfafe86ad709af371c551cdbf6
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
26582
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
logo.png
cofense.com/wp-content/uploads/2016/06/
99 KB
99 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/06/logo.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f17190694a08c3f14eb0dd51d2ae0b4963e569893db8d2cb620cee83ac62d486

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:53 GMT
server
nginx
status
200
etag
"5d5ad9fd-18a84"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
100996
logo@2x.png
cofense.com/wp-content/uploads/2016/06/
99 KB
99 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/06/logo@2x.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f17190694a08c3f14eb0dd51d2ae0b4963e569893db8d2cb620cee83ac62d486

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:53 GMT
server
nginx
status
200
etag
"5d5ad9fd-18a84"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
100996
gtm.js
www.googletagmanager.com/
100 KB
33 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
13c8eb686cafa8179c5a2e71a0bdcc6e805fe053b4b44a1d51af6612e65cd282
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
34017
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:44 GMT
wp-emoji-release.min.js
cofense.com/wp-includes/js/
14 KB
5 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-3610"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
triage-cluster_56832-adam_AT_friaryshoes_co_uk_SockRat_screenshots_Screenshot-2019-08-05-at-14.56.06-3-480x480.jpg
cofense.com/wp-content/uploads/2019/08/
34 KB
35 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/triage-cluster_56832-adam_AT_friaryshoes_co_uk_SockRat_screenshots_Screenshot-2019-08-05-at-14.56.06-3-480x480.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
de95c17313616699cb855d98bf282f599609fd62b2cfa68646358fcc974258f3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:16 GMT
server
nginx
status
200
etag
"5d5ad9d8-89e6"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
35302
Figure-2-600x211.jpg
cofense.com/wp-content/uploads/2019/08/
21 KB
21 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/Figure-2-600x211.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bdb61e3c8d532a250616d64673ef916590054dd43da336003f918ebf27f2586

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:15 GMT
server
nginx
status
200
etag
"5d5ad9d7-525e"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
21086
figure-3-600x76.jpg
cofense.com/wp-content/uploads/2019/08/
25 KB
25 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/figure-3-600x76.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
9a19c05e2be688ed58217f50502e9db3fbe10d17f1eb22b7c9345c5d98943a64

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:16 GMT
server
nginx
status
200
etag
"5d5ad9d8-6317"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
25367
Figure-4-600x154.jpg
cofense.com/wp-content/uploads/2019/08/
35 KB
35 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/Figure-4-600x154.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a1c466714cb6757293f3793147a814e8e87dda023dc8a469495fca6b4ad7f05e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:15 GMT
server
nginx
status
200
etag
"5d5ad9d7-8a3f"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
35391
figure-5-768x352.jpg
cofense.com/wp-content/uploads/2019/08/
52 KB
52 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/figure-5-768x352.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
8079f5d7997b257c348d5359ea03784ca342e1fa9b9747fb5f5244001b3bb6fa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:16 GMT
server
nginx
status
200
etag
"5d5ad9d8-d079"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
53369
figure-6-600x184.jpg
cofense.com/wp-content/uploads/2019/08/
36 KB
36 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2019/08/figure-6-600x184.jpg
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
3c105d3245aae393bec2bccf0c72039e3d02f73a64856cfe825030c8a8357c5e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:16 GMT
server
nginx
status
200
etag
"5d5ad9d8-90f0"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
37104
jquery.form.min.js
cofense.com/wp-includes/js/jquery/
16 KB
6 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ee1a97f49961f87c6aa495dca24759a1ca097b3c8612401e45c09248fae2fffa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-4028"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
jquery.t-countdown.js
cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/
9 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:43 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-23d2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
wow.min.js
cofense.com/wp-content/plugins/elite-addons-vc/assets/
8 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-1ff6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
modules.min.js
cofense.com/wp-content/plugins/elite-addons-vc/assets/
121 KB
35 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:10 GMT
server
nginx
status
200
etag
W/"5d5ada0e-1e4e2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
owl.carousel.js
cofense.com/wp-content/themes/copro/css/libs/owl-carousel/
38 KB
9 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-99c8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
jquery.sticky.js
cofense.com/wp-content/themes/copro/js/
10 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-2765"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
custom.js
cofense.com/wp-content/themes/copro/js/
14 KB
4 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/custom.js?ver=1566235144
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
988698cdde3292e370653b137f03fa593cc4cea173f94e99f2111ed168e87dde

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-3851"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
theme-scripts.js
cofense.com/wp-content/themes/copro/js/
139 KB
39 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:05 GMT
server
nginx
status
200
etag
W/"5d5ada09-22de9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
select2.min.js
cofense.com/wp-content/themes/copro/js/vendor/
66 KB
19 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-10964"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
jquery.waypoints.min.js
cofense.com/wp-content/themes/copro/js/vendor/
9 KB
3 KB
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-2344"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
sticky.min.js
cofense.com/wp-content/themes/copro/js/vendor/
1 KB
816 B
Script
General
Full URL
https://cofense.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
W/"5d5ada08-4db"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
comment-reply.min.js
cofense.com/wp-includes/js/
2 KB
1 KB
Script
General
Full URL
https://cofense.com/wp-includes/js/comment-reply.min.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-8ba"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
wp-embed.min.js
cofense.com/wp-includes/js/
1 KB
991 B
Script
General
Full URL
https://cofense.com/wp-includes/js/wp-embed.min.js?ver=5.2.2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:18:12 GMT
server
nginx
status
200
etag
W/"5d5ad9d4-57b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
jquery.json.min.js
cofense.com/wp-content/plugins/gravityforms/js/
2 KB
1 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.4.3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-738"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
gravityforms.min.js
cofense.com/wp-content/plugins/gravityforms/js/
33 KB
10 KB
Script
General
Full URL
https://cofense.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.3
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Mon, 19 Aug 2019 17:19:09 GMT
server
nginx
status
200
etag
W/"5d5ada0d-853b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
css
fonts.googleapis.com/
5 KB
615 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Montserrat:300,400,700
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
b1f883af57822077826c9ac07ee32dd79cc07ff96d3115508c12b3c355abf394
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Aug 2019 18:56:43 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Mon, 19 Aug 2019 18:56:43 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Mon, 19 Aug 2019 18:56:43 GMT
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 12 Aug 2019 19:17:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:48:04 GMT
server
sffe
age
603526
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
13428
x-xss-protection
0
expires
Tue, 11 Aug 2020 19:17:58 GMT
icn-nav-search@2x.png
cofense.com/wp-content/uploads/2016/07/
822 B
1023 B
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/07/icn-nav-search@2x.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
198e3e673bcd3689b80038e221442efd55bbff4079129f56bdad0b2940ac43b6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:51 GMT
server
nginx
status
200
etag
"5d5ad9fb-336"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
822
nav-arrow.png
cofense.com/wp-content/uploads/2016/07/
208 B
408 B
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/07/nav-arrow.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
7d59dbec6f211b9b7910a6348a9ca93c4d733c625fd13eba33f8fdaef91a09db

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:51 GMT
server
nginx
status
200
etag
"5d5ad9fb-d0"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
208
b-g.png
cofense.com/wp-content/themes/copro/images/
840 KB
841 KB
Image
General
Full URL
https://cofense.com/wp-content/themes/copro/images/b-g.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/css/custom-styles.css?ver=1566235145
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:19:07 GMT
server
nginx
status
200
etag
"5d5ada0b-d20af"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
860335
footer-graphic.png
cofense.com/wp-content/uploads/2016/07/
16 KB
16 KB
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
1c80b6cd2eba57ae2b468a90b970f45790801cfd609a37bce090b8b65dc0a55f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:51 GMT
server
nginx
status
200
etag
"5d5ad9fb-4105"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
16645
footer-graphic-b.png
cofense.com/wp-content/uploads/2016/07/
212 B
412 B
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:51 GMT
server
nginx
status
200
etag
"5d5ad9fb-d4"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
212
footer-graphic-a.png
cofense.com/wp-content/uploads/2016/07/
107 B
307 B
Image
General
Full URL
https://cofense.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/wp-content/themes/copro/style.css?ver=5.2.2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:18:51 GMT
server
nginx
status
200
etag
"5d5ad9fb-6b"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
107
fontawesome-webfont.woff
cofense.com/wp-content/themes/copro/css/libs/fonts/
64 KB
64 KB
Font
General
Full URL
https://cofense.com/wp-content/themes/copro/css/libs/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.188.168.180 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
180.168.188.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Sec-Fetch-Mode
cors
Referer
https://cofense.com/wp-content/themes/copro/css/libs/font-awesome-css/font-awesome.min.css?ver=4.1.0
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
last-modified
Mon, 19 Aug 2019 17:19:04 GMT
server
nginx
status
200
etag
"5d5ada08-ffac"
vary
Accept-Encoding
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
content-length
65452
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.2
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 12 Aug 2019 21:30:30 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
age
595574
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11056
x-xss-protection
0
expires
Tue, 11 Aug 2020 21:30:30 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.2
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 15 Aug 2019 09:00:48 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
381356
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11016
x-xss-protection
0
expires
Fri, 14 Aug 2020 09:00:48 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.2
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 12 Aug 2019 22:53:54 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:58 GMT
server
sffe
age
590570
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
11020
x-xss-protection
0
expires
Tue, 11 Aug 2020 22:53:54 GMT
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/
12 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.2.2
Origin
https://cofense.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 24 Jul 2019 01:24:47 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
age
2309517
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
12680
x-xss-protection
0
expires
Thu, 23 Jul 2020 01:24:47 GMT
shrMain.min.js
k4z6w9b5.stackpathcdn.com/v2/544ec68d/
0
0

62df9f201cc7c19a56912daae814efca.json
www.shareaholic.net/config/
0
0

shrMain.min.js
k4z6w9b5.stackpathcdn.com/v2/544ec68d/ Frame 7182
0
0

conversion_async.js
www.googleadservices.com/pagead/
23 KB
9 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s20-in-f2.1e100.net
Software
cafe /
Resource Hash
077f9f503fe2387c21f3b4762d372b16d335cbc34ee922a150af282c350fd3f1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:57:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
9096
x-xss-protection
0
server
cafe
etag
2741170579065278026
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 19 Aug 2019 18:57:05 GMT
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 29 Jul 2019 21:35:27 GMT
server
Golfe2
age
4814
date
Mon, 19 Aug 2019 17:36:30 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
17724
expires
Mon, 19 Aug 2019 19:36:30 GMT
hotjar-1312741.js
static.hotjar.com/c/
0
0

bat.js
bat.bing.com/
23 KB
7 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
6b4c72b8214beaceed57a85c54eed2c61cfc4911b3d677db9a6e00849ef6be05

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
last-modified
Fri, 02 Aug 2019 18:53:49 GMT
x-msedge-ref
Ref A: 6C06EDC1083A4CB3874DAD9B1DE26C07 Ref B: VIEEDGE0809 Ref C: 2019-08-19T18:56:44Z
status
200
etag
"809cac9e6349d51:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
7126
insight.min.js
sjs.bizographics.com/
15 KB
5 KB
Script
General
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 19 Aug 2019 18:56:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=31992
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
sf14g.js
t.sf14g.com/
0
0

api.min.js
a.optnmstr.com/app/js/
0
0

collect
www.google-analytics.com/
35 B
100 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j78&aip=1&a=107959905&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&ul=en-us&de=UTF-8&dt=New%20Phishing%20Campaign%20Bypasses%20Microsoft%20ATP%20to%20Deliver%20Adwind%20to%20Utilities%20Industry%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGBAgUAB~&jid=501254438&gjid=1890419669&cid=840847004.1566241004&tid=UA-114787942-1&_gid=82040650.1566241004&gtm=2wg8745RQ37KH&z=334587575
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 09 Jul 2019 03:14:11 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
3598953
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j78&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&gjid=1890419669&_gid=82040650.1566241004&_u=YGBAgUAB~&z=712800910
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910&slf_rd=1&random=1385438934
42 B
374 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910&slf_rd=1&random=1385438934
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Aug 2019 18:56:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 19 Aug 2019 18:56:44 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-114787942-1&cid=840847004.1566241004&jid=501254438&_v=j78&z=712800910&slf_rd=1&random=1385438934
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/
0
148 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=26041328&Ver=2&mid=df9458be-b334-0fa4-d5b6-2182e5f78672&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20Phishing%20Campaign%20Bypasses%20Microsoft%20ATP%20to%20Deliver%20Adwind%20to%20Utilities%20Industry%20-%20Cofense&p=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&r=&evt=pageLoad&msclkid=N&rn=950588
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Mon, 19 Aug 2019 18:56:44 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 61FF177A16CB47E58EAA2C09B217BB72 Ref B: VIEEDGE0809 Ref C: 2019-08-19T18:56:44Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
px.ads.linkedin.com/collect/
0
351 B
Script
General
Full URL
https://px.ads.linkedin.com/collect/?time=1566241004409&pid=300721&url=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&fmt=js&s=1
Requested by
Host: sjs.bizographics.com
URL: https://sjs.bizographics.com/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 19 Aug 2019 18:56:44 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-ltx1
status
200
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
20
x-li-uuid
ZcRpLuVnvBXAbV6BJysAAA==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1566241025624&cv=9&fst=1566241025624&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa874&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&tiba=New%20Phishing%20Campaign%20Bypasses%20Microsoft%20ATP%20to%20Deliver%20Adwind%20to%20Utilities%20Industry%20-%20Cofense&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
8ed8ece689af6f78d4b325445a37299c107fe80cf6d2de9680e22b82f2a0a4a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Aug 2019 18:57:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43,39",quic=":443"; ma=2592000; v="46,43,39"
content-length
1064
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/1061448384/
42 B
156 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/1061448384/?random=1566241025624&cv=9&fst=1566237600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa874&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&tiba=New%20Phishing%20Campaign%20Bypasses%20Microsoft%20ATP%20to%20Deliver%20Adwind%20to%20Utilities%20Industry%20-%20Cofense&async=1&fmt=3&cdct=2&is_vtc=1&random=696802705&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Aug 2019 18:57:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1061448384/
42 B
156 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1061448384/?random=1566241025624&cv=9&fst=1566237600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa874&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fnew-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry%2F&tiba=New%20Phishing%20Campaign%20Bypasses%20Microsoft%20ATP%20to%20Deliver%20Adwind%20to%20Utilities%20Industry%20-%20Cofense&async=1&fmt=3&cdct=2&is_vtc=1&random=696802705&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: cofense.com
URL: https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://cofense.com/new-phishing-campaign-bypasses-microsoft-atp-deliver-adwind-utilities-industry/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 19 Aug 2019 18:57:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
k4z6w9b5.stackpathcdn.com
URL
https://k4z6w9b5.stackpathcdn.com/v2/544ec68d/shrMain.min.js
Domain
www.shareaholic.net
URL
https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Domain
k4z6w9b5.stackpathcdn.com
URL
https://k4z6w9b5.stackpathcdn.com/v2/544ec68d/shrMain.min.js
Domain
static.hotjar.com
URL
https://static.hotjar.com/c/hotjar-1312741.js?sv=5
Domain
t.sf14g.com
URL
https://t.sf14g.com/sf14g.js
Domain
a.optnmstr.com
URL
https://a.optnmstr.com/app/js/api.min.js

Verdicts & Comments Add Verdict or Comment

196 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer object| _wpemojiSettings undefined| $ function| jQuery object| cnArgs object| jQuery112407869193389818256 undefined| allps function| _PopupCenter function| generatepass function| hideLockFrame object| equalHeightColumnElements function| PhotoBookGallery boolean| initiated object| html5 object| Modernizr function| yepnope string| wpdm_site_url string| wpdm_home_url string| ajax_url string| wpdm_ajax_url string| wpdm_ajax_popup string| tminusnow function| gtag boolean| publisherConfigLoaded function| Shareaholic object| google_tag_manager object| tCountAjax function| postscribe string| GoogleAnalyticsObject function| ga function| hj object| _hjSettings object| uetq string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email number| sf14gv string| piAId string| piCId undefined| om834_818 function| om834_818_poll function| Attributor object| __utmz object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| WOW object| ivan_vc function| countUp function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| ivan_vc_viewportHeight function| ivan_update_bg function| ivan_parallax_scroll function| iv_initVideoBackground function| iv_initMessageBoxes function| iv_initProgressBar function| iv_initPieChart function| wowInit object| mejs function| MediaElement function| MediaElementPlayer object| localized object| ivan_theme_scripts function| iv_cancelZoom number| _window_width boolean| iv_device_xs boolean| iv_device_sm boolean| iv_device_md boolean| iv_device_lg function| ivan_recalc_sticky_height function| sideHeaderInit function| ivan_fixed_header function| ivan_live_search_init function| ivan_woo_cart_init function| ivan_wpml_languages_dropdown_init function| ivan_login_ajax_init function| ivan_responsive_menus_init function| ivan_responsive_menus_select_init function| ivan_megamenu_init object| ivan_title_paddingTop number| ivan_header_marginTop number| ivan_negative_header_calls function| ivan_negative_height_init function| headerTitleFade function| ivan_post_formats_init function| ivan_post_wp_gallery_init function| ivan_back_to_top_init function| floatedContactForm function| tabsInit function| animatedBlock function| ivan_smooth_links_init function| ivan_floating_contact_form_init function| ivan_portfolio_modern_init function| portfolio_style2 function| ivan_init_mansory_style_blog function| ivan_fix_header_area_height function| ivan_update_mansory_style_blog function| ivan_vc_full_width_container function| ivan_theme_script_load function| ivan_theme_script_ready function| ivan_recalc_dimensions function| enableInstagramFeed object| classie function| getStyleProperty function| getSize object| eventie function| docReady function| EventEmitter function| matchesSelector function| Outlayer function| Packery function| imagesLoaded function| Waypoint function| UET object| addComment object| wp function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleCheckboxes function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| _gformPriceFields undefined| _anyProductSelected function| GFMergeTag function| GFCalc object| gform undefined| __gf_keyup_timeout object| gfMultiFileUploader object| wow string| waypointContextKey function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called object| twemoji function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://cofense.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optnmstr.com
bat.bing.com
cofense.com
dsms0mj1bbhn4.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
k4z6w9b5.stackpathcdn.com
px.ads.linkedin.com
sjs.bizographics.com
static.hotjar.com
stats.g.doubleclick.net
t.sf14g.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.shareaholic.net
a.optnmstr.com
k4z6w9b5.stackpathcdn.com
static.hotjar.com
t.sf14g.com
www.shareaholic.net
216.58.206.2
2600:9000:200c:1600:c:d51b:4400:21
2620:1ec:c11::200
2a00:1450:4001:806::200a
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:815::2003
2a00:1450:4001:816::2004
2a00:1450:4001:824::2003
2a00:1450:400c:c00::9a
2a02:26f0:10c:38f::3adf
2a05:f500:10:101::b93f:9105
35.188.168.180
02b5728af616b0e28cc34dec506dc3ed5c94c4963cfd27056a5bebcdea0a8487
077f9f503fe2387c21f3b4762d372b16d335cbc34ee922a150af282c350fd3f1
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
0e72d4d7a1516d01d305645685a5c0d11b331e854283eb75fb44a45dfe50bdec
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
13c8eb686cafa8179c5a2e71a0bdcc6e805fe053b4b44a1d51af6612e65cd282
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
16ad30dc7c52842f580962e62e29bd0474f9d3d99c93c81b8d384bdb52553719
198e3e673bcd3689b80038e221442efd55bbff4079129f56bdad0b2940ac43b6
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1c80b6cd2eba57ae2b468a90b970f45790801cfd609a37bce090b8b65dc0a55f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1febea0d811318da1ca5f4b52b9e406df837c27e79bf633315f5acf33fb54c9c
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
2348b89c8b4ad214b3588b7a5c0f898f7366ffd81e21de46ecc29d16a1722aa8
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
373a0505368dab061278aa0b7243dc58fc165a25f8b0286d57f8835d06ab6e27
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
3c105d3245aae393bec2bccf0c72039e3d02f73a64856cfe825030c8a8357c5e
40709d33f8087ff2d000f33d3be50a7241409eb411af7878dad1707f49cf1db5
4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4b9329f540f2a0a583e6b0dff71f0f68d819ca3920c752fdb4e6bb1f88659cab
4c940a58b40018214ca32665ff4cf755522b32a027b309cccb950ccd22e27637
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
5abe21f898d69ccc30a452d02b70a828d111204b7c898709c4e74d0620e79451
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
64a9458dcbc3ef9e2e25864aecdf42fb0514f93f554597fee80797f55ca86ce0
6b4c72b8214beaceed57a85c54eed2c61cfc4911b3d677db9a6e00849ef6be05
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
77565a00d3b86cbbd914224f423cdb01b2d5db3c3057c2b69209153cc769c8c1
7bdb61e3c8d532a250616d64673ef916590054dd43da336003f918ebf27f2586
7d59dbec6f211b9b7910a6348a9ca93c4d733c625fd13eba33f8fdaef91a09db
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
8079f5d7997b257c348d5359ea03784ca342e1fa9b9747fb5f5244001b3bb6fa
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
8478633a8d54b7eb20212784040cc4de50aea5cfafe86ad709af371c551cdbf6
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
8ed8ece689af6f78d4b325445a37299c107fe80cf6d2de9680e22b82f2a0a4a9
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
988698cdde3292e370653b137f03fa593cc4cea173f94e99f2111ed168e87dde
98984bbc9d46fc5e6ef61b1882e77303377713b957b6ef0f8475ceca54dc6c18
9a19c05e2be688ed58217f50502e9db3fbe10d17f1eb22b7c9345c5d98943a64
a1c466714cb6757293f3793147a814e8e87dda023dc8a469495fca6b4ad7f05e
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
b1f883af57822077826c9ac07ee32dd79cc07ff96d3115508c12b3c355abf394
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
bd6dfa634b993ea250503f1ada1e7764d843fdf9ab1db00bd8fa7ce2b4d57fe8
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d
de95c17313616699cb855d98bf282f599609fd62b2cfa68646358fcc974258f3
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
ee1a97f49961f87c6aa495dca24759a1ca097b3c8612401e45c09248fae2fffa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f17190694a08c3f14eb0dd51d2ae0b4963e569893db8d2cb620cee83ac62d486
f4799ef2939b8377cf33f07b07b6d90a4a245adbf1c6eaf47ee3b0fcefcc07fe
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
faa4537366f405c58904225222e7f6f69af074f1e10a3a424cac9d78d6c4189f
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
ff09631078dd4af25f0cd2647d53311bbab55dc2c0a5045f8a38baf1a9506b41